W32/Falgna Worm

 Information about the W32/Falgna Worm:

W32/Falgna is a worm. The worm will infect Windows systems.

This worm steals system information and opens a back door on the infected computer allowing a remote attacker to have unauthorized access.

Upon execution, the worm creates the following files in the Windows System folder;

MSINSCK.OCX, Rtmp.bat, Rtmp.log, Rtmp.scr, Rtmp.scr, ALMV.exe, DLMVT.exe, DLMVD.exe, DLMVX.exe, DLMVP.exe and RCS.exe

It also creates the following files on a removable drive;

Autorun.inf, ALMV.exe, MVH.exe and MVS.exe

It modifies the registry at the following locations:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters \FirewallPolicy\StandardProfile\AuthorizedApplications\List
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet001\Services\SharedAccess\Parameters \FirewallPolicy\StandardProfile\AuthorizedApplications\List
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL

The backdoor component of the worm opens TCP port 3891, which allows the remote attacker to access the compromised machine.

The worm also steals the critical information of the infected computer and saves as Rtmp.log in the Windows System folder and sends it to the remote attacker via FTP.

This worm first appeared on January 18, 2007.

 Other names of W32/Falgna Worm:

This Worm is also known as W32.Falgna.