Worm.Abfewsm.A

Worm.Abfewsm.A is a self replicating and malicious worm first released on 23 April 2009. This worm spreads itself by placing copies of itself in the folder used for copying files onto CDs. This worm is a serious security threat to any PC, as it has the ability to modify a variety of system services and settings. It has also been reported that Worm.Abfewsm.A will disable the user’s access to the Control Panel and other registry editors. It will also modify the settings or even completely disable the PC’s Firewall.

This worm was created by unscrupulous cyber criminals so as to allow them access to infected PCs. A large number of annoyances and disturbances will begin to plague the system as soon as Worm.Abfewsm.A successfully infects the PC. First of all it will modify the following processes automatically, without any user interaction being required:

Remote Desktop Sharing service
Terminal Server service
UPnP device hosting
Removable Storage service
Telnet Server service

It will also modify system registry entries by
Adding value: Start
With data: 2
To subkey: HKLM\SYSTEM\ControlSet001\Services\mnmsrvc

Worm.Abfewsm.A will also modify the following registry entry which will effectively prevent the system’s Firewall from working:

Modifies value: "Epoch"
From data: "6A, 60, 00, 00"
To data: "6B, 60, 00, 00"
In subkey: HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Epoch

Other symptoms of this infection include the disabling of the option in Windows Explorer to ‘show all files.’ This allows Worm.Abfewsm.A to hide certain system files and folders’ contents from the user, and the user being powerless to stop it. Worm.Abfewsm.A will also change the window title for Internet Explorer to ‘Internet Exploiter’.

Throughout the entire attack of Worm.Abfewsm.A on the system, users will not be aware of its presence on the system except through security notifications received from installed security software. Users infected with Worm.Abfewsm.A can have their systems hijacked by these faceless remote hackers to be used as part of mass spamming campaigns, or have it used as part of Denial of Service (DoS) attacks, without there being anything to reflect back to Worm.Abfewsm.A’s developers.

It is for these reasons, as well as the rapid deterioration of your PC that you have to destroy Worm.Abfewsm.A with the help of a powerful security tool. This will not only get rid of Worm.Abfewsm.A for good, but will also protect your PC against similar future attacks.