Because your browser does not support JavaScript you are missing out on on some great image optimizations allowing this page to load faster.

Microsoft Security Intelligence

Microsoft Security Intelligence

Cart

Sign in

We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names

Published Jul 06, 2008 | Updated Sep 15, 2017

Learn about other threats

Worm:Win32/Slenfbot

Detected by Microsoft Defender Antivirus

Aliases: No associated aliases

Summary

Win32/Slenfbot is a worm that can spread via instant messaging programs, which may include MSN Messenger, Yahoo Messenger and Skype. It may also spread via removable drives or exploiting the MS06-040 vulnerability. This worm spreads automatically via shares, but must be ordered to spread via exploit or instant messaging by a remote attacker. The worm also contains backdoor functionality that allows unauthorized access to an affected machine.

Manual removal is not recommended for this threat. Use the Microsoft Malicious Software Removal Tool, Microsoft Security Essentials, Microsoft Safety Scanner, or another up-to-date scanning and removal tool to detect and remove this threat and other unwanted software from your computer. For more information on Microsoft security products, see http://www.microsoft.com/protect/products/computer/default.mspx.

Disable Autorun functionality

Win32/Slenfbot attempts to spread via removable drives on computers that support Autorun functionality. This is a particularly common method of spreading for many current malware families. For information on disabling Autorun functionality, please see the following article:

http://support.microsoft.com/kb/967715/

Additional remediation instructions for Win32/Slenfbot

This threat may make lasting changes to a computer’s configuration that are NOT restored by detecting and removing this threat. For more information on returning an infected computer to its pre-infected state, please see the following article/s:

Restoring your System Registry:

For Windows 7: http://windows.microsoft.com/en-us/windows7/Back-up-the-registry
For Windows Vista: http://windows.microsoft.com/en-US/windows-vista/Back-up-the-registry
For Windows XP: http://support.microsoft.com/kb/322756/

Resetting System Security Settings to default:

For Windows XP and Vista: http://support.microsoft.com/kb/313222

Viewing hidden and/or system files:

For Windows 7: http://windows.microsoft.com/en-US/windows7/Show-hidden-files
For Windows Vista: http://windows.microsoft.com/en-US/windows-vista/Show-hidden-files
For Windows XP: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/win_fcab_show_file_extensions.mspx?mfr=true

Stopping and starting Windows services:

For Windows 7: http://windows.microsoft.com/en-US/windows7/What-are-Administrative-Tools
For Windows Vista: http://windows.microsoft.com/en-US/windows-vista/What-are-Administrative-Tools
For Windows XP: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sys_srv_start_service.mspx

Enabling Task Manager:

For Windows Vista: http://windows.microsoft.com/en-us/windows-vista/Troubleshoot-Task-Manager-problems
For Windows XP: http://support.microsoft.com/kb/913623/

Enabling System Restore:

For Windows 7: http://windows.microsoft.com/en-us/windows7/What-is-System-Restore
For Windows Vista: http://windows.microsoft.com/en-us/windows-vista/What-is-System-Restore
For Windows XP: http://support.microsoft.com/kb/310405

Enabling Windows Firewall:

For Windows 7: http://windows.microsoft.com/en-US/windows7/Turn-Windows-Firewall-on-or-off
For Windows Vista: http://windows.microsoft.com/en-US/windows-vista/Turn-Windows-Firewall-on-or-off
For Windows XP: http://support.microsoft.com/kb/283673

Enabling Windows Security Center/Action Center alerts:

For Windows 7: http://windows.microsoft.com/en-us/windows7/What-happened-to-Windows-Security-Center
For Windows Vista: http://windows.microsoft.com/en-US/windows-vista/Using-Windows-Security-Center
For Windows XP: http://support.microsoft.com/kb/889737

Recreating a clean HOSTS file:

http://support.microsoft.com/kb/972034