W32/Fubalca.N is a worm. The worm will infect Windows systems.

Upon execution, the worm copies itself as disocoo.exe in Windows Temp folder.

It also creates npptools.dll, Packet.dll, npf.sys and WanPacket.dll in folder where it was executed.

It modifies the registry at the following locations:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

It registers a new service NFP using nfp.sys file dropped by itself.

The worm injects iframe tag to the files with following extensions found in the hard disk.

jsp, php, asp, htm, aspx and html

The injected iframe exploits Microsoft Internet Explorer Object Handling Remote Code Execution Vulnerability to download and execute a file.

The worm then disables antivirus software and Windows System Restore.

This worm first appeared on July 13, 2007.

 Other names of W32/Fubalca.N Worm: