Forten is an email worm written in Java, that replicates by replacing the signature of Outlook Express with a link to an infected web site. When an user opens an infected email, the link is activated and the worm code is executed from the web site.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Variant:Forten.AJava/Forten.AJS/Fortnight.C
When a user opens or views an infected email, the invisible frame embedded into message will be activated. This causes the browser to connect a web site that contains a small javascript code. The javascript code will in turn download and activate the Java applet ("a.jar") that contains the worm code.
When the JAR file is executed it uses Microsoft Internet Explorer VerifierBug vulnerability to get full privileges by escaping the Java security, and execute its code. Then the JAR will alter the Internet Explorer search settings and add three pages to the Favorities folder.
Further, the worm disables Internet Explorer both Security and Advanced tabs from the settings dialog.
The JAR will then drop two files, "hosts" and "s.htm" to the Windows installation directory. It modifies the registry so that Outlook Express will use the "s.htm" file as the default signature. The "hosts" file contains a set of domain names that will be redirected to a different web site instead of the real addresses. The redirection works only in Windows 95, 98 and Me. The "hosts" file has to be removed manually from the infected system.
Additionally the changes into Internet Explorer setting will cause that the web sites accessed via Internet Explorer without specifying the protocol (http://) will be redirected to another web site. This web site will then redirect the browser to correct address.
Further information about the vulnerability in the Microsoft Java VM, including a fix, is available at: https://www.microsoft.com/technet/security/bulletin/ms03-011.asp
Variant:Forten.BJava/Forten.B
This is a functionally similar to the Forten.A. This variant does not create the "hosts" file to the Windows installation directory, but into Windows' "system32\drivers\etc" directory instead. In this way the "hosts" file is active on Windows NT, 2000 and XP. However, the created "hosts" file is empty.
Additionally this variant adds three buttons to the Internet Explorer toolbar.
Variant:Forten.C
This variant is functionally identical to Forten.B
Variant:Forten.D
This variant behaves in a same way as Forten.A, however, the exact addresses of the files in the web has been changed as the previous sites were closed.
Variant:Forten.E
This variant is functionally identical to Forten.D
Variant:Forten.F
This variant is functionally identical to other Forten variants, with the exception that it won't infect systems where browser language is set to Russian.
Variant:Forten.G
This variant is functionally identical to Forten.F