Virus:Worm/VB.bl.2.A
Date discovered:24/10/2006
Type:Worm
In the wild:No
Reported Infections:Low
Distribution Potential:Low to medium
Damage Potential:Medium
Static file:Yes
File size:19.456 Bytes
MD5 checksum:efc854153fbbe960b2da221d4c937288
VDF version:6.36.00.115
IVDF version:6.36.00.131 - Thursday, October 19, 2006

 General Method of propagation:
   • Mapped network drives


Aliases:
   •  Mcafee: Generic BackDoor.k
   •  Kaspersky: Virus.Win32.VB.bl
   •  Bitdefender: Generic.Malware.SD.05261FA0


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Drops a file
   • Registry modification

 Files It copies itself to the following locations:
   • %WINDIR%\Desktop.com
   • %SYSDIR%\Check.exe
   • %SYSDIR%\Direct.com
   • %HOME%\Start Menu\Programs\Startup\Scan.pif



It overwrites the following files.
– %all directories%

File extension:
   • .doc

With the following contents:
   • %executed file%




The following file is created:

– A file that is for temporary use and it might be deleted afterwards:
   • %TEMPDIR%\~DF%four-digit random character string%.tmp

 Registry The following registry keys are continuously in an infinite loop added in order to run the processes after reboot.

–  [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "Check"="%SYSDIR%\Check.exe"

–  [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "Desktop"="%WINDIR%\Desktop.com"



The following registry key is added:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   • "NoFind"=hex(4):31
   • "NoFolderOptions"=hex(4):31



The following registry keys are changed:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
   New value:
   • "DisableRegistryTools"=dword:00000030
     "DisableTaskMgr"=dword:00000030

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   New value:
   • "Hidden"=hex(4):32
     "HideFileExt"=hex(4):31

 File details Programming language:
 The malware program was written in Visual Basic.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
   • UPX

Description inserted by Monica Ghitun on Tuesday, October 24, 2006
Description updated by Monica Ghitun on Wednesday, November 22, 2006

Back . . . .