Need to fix your PC?
Hire an Expert
Virus:Worm/Darby.O
Date discovered:13/12/2012
Type:Worm
In the wild:Yes
Reported Infections:Low
Distribution Potential:Medium to high
Damage Potential:Medium
Static file:Yes
File size:140.470 Bytes
MD5 checksum:c7a286a790fcb6b93264b2cc26522cf3
VDF version:7.11.53.216

 General Methods of propagation:
   • Email
   • Local network
   • Peer to Peer


Aliases:
   •  Symantec: W32.Darby.B
   •  Kaspersky: P2P-Worm.Win32.Darby.o
   •  TrendMicro: WORM_DARBY.O
   •  Sophos: W32/Darby-O
   •  Grisoft: Worm/Darby.S
   •  VirusBuster: Worm.P2P.Darby.Q
   •  Bitdefender: Win32.Worm.P2P.Darby.O


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows 2000
   • Windows XP


Side effects:
   • Uses its own Email engine
   • Lowers security settings
   • Registry modification


Right after execution the following information is displayed:


 Files It drops copies of itself using a filename from lists
– To: %SYSDIR%\ Using one of the following names:
   • %random character string%.exe
   • %random character string%.bat
   • %random character string%.cmd
   • %random character string%.scr




The following files are created:

– Non malicious files:
   • %SYSDIR%\bZip.exe
   • c:\bardiel.hta

– A file that contains collected email addresses:
   • %TEMPDIR%\mail.dat

 Registry The following registry key is added in order to run the process after reboot:

– HKLM\Software\Microsoft\Windows\CurrentVersion\Run
   • %random character string%=%SYSDIR%\%random character string%



The following registry keys are added:

– HKLM\Software\GedzacLABS\Bardiel.d
   • "Parent" = "%SYSDIR%\%random character string%
   • "Sey3" = "%random character string%)%random character string%"
   • "Sey2" = "%random character string%)%random character string%"
   • "Sey1" = "%random character string%)%random character string%"

– HKLM\Software\Microsoft\Active Setup\Installed Components\Bardiel
   • "StubPath" = "%SYSDIR%\%random character string%

– HKLM\SYSTEM\CurrentControlSet\Services\GEDZAC LABS
   • "ImagePath" = "%SYSDIR%\%random character string%"
   • "DisplayName" = "GEDZAC Service"
   • "ObjectName" = "LocalSystem"
   • "ErrorControl" = dword:00000001
   • "Start" = dword:00000002
   • "Description" = "GEDZAC Service for W32.Bardiel.D"
   • "Type" = dword:00000010

Disable Regedit and Task Manager:
– HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
   Old value:
   • "Shell" = "%user defined settings%"
   New value:
   • "Shell" = "Explorer.exe %SYSDIR%\%random character string%"

Disable Regedit and Task Manager:
– HKCR\regfile\shell\open\command
   Old value:
   • "@" = "%user defined settings%"
   New value:
   • "@" = "GDC"

– HKLM\Software\Microsoft\Windows Scripting Host\Settings
   Old value:
   • "Timeout" = dword:00000000
   New value:
   • "Timeout" = dword:00000000

– HKLM\Software\Microsoft\Windows Script Host\Settings
   Old value:
   • "Timeout" = dword:00000000
   New value:
   • "Timeout" = dword:00000000

– HKCU\Software\Microsoft\WindowsNT\CurrentVersion\Policies\System
   Old value:
   • "DisableTaskMgr" = %user defined settings%
   • "DisableRegistryTools" = %user defined settings%
   New value:
   • "DisableTaskMgr" = dword:00000001
   • "DisableRegistryTools" = dword:00000001

– HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
   Old value:
   • "DisableTaskMgr" = %user defined settings%
   • "DisableRegistryTools" = %user defined settings%
   New value:
   • "DisableTaskMgr" = dword:00000001
   • "DisableRegistryTools" = dword:00000001

– HKCR\exefile\shell\open\command\
   Old value:
   • "@" = "%user defined settings%"
   New value:
   • "@" = "%SYSDIR%\%random character string%"%1" %*"

– HKCR\batfile\shell\open\command\
   Old value:
   • "@" = "%user defined settings%"
   New value:
   • "@" = "%SYSDIR%\%random character string%"%1" %*"

– HKCR\comfile\shell\open\command\
   Old value:
   • "@" = "%user defined settings%"
   New value:
   • "@" = "%SYSDIR%\%random character string%"%1" %*"

– HKCR\piffile\shell\open\command\
   Old value:
   • "@" = "%user defined settings%"
   New value:
   • "@" = "%SYSDIR%\%random character string%"%1" %*"

– HKCR\scrfile\shell\open\command\
   Old value:
   • "@" = "%user defined settings%"
   New value:
   • "@" = "%SYSDIR%\%random character string%"%1" %*"

 Email It contains an integrated SMTP engine in order to send emails. A direct connection with the destination server will be established. The characteristics are described in the following:


From:
The sender address is spoofed.


To:
– Email addresses found in specific files on the system.
– Email addresses gathered from WAB (Windows Address Book)


Email design:
 


Subject: Mail Delivery Return System
Body:
   • La informaci
     n no pudo ser enviada a uno o m
     s destinatarios
Attachment:
   • ReturnMsg.zip ReturnMsg
 


Subject: Hola %username from receiver's email address%
Body:
   • Te envio la info que me pediste, responde que tal esta, bye
Attachments:
   • videoClip.zip
   • Tienes un Mensage %username from receiver's email address%
 


Subject: Sabes si te mienten?
Body:
   • El lenguage corporal delata sutilmente la mentira, 5 tips para saber si te estan diciendo la verdad.
Attachments:
   • NoMentir.zip
   • NoMentir
 


Subject: Manual de Seduccion
Body:
   • Quieres mejorar tu exito con el sexo opuesto, pos echale un ojo a este texto. que tiene utiles consejos
Attachments:
   • Seduc.zip
   • Arte de Seducir
 


Subject: tienes un Regalo Virtual
Body:
   • Te han enviado un Regalo virtual, esta disponible durante 7 dias, descargalo o entra al link :)
Attachments:
   • Virtual0034.zip
   • %username from receiver's email address%
 


Subject: Gusanito.com
Body:
   • Hay una targeta disponible para ti de parte de un amigo. descargala o entra al link :)
Attachments:
   • E-Card.zip
   • Targeta Virtua
 


Subject: Fotos en tu email
Body:
   • XXX Todo Vale XXX
Attachments:
   • xImages.zip
   • Mirame ;)
 


Subject: Que hay detras de un beso
Body:
   • Sabes que significa la forma de besar o que tipos y tecnicas existen, conocelas
Attachments:
   • beso.zip
   • Besos
 


Subject: Sexo Tantrico
Body:
   • Tantra: antigua disciplina oriental para mejorar el desempe
Attachments:
   • Sex_Tantra.zip
   • Sexo Tantrico Images
 


Subject: No Adware
Body:
   • Se te cambia la pagina de inicio?, te salen ventanas de publicidad, problemas con dialers, troyanos u otros adwares, prueba este programa gratis y acabemos con la lacra que es el Adware
Attachments:
   • CwshredderPlus.zip
   • Limpiar Pc
 


Subject: Hey
Body:
   • mira la imagen 30 segundos y luego mira a otra parte y veras algo sorprendente (buena ilusion optica, casi alucinacion)
Attachments:
   • IlusionI.zip
   • Imagenes
 


Subject: Mira la foto
Body:
   • Mira mi foto ;)
Attachments:
   • Photo.zip
   • Mi Album
 


Subject: Que significa tu nombre?
Body:
   • Los nombres y los apellidos como toda palabra tienen un significado, el cual ya en la mayoria de veces o no recordamos, tal vez encuentres el significado del tuyo en nuestra base de datos :)
Attachments:
   • SigNombre.zip
   • Tu Nombre
 


Subject: Eres inteligente? ;)
Body:
   • El Papa de rosa era un empleado en una compa
     ia de seguros, vivia modestamente, tenia una casa mediana, un auto no muy nuevo y un perro, pero lo que el queria m
     s eran sus 3 hijas: Ana, Ane y ...
     Como se llamaba su otra hija?
Attachments:
   • RptAcertijos.zip
   • Respuesta
 


Subject: Hack Hotmail
Body:
   • Quisiste hackear una cuenta de hotmail alguna vez, entonces prueba esta tecnica, y lo bueno es que no se nesecita ser un Hacker para usarla.
Attachments:
   • HackHotmail.zip
   • HackHotmail
 


Subject: Respuesta para
Body:
   • La respuesta a su pedido ha sido aprobada, con lo que se hace acreedor de las ventajas y descuentos de nuestro circulo, para mas detalles vea texto el adjunto.
Attachments:
   • Respuesta para %username from receiver's email address% .zip
   • Admin Page
 


Subject: Importante para
Body:
   • Hola, no me conoces, pero te envio algo que te interesara, ojala te sea de utilidad, bye
Attachments:
   • _msg.zip
   • Mensage
 


Subject: Click en el adjunto y pon audifono :)
Body:
   • Escuchate esta cancion, Carta a Santa Claus III ;)
Attachments:
   • FuckSanta.zip
   • Play Song
 


Subject: quieres saber cuan psicopata eres?
Body:
   • Este es un test usado por el ejercito de estados unidos al reclutar soldados, para en palabras simples medir cuan propensos a la locura son, hacelo y ve cuan zafado estas.
Attachments:
   • TestRayado.zip
   • Test Aqui
 


Subject: Dibujitos (Esta Buenisimo)
Body:
   • Mirate esto ;)
Attachments:
   • Dibujitos.zip
   • at the picture
 


Subject: Osama Ben Laden el hombre que le declaro la Guerra a Estados Unidos
Body:
   • Que lo indujo a dejar una posible vida de lujos(es millonario), para embarcarse en una guerra santa contra USA, sabias que las familias de Bush y Osama se conocian, enterate de las verdaderas causas de su guerra aqui.
Attachments:
   • Osama.zip
   • Osama Web
 


Subject: PornStars Show
Body:
   • Mira este scrensaver de las actrices del cine porno
Attachments:
   • PornStars.zip
   • PorStars All Access
 


Subject: Solo la pura verdad
Body:
   • Asi es la vida :(
     e picture
     Solo la Pura Verdad
Attachment:
   • ZALIA.zip
 


Subject: 16 Fotos de las mejores conejitas de Playboy
Body:
   • Las mejores fotos de PlayBoy de este a o, pasalas ;)
Attachments:
   • 16Playboy.zip
   • Planeta PlayBoy
 


Subject: Aviso Importante
Body:
   • Debido a las reformas del servidor, se pide a los usuarios completar el nuevo registro a fin de validar sus cuentas y no sean suspendidas. Atentamente AdminSystem
Attachments:
   • Registro.zip
   • Nuevo Registro
 


Subject: Diez mandamientos del Amor y Sexo
Body:
   • Mantener una relacion amorosa saludable y exitante exige mucho esfuerzo y muchas ganas, te damos estas 10 claves
Attachments:
   • 10Claves.zip
   • Amor y Sexo
 


Subject: Como Saber si le Gustas?
Body:
   • Te mueres por esa persona, pero no sabes si decirle algo, porque capaz no te da bola, con este test puedes descubrir detalles que te indiquen que siente por ti :)
Attachments:
   • TestG.zip
   • My Page
 


Subject: 100% Ideal
Body:
   • Participa en este rompecabezas, si se pudiera crear a la(el) Chica(o) Ideal escogiendo un rostro de aqui y una silueta de alla, como seria tu pareja Ideal?
Attachments:
   • Ideal.zip
   • 100% Ideal
 


Subject: Vision del Futuro
Body:
   • TodO hA sIdO Dad0
Attachments:
   • TuFuturo.zip
   • Necromancia
 


Subject: Que Raro
Body:
   • Miralo tu mismo
Attachments:
   • QueRaro.zip
   • Que Raro
 


Subject: Mail Delivery Return System
Body:
   • The information could not be a correspondent to one or more addressees.
Attachments:
   • ReturnMsg.zip
   • ReturnMsg
 


Subject: Hello %username from receiver's email address%
Body:
   • I ship You the info that you requested me, responds that such this, bye
Attachments:
   • videoClip.zip
   • you Have a Mensage
 


Subject: do you Know if they lie you?
Body:
   • The corporal language accuses the lie subtly, 5 tips to know if they are telling you the truth.
Attachments:
   • Lie.zip
   • NotLie
 


Subject: Manual gives Seduction
Body:
   • you Want to improve your success with the opposite sex, search keeps an eye on this text. that has useful advice.
Attachments:
   • Seduc.zip
   • Art gives to Seduce
 


Subject: %username from receiver's email address% you have a Virtual Gift
Body:
   • they have sent You a virtual Gift, this available one during 7 days, discharge it or enters to the link:)
Attachments:
   • Virtual0034.zip
   • %username from receiver's email address%
 


Subject: Gusanito.com
Body:
   • there is an available card for you on behalf of a friend. discharge it or enters to the link:)
Attachments:
   • EL-Card.zip
   • Virtual Card
 


Subject: Pictures in your email
Body:
   • XXX All Voucher XXX
Attachments:
   • xImages.zip
   • you Look at me ;
 


Subject: That there is behind a kiss
Body:
   • you Know that it means the form gives to kiss or that types and techniques exist, know them
Attachments:
   • Kiss.zip
   • Kisses
 


Subject: No Adware
Body:
   • are you changed the it paginates beginning he/she gives?, do they leave you windows publicity he/she gives, problems with dialers, troyanos or other adwares, does it prove this program free and do let us put an end to the insensitive one that the Adware is.
Attachments:
   • CwshredderPlus.zip
   • to Clean Pc
 


Subject: Sex Tantrico
Body:
   • Tantra: ancient discipline oriental to improve the sexual acting. Know it
Attachments:
   • Sex_Tantra.zip
   • Sex Tantrico Images
 


Subject: Hey %username from receiver's email address%
Body:
   • %username from receiver's email address% he/she looks at the image 30 second and then he/she looks to another part and truth at something surprising (good optic illusion, almost hallucination)
Attachments:
   • IlusionI.zip
   • Images
 


Subject: %username from receiver's email address% Looks at the picture
Body:
   • Looks at my picture;)
Attachments:
   • Ph0t0.zip
   • My Album
 


Subject: That means your name?
Body:
   • The names and the last names like all word have a meaning, the one which already in most he/she gives times or we don't remember, perhaps find the meaning he/she gives yours in our database:)
Attachments:
   • SigName.zip
   • Your Name
 


Subject: are you intelligent? ;)
Body:
   • The Father gives Sandra was an employee in an insurance company, lived modestly, tapeworm a medium house, a car very new no and a dog, but what the one wanted more they were its 3 daughters: Ana, Ane and... Like their other daughter was called?
Attachments:
   • Riddles
   • Answer
 


Subject: Hack Hotmail
Body:
   • you Wanted hackear one it counts gives hotmail at some time, then test this technique, and the good thing is that no you need to be a Hacker to use it
Attachments:
   • HackHotmail.zip
   • HackHotmail
 


Subject: Answer for %username from receiver's email address%
Body:
   • it is This way the life :(
     The answer to its order has been approved, with what becomes accrediting gives the advantages and discounts gives our I circulate, for but you detail sees text the assistant
Attachments:
   • %username from receiver's email address% .zip
   • Admin Page
 


Subject: Important for %username from receiver's email addre
Body:
   • Hello, you don't know me, but I ship you something that interested you, God willing it is you gives utility, bye
Attachments:
   • _msg.zip
   • Message
 


Subject: Click in the assistant and put earphone:)
Body:
   • you Listen to yourself this song, Letter to Santa Claus III ;)
Attachments:
   • FuckSanta.zip
   • Play Song
 


Subject: do you want to know how psychopath you are?
Body:
   • This is a test used for the I exercise gives states together to recruiting soldiers, it stops in simple words to measure how prone to the madness they are, and you go how released these.
Attachments:
   • CrazyTest.zip
   • Test Here
 


Subject: Drawings (This Very Good)
Body:
   • you Look at yourself this ;)
Attachments:
   • Drawings.zip
   • MORE Drawings
 


Subject: Osama Ben Laden the man that I declare the War to United States
Body:
   • That induced it to leave a possible life he gives luxuries, to go aboard in a sacred war against it USES, wise that the families give Bush and Osama they knew each other, find out he gives the true causes he gives their war
Attachments:
   • Osama.zip
   • Osama Web
 


Subject: PornStars Show
Body:
   • Looks at this scrensaver gives the actresses he/she gives the cinema porn
Attachments:
   • PornStars.zip
   • PorStars All Access
 


Subject: Alone the pure truth
Body:
   • it is This way the life :(
Attachments:
   • e picture
   • Alone the pure truth
 


Subject: 16 Pictures give the best doe gives Playboy
Body:
   • The best pictures give PlayBoy gives this year, it passes them ;)
Attachments:
   • 16Playboy.zip
   • Planet PlayBoy
 


Subject: I Warn Important
Body:
   • %username from receiver's email address% due to the reformations he/she gives the servant, it is asked the users to complete the new registration in order to validate their you count and don't be suspended. Sincerely AdminSystem"
Attachments:
   • Registry.zip
   • New Registry
 


Subject: Ten commandments give the Love and Sex
Body:
   • to Maintain a healthy loving relationship and upper demands a lot of effort and many desires, we give you these 10 keys
Attachments:
   • 10Claves.zip
   • Love and Sex
 


Subject: As Knowing if he Likes?
Body:
   • you die for that person, but you don't know if to tell him something, because capable doesn't give you ball, with this test you can discover specificses that indicate you that it feels for you :)
Attachments:
   • TestG.zip
   • My Page
 


Subject: 100% Ideal
Body:
   • %username from receiver's email address% does it Participate in this puzzle, if you could create to the Girl (or Boy) Ideal choosing a face gives here and does a silhouette give there, as serious your Ideal couple?
Attachments:
   • Ideal.zip
   • 100% Ideal
 


Subject: Vision gives the Future
Body:
   • Everything has Been given
Attachments:
   • YourFuture.zip
   • Necromancy
 


Subject: YourFuture.zip
Body:
   • you Look at it your same one
Attachments:
   • ThatStrange.zip
   • That Strange


Attachment:

The attachment is a copy of the malware itself.



The email looks like the following:


 Mailing Search addresses:
It searches the following files for email addresses:
   • .htm
   • .txt
   • .php
   • .asp


Avoid addresses:
It does not send emails to addresses containing one of the following strings:
   • virus; master; persys; perant; abuse; report; panda; symantec; trend;
      avp; kasp; nod; support; admin; foo; iana; messagelab; microsoft; msn;
      anyone; bug; f-secur; free-av; google; help; info; linux; soporte;
      nobody; noone; noreply; rating; root; samples; sopho; spam; unix; upd;
      winrar; winzip


MX Server:
It has the ability to contact one of the following MX servers:
   • mdm@latinmail.com
   • mx1.hotmail.com
   • mdm@hotmail.com
   • correo.viabcp.com

 P2P In order to infect other systems in the Peer to Peer network community the following action is performed:   It searches for the following standard shares:
   • appleJuice\incoming
   • eDonkey2000\incoming
   • Gnucleus\Downloads
   • Grokster\My Grokster
   • ICQ\shared files
   • Kazaa\My Shared Folder
   • Kazaa Lite\My Shared Folder
   • LimeWire\Shared
   • morpheus\My Shared Folder
   • Overnet\incoming
   • Shareaza\Downloads
   • Swaptor\Download
   • WinMX\My Shared Folder
   • Tesla\Files
   • XoloX\Downloads
   • Rapigator\Share
   • KMD\My Shared Folder
   • BearShare\Shared
   • Direct Connect\Recieved Files
   • eMule\Incoming
   • Kazaa Lite K++\My Shared Folder
   • My Downloads

   It searches for all shared standard directories.

   If successful, the following files are created:
   • Quick Time Key Crack.exe; Ana Kournikova Sex Video.exe; AVP Antivirus
      Pro Key Crack.exe; Britney Spears Sex Video.exe; Buffy Vampire Slayer
      Movie.exe; Crack Passwords Mail.exe; Cristina Aguilera Sex Video.exe;
      Game Cube Real Emulator.exe; delphi.exe; Hentai Anime Girls Movie.exe;
      Jenifer Lopez Sex Video.exe; Matrix Movie.exe; Mcafee Antivirus Scan
      Crack.exe; Norton Anvirus Key Crack.exe; Panda Antivirus Titanium
      Crack.exe; PS2 PlayStation Simulator.exe; divx pro.exe; Sakura Card
      Captor Movie.exe; Sex Live Simulator.exe; Sex Passwords.exe; Spiderman
      Movie.exe; Start Wars Trilogy Movies.exe; Thalia Sex Video.exe; Winzip
      KeyGenerator Crack.exe; aol cracker.exe; aol password cracker.exe; GTA
      3 Crack.exe; GTA 3 Serial.exe; play station emulator.exe; virtua girl
      - adriana.exe; virtua girl - bailey short skirt.exe; Virtua Girl
      (Full).exe; warcraft 3 crack.exe; warcraft 3 serials.exe;
      counter-strike.exe; divx_pro.exe; HotGirls.exe; hotmail_hack.exe;
      pamela_anderson.exe; serials2000.exe; subseven.exe; VB6.exe;
      VirtualSex.exe; ACDSee 5.5.exe; Age of Empires 2 crack.exe; Animated
      Screen 7.0b.exe; AOL Instant Messenger.exe; AquaNox2 Crack.exe;
      Audiograbber 2.05.exe; BabeFest 2004 ScreenSaver 1.5.exe; Babylon
      3.50b reg_crack.exe; Battlefield1942_bloodpatch.exe;
      Battlefield1942_keygen.exe; DirectX InfoTool.exe; Business Card
      Designer Plus 7.9.exe; Clone CD 5.0.0.3 (crack).exe; Clone CD
      5.0.0.3.exe; Coffee Cup Free zip 7.0b.exe; Cool Edit Pro v2.55.exe;
      Diablo 2 Crack.exe; DirectDVD 5.0.exe; DirectX Buster (all
      versions).exe; DivX Video Bundle 6.5.exe; Download Accelerator Plus
      6.1.exe; DVD Copy Plus v5.0.exe; DVD Region-Free 2.3.exe; FIFA2004
      crack.exe; Final Fantasy VII XP Patch 1.5.exe; Flash MX crack
      (trial).exe; FlashGet 1.5.exe; FreeRAM XP Pro 1.9.exe; GetRight
      5.0a.exe; Global DiVX Player 3.0.exe; Gothic2 licence.exe; Guitar
      Chords Library 5.5.exe; Hitman_2_no_cd_crack.exe; Hot Babes XXX Screen
      Saver.exe; ICQ Pro 2004a.exe; SmartRipper v2.7.exe; ICQ Pro 2004b (new
      beta).exe; iMesh 3.6.exe; iMesh 3.7b (beta).exe; IrfanView 4.5.exe;
      KaZaA Hack 2.5.0.exe; KaZaA Speedup 3.6.exe; Links 2004 Golf game
      (crack).exe; Living Waterfalls 1.3.exe; Mafia_crack.exe; Matrix
      Screensaver 1.5.exe; MediaPlayer Update.exe; mIRC 6.40.exe; mp3Trim
      PRO 2.5.exe; MSN Messenger 5.2.exe; NBA2004_crack.exe; Need 4 Speed
      crack.exe; Nero Burning ROM crack.exe; Netfast 1.8.exe; SmartFTP
      2.0.0.exe; Network Cable e ADSL Speed 2.0.5.exe; NHL 2004 crack.exe;
      Nimo CodecPack (new) 8.0.exe; PalTalk 5.01b.exe; Popup Defender
      6.5.exe; Pop-Up Stopper 3.5.exe; QuickTime_Pro_Crack.exe; Serials 2004
      v.8.0 Full.exe; Space Invaders 1978.exe; Splinter_Cell_Crack.exe;
      Steinberg_WaveLab_5_crack.exe; Trillian 0.85 (free).exe; TweakAll
      3.8.exe; Unreal2_bloodpatch.exe; Unreal2_crack.exe;
      UT2004_bloodpatch.exe; UT2004_keygen.exe; UT2004_no cd (crack).exe;
      UT2004_patch.exe; WarCraft_3_crack.exe; Winamp 3.8.exe; WindowBlinds
      4.0.exe; WinOnCD 4 PE_crack.exe; WinZip 9.0b.exe; Yahoo Messenger
      6.0.exe; Zelda Classic 2.00.exe; Windows XP complete + serial.exe;
      Screen saver christina aguilera.exe; Screen saver christina aguilera
      naked.exe; Visual basic 6.exe; Starcraft serial.exe; Credit Card
      Numbers generator(incl Visa,MasterCard,...).exe; Edonkey2000-Speed me
      up scotty.exe; Hotmail Hacker 2004-Xss Exploit.exe; Kazaa SDK + Xbit
      speedUp for 2.xx.exe; Microsoft KeyGenerator-Allmost all microsoft
      stuff.exe; Netbios Nuker 2004.exe; Security-2004-Update.exe; Stripping
      MP3 dancer+crack.exe; Visual Basic 6.0 Msdn Plugin.exe; Windows Xp
      Exploit.exe; WinRar 3.xx Password Cracker.exe; WinZipped Visual C++
      Tutorial.exe; XNuker 2004 2.93b.exe; cable modem ultility pack.exe;
      macromedia dreamweaver key generator.exe; winamp plugin pack.exe;
      winzip full version key generator.exe; PerAntivirus 8.9.exe; The
      Hacker Antivirus 5.7.exe

   These files are copies of the malware itself.



The shared directory might look like the following:


 Network Infection It uses the following login information in order to gain access to the remote machine:

– The following list of usernames:
   • Andrea; Pamela; Patricia; Cristina; Adriana; Katherine; July; Vanessa;
      Jennifer; Karina; Janeth; Dulce; Bill; Alejandro; Dark; Bracho;
      Torres; Aguilar; Martinez; Lugo; Costa; Velarde; Varela; Helsim;
      Valencia; Mancilla; Braschi; Wong; Chang; Mora; Arana; Alvites; Start;
      Toledo; Flores; Garcia; Orellana; Hoyos; Perez; Campos; Humala;
      Alvarez; Valenzuela; Luque

– The following list of passwords:
   • "123"; "1234"; "12345"; "123456"; "1234567"; "12345678"; "654321";
      "54321"; "111"; "11111"; "111111"; "11111111"; "000000"; "00000000";
      "pass"; "5201314"; "88888888"; "888888"; "passwd"; "password";
      "database"; "test"; "server"; "computer"; "secret"; "oracle";
      "sybase"; "Internet"; "super"; "user"; "manager"; "public"; "private";
      "default"; "1234qwer"; "123qwe"; "abcd"; "abc123"; "123abc"; "abc";
      "123asd"; "dos"; "asdfgh"; "!@; $"; "!@; $%"; "!@; $%^"; "!@; $%^&";
      "!@; $%^&*"; "!@; $%^&*("; "!@; $%^&*()"; "intel"; "KKKKKKK"; "09876"


 IRC Spreading:
–The Mirc.ini file gets modified.

 Process termination It tries to terminate the following processes and delete the corresponding files:
   • avx; adaware; advxdwin; alevir; arr; auto-protect; Avg; avw; ahnsd;
      apvxdwin; anti-trojan; avsched32; avconsol; ackwin32; autodown; alert;
      amon; avmon; antivir; avsynmgr; avnt; avrep32; ants; atcon; atupdater;
      atwatch; autotrace; aplica32; atro55en; aupdate; autoupdate; avrescue;
      agent; avltmain; backweb; blackice; blackd; bd_professional; bidef;
      bidserver; bipcp; bisp; bootwarn; borg2; bs120; buscareg; clrav;
      claw95ct; cfiaudit; cfiadmin; cmgrdian; ctrl; cfind; cfinet; ccapp;
      claw95; cpd; cleanpc; cmon016; cpf9x206; cpfnt206; csinject; csinsm32;
      css1631; cwnb181; cwntdwmo; ccevtmgr; ccpxysvc; dv95; dvp95; defwatch;
      defalert; doors; deputy; dpf; drwatson; drweb32; drwebupw; efinet32;
      espwatch; esafe; efpeadm; etrustcipe; evpn; ecengine; eli; findviru;
      f-agnt95; frw; f-stopw; filemon; f-prot; fch32; fih32; fp-win; fsgk32;
      fnrb32; fsaa; fameh32; fast; fix-it; flowprotector; fp-win_trial;
      fsav; fsm; fwenc; gbmenu; gbpoll; generics; guard; hacktracer; htlog;
      icssuppnt; icload; iamapp; icsupp95; ibma; iomon98; icmo; iface; iams;
      ifw2000; iparmor; iris; isrv95; jed; jammer; kpf; kavlite; kerio;
      luall; lookout; lockdown; lucomserver; ldpromenu; luspt; ldnetmon;
      ldpro; localnet; lsetup; luau; luinit; mpftray; moolive; msconfig;
      monitor; mcmnhdlr; mctool; mcupdate; mcvsrte; mghtml; minilog;
      mcvsshld; mpfservice; mwatch; mcshield; mfw2en; mfweng3; mgavr; mgui;
      monsys; monwow; mrflux; msinfo32; mssmmc32; mu0311ad; mxtask; nav;
      netd32; nod32; nspclean; nmain; nvc95; nisum; nupgrade; per; nwtool16;
      normist; nisserv; nsched32; neowatchlog; nvsvc32; nwservice;
      ntxconfig; ntvdm; npssvc; npscheck; netutils; ndd32; notstart; nc2000;
      ncinst4; netarmor; netinfo; netmon; pav; netspyhunter; netstat; npf;
      nui; nvarch16; nvlaunch; nwinst4; nvapsvc; outpost; offguard;
      ostronet; procexp; pcfwallicon; programauditor; pop3trap; poproxy;
      pcntmon; padmin; pview95; pcc; pqremove; pfwcon; pfwagent; pfwsvc;
      prebind; panixk; pcdsetup; pcip10117_0; pf2; pfwadmin; platin;
      portdetective; ppinupdt; pptbc; ppvstop; procexplorerv1; proport;
      protect; purge; pccntmon; ping; qconsole; qserver; rav; regmon;
      rescue; rapapp; rtvscn95; rulaunch; regedit; regedt32; realmon;
      rshell; stinger; serv95; safeweb; symproxysvc; symtray; sphinx; smc;
      ss3edit; sbserv; swnetsup; sfc; schedapp; setupvameeval;
      setup_flowprotector_us; sgssfw32; shellspyinstall; shn; sofi; spf;
      srwatch; st2; supftrl; supporter5; sweep; sysdoc32; sysedit;
      sharedaccess; tbscan; tds; taumon; tcm; tfak; taskmon; tauscan; tc;
      tgbob; titanin; tracer; trjs; tmntsrv; undoboot; Update; vshwin32;
      vet; vsecomr; vbcmserv; vbcons; vir -help; vptray; vsmain; vsmon;
      vsstat; vettray; vcontrol; vbust; vbwin; vccmserv; vcsetup; vfsetup;
      vnlan300; vnpc3000; vpc; vpfw30s; vscenu6; vsisetup; vswin; vvstat;
      view; wfindv32; wimmun32; wgfe95; webtrap; watchdog; wradmin; wrctrl;
      w32dsm89; whoswatchingme; winrecon; winroute; winsfcm; wsbgate;
      zonealarm; zapro; zap; zcap; zatutor; zonestub; asdf; zlclient;
      zauinst; zonalm2601; taskmgr

Processes with the following characteristics are terminated:
    •  Title: %random character string%     Class name: DirectUIHWND
    •  Title: %random character string%     Class name: RICHEDIT20a
    •  Title: %random character string%     Class name: RICHEDIT
    •  Title: %random character string%     Class name: ate32class

 File details Programming language:
 The malware program was written in Visual Basic.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
   • UPX

Description inserted by Irina Boldea on Tuesday, December 6, 2005
Description updated by Andrei Gherman on Monday, January 30, 2006

Back . . . .
 
 
 
 

© 2013 Avira Operations GmbH & Co. KG. All rights reserved.

My Account

https:// This window is encrypted for your security.