Need to fix your PC?
Hire an Expert
Virus:Worm/Palevo.acpp
Date discovered:26/07/2010
Type:Worm
In the wild:Yes
Reported Infections:Low to medium
Distribution Potential:Medium
Damage Potential:Medium
Static file:Yes
File size:393.216 Bytes
MD5 checksum:3fd301b3b08e66bd94f05b9bc2cbabc6
IVDF version:7.10.09.219 - Monday, July 26, 2010

 General Method of propagation:
   • Peer to Peer


Aliases:
   •  Sophos: Troj/Agent-OBK
   •  Panda: W32/IrcBot.CYL.worm
   •  Eset: Win32/Boberog.AX


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Third party control
   • Drops malicious files
   • Registry modification

 Files It copies itself to the following locations:
   • %TEMPDIR%\lsass.exe
   • %TEMPDIR%\lToRo.exe
   • C:\Users\User\Documents\LimeWire\MicrosoftPointGenerator.exe
   • C:\Users\User\Documents\LimeWire\HostBooter.exe
   • C:\Users\User\Documents\LimeWire\NeroKeygen.exe
   • C:\Users\User\Documents\LimeWire\AdobeKeygen.exe
   • C:\Users\User\Documents\LimeWire\retardedpicturelol.exe
   • C:\Users\User\Documents\LimeWire\Microsoft_Update.exe
   • C:\Users\User\Documents\LimeWire\AdobePhotoShopKeygen.exe
   • C:\Users\User\Documents\LimeWire\MicrosoftOfficeKeygen.exe
   • C:\Users\User\Documents\LimeWire\MicrosoftOffice2007Keygen.exe
   • C:\Users\Public\SystemCleanup.exe
   • C:\Users\Public\RunescapeMoneyHacker.exe
   • C:\Users\Public\MicrosoftPointGenerator.exe
   • C:\Users\Public\HostBooter.exe
   • C:\Users\Public\NeroKeygen.exe
   • C:\Users\Public\AdobeKeygen.exe
   • C:\Users\Public\retardedpicturelol.exe
   • C:\Users\Public\Microsoft_Update.exe
   • C:\Users\Public\AdobePhotoShopKeygen.exe
   • C:\Users\Public\MicrosoftOfficeKeygen.exe
   • C:\Users\Public\MicrosoftOffice2007Keygen.exe
   • C:\Users\User\Downloads\SystemCleanup.exe
   • C:\Users\User\Downloads\RunescapeMoneyHacker.exe
   • C:\Users\User\Downloads\MicrosoftPointGenerator.exe
   • C:\Users\User\Downloads\HostBooter.exe
   • C:\Users\User\Downloads\NeroKeygen.exe
   • C:\Users\User\Downloads\AdobeKeygen.exe
   • C:\Users\User\Downloads\retardedpicturelol.exe
   • C:\Users\User\Downloads\Microsoft_Update.exe
   • C:\Users\User\Downloads\AdobePhotoShopKeygen.exe
   • C:\Users\User\Downloads\MicrosoftOfficeKeygen.exe
   • C:\Users\User\Downloads\MicrosoftOffice2007Keygen.exe



It deletes the following file:
   • %TEMPDIR%\LPRD.bat



The following file is created:

– %TEMPDIR%\LPRD.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file.



It tries to execute the following file:

– Filename:
   • cmd /c ""C:\Temp\LPRD.bat" "

 Registry The following registry keys are added in order to run the processes after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "Windows Firewall"="%TEMPDIR%\lsass.exe"
   • "cHa"="%TEMPDIR%\lToRo.exe"

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "Rk6s2LSdQm"="%TEMPDIR%\lToRo.exe"
   • "Windows Firewall"="%TEMPDIR%\lsass.exe"



The following registry keys are added:

– [HKCU\Software\Microsoft\Active Setup\Installed Components\
   {CLVQ0DSR-QSFT-LBKV-FZYX-CVZEGNEMN16E}]
   • "StubPath"="%TEMPDIR%\lToRo.exe"

– [HKLM\Software\Microsoft\Active Setup\Installed Components\
   {CLVQ0DSR-QSFT-LBKV-FZYX-CVZEGNEMN16E}]
   • "StubPath"="%TEMPDIR%\lToRo.exe"

 P2P In order to infect other systems in the Peer to Peer network community the following action is performed:   It searches for directories that contain one of the following substrings:
   • winmx\shared\
   • tesla\files\
   • limewire\shared\
   • morpheus\my shared folder\
   • emule\incoming\
   • edonkey2000\incoming\
   • bearshare\shared\
   • grokster\my grokster\
   • icq\shared folder\
   • kazaa lite k++\my shared folder\
   • kazaa lite\my shared folder\
   • kazaa\my shared folder\

   If successful, the following files are created:
   • Sony Vegas Pro 9.0c Build 896.exe; WinRAR v3.90 Final Cracked.exe;
      LimeWire PRO v5.4.6.1.exe; Magic ISO Maker 5.4-CRACKED.exe; Adobe
      Photoshop Crack.exe; CyberLink PowerDVD Ultra Deluxe Multilingual.exe;
      Microsoft Office 2010 Professional Plus RC0 Build 4734-WinBeta.exe;
      NOD32 Anti-Virus 4.0.468.0-For Life.exe; Adobe Photoshop CS4
      Extended.exe; Young.Money-We.Are.Young.Money-(Retail)-2009-[NoFS].exe;
      Young Money ft. Lloyd - BedRock [.mp3] - NEW SINGLE.exe; Young Money -
      We Are Young Money (Retail)(GroupRip)(2009)-(Rap-M.exe; Yeah Yeah
      Yeahs - It's Blitz [mp3-192-2009].exe; Xilisoft avi to DVD converter
      v3.0.26 + keygen.exe; WinZip PRO v12.1 + Serials By ChattChitto.exe;
      Windows 7 Home Edition Service Pack 2 (x86).exe; WINDOWS 7 KEYGEN.exe;
      WinRAR_3.80_Professional.exe; WinRAR v3.90 Final + KeyReg By
      ChattChitto.exe; WinRAR 3.90 Beta 4 Cracked + Keygen +
      Instructions.txt + tnedor.exe;
      WINDOWS_XP_PRO_32-BIT_SP3_ISO_ACTIVATED_GENUINE.exe; Windows XP Home
      Edition with Service Pack 3 Retail (x86) (TPB).exe; Windows XP
      Activation Crack.exe; Windows 7 Ultimate(32 & 64 bit) Self Activation
      - Jz.exe; Windows 7 Ultimate AIO Activated.exe; Windows 7 Ultimate
      (Activated and TESTED!).exe; Windows 7 crack RemoveWAT 2.2.5.Hazar
      carter67.exe; Windows 7 Autoactivable [Spanish].exe; Windows 7 all
      version 7600 16385 RTM Activator [by Sk].exe; Windows 7 All Editions -
      Activated x32x64 January 2010[ kk ].exe; VMWare Workstation
      6.5.3.185404 Incl Keygen(Tested, Works 100%).exe; Usher-Raymond Vs
      Raymond-2010-P2P.exe; UK Top 40 Singles Chart 14-03-2010.exe; UK Top
      40 Singles Chart 07-03-2010.exe; U2 - Discography.exe; The Beatles -
      discography (2009 Remastered).exe; Adobe Photoshop CS3 Extended
      Version Full + Crack.exe; Adobe Flash CS4 Professional + Keygen.exe;
      Adobe Dreamweaver CS4 + Keygen & Activation Patch.exe; Adobe CS4
      Master Collection -MT-.exe; Adobe CS4 Master Collection Mac - EN FR
      ESP.exe; Adobe CS3 Photoshop Extended and Illustrator - All
      Cracked.exe; Adobe After Effects CS4 (Final) + Crack [RH].exe; ADOBE
      ACROBAT 9.2.0 PRO EXTENDED EDITION + 9.3.1 UPDATE.exe; ACDC -
      Discography - 1975-2008 (31 CD's plus many extras & co.exe;
      The.Sims.3.High.End.Loft.Stuff-ViTALiTY.exe;
      The.Princess.And.The.Frog.DVDRSCREENER.XviD-MENTiON.avi.exe;
      The.Office.S06E19.HDTV.XviD-LOL.[VTV].avi.exe;
      The.Crazies.2010.TS.XviD-Rx.exe;
      The.Book.of.Eli.2010.TS.XviD-IMAGiNE.avi.exe; The Spy Next Door (2010)
       DVDRiP LiNE XViD READNFO - IMAGiNE.exe; The Sims 3 World
      Adventures-RELOADED.exe; The Sims 3 World Adventures Update
      2.5.12-ViTALiTY.exe; The Sims 3 - Razor1911 Final MAXSPEED.exe; The
      Pacific (HBO 2010 - Part 1).exe; The Men Who Stare at Goats (2009)
      Spanish BRSCR.exe; The Men Who Stare at Goats (2009) R5 DVDRip
      XviD-MAX.exe; The Informant![2009]DvDrip[Eng]-FXG.exe; Prototype [PC]
      [MULTI2].exe; Pro.Evolution.Soccer.2010-RELOADED.exe;
      Prison.Break.The.Conspiracy.CLONEDVD-AVENGED-[tracker.BTARENA.or.exe;
      Prison Break The Conspiracy [RF] [X360] [www.SoloEstreno.com].exe;
      Prison Break The Conspiracy [PC] [www.SoloEstreno.com].exe; Plants vs
      Zombies [KTB] - v1.0.0.1051.exe; Planet 51 (2009) R5 DVDRip
      XviD-MAX.exe;
      Percy.Jackson.E.Gli.Dei.Dell.Olimpo.Il.Ladro.Di.Fulmini.2010.iTA.exe;
      Percy Jackson and the Olympians (2010) Spanish DVDSCR.exe; Percy
      Jackson and the Olympians (2010) R5 DVDRip XviD-MAX.exe;
      Order.of.Chaos.2010.DVDRip.XviD-SPRiNTER.exe;
      Alice.in.Wonderland-ViTALiTY.iso.exe; Alice In Wonderland 2010 TS XViD
      - IMAGiNE[ExtraTorrent].exe; Age of Empires 3.exe;
      A.Serious.Man.2009.LIMITED.DVDRip.XviD-ESPiSE.avi.exe; 30 Rock S04E15
      HDTV XviD-LOL [eztv].exe; 24.S08E12.HDTV.XviD-CRiMSON.avi.exe;
      2012[2009]DvDrip[Eng]-FXG.exe; porno.scr2012 (2009) R5 DVDRip
      XviD-MAX.exe; headjobs.scr; ilovetofuck.scr;
      FREEPORN.exe,fuckshitcunt.scr; Autoloader.exe; Wireshark.exe;
      DDOSPING.exe; ScreenMelter.exe; How-to-make-money.exe; Ebooks.exe;
      WildHorneyTeens.scr; RapidsharePREMIUM.exe; LimeWireCrack.exe;
      Porno.MPEG.exe; image.scr; VistaUltimate-Crack.exe; paris-hilton.scr;
      MSNHacks.exe; YahooCracker.exe; HotmailHacker.exe


 IRC To deliver system information and to provide remote control it connects to the following IRC Server:

Server: stoneytheboss.no-**********.info
Port: 6667
Channel: #dervieboy
Nickname: -NEW-{USA|XP-SP3|612655}

 Miscellaneous Mutex:
It creates the following Mutex:
   • C3GGF39MQ23Z

 File details Programming language:
 The malware program was written in Visual Basic.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

Description inserted by Petre Galan on Monday, November 8, 2010
Description updated by Petre Galan on Thursday, November 11, 2010

Back . . . .
 
 
 
 

© 2013 Avira Operations GmbH & Co. KG. All rights reserved.

My Account

https:// This window is encrypted for your security.