Win32.BugBear.D@mm( I-Worm.Tanatos.e (KAV) )
SYMPTOMS:
TECHNICAL DESCRIPTION: Previously detected as Win32.BugBear.Gen@mm, the worm spreads like the former variants by mail in the following format:Subject: one of the following:
Body: one of the following:
Attachment: A Zip archive or a file with a name taken from the infected computer or one of:
followed by many spaces before the real SCR extension. It copies itself with a random name: %random%.exe in the Windows System directory: %WINSYS% It executes the copied file. It displays a fake WinZip message box with the following text: bad CRC 23bb8dea (should be 0be7841c). The %WINSYS% copy does the following: It adds the following registry key: HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\%random% With value: %WINSYS%\\%random%.exe It tries to register itself as a service (under Win9X machines) It creates a .dat file for storing e-mail addresses. It drops a key logger component in %WinSYS% folder with a random name and .dll extension. This component is detected as Trojan.KeyLogger.BugBear.B It creates 2 files with dll extension and random name. In these files the worm keeps encrypted data gathered from the computer. At every 20 seconds it search for and kills a list of antivirus and shield processes. The worm registers the actions of the user. This information is then sent to an e-mail address. It searches for e-mail addresses in all the files with the following extensions:
And it send itself to all the e-mails it finds in the same format it arrives. Removal instructions: Let BitDefender delete all files found infected by this worm.ANALYZED BY: Sorin Victor DudeaBitDefender Virus Researcher |
