w32Babelloh virus
Discovered: December 5, 2007
Type: Worm
Infection Length: 51,576 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP
Once executed, the worm creates the following mutex so only one instance of the worm is running:
NameOfMutexObject2
The worm creates the following files:
* %SystemDrive%\cblogsvr.ini
* %SystemDrive%\mgrShell.exe
* %SystemDrive%\spoolsv32.exe
* %SystemDrive%\wmiprvse.exe
* %Temp%\L4SD\1CE993C1.db
* %Temp%\~RHF514.log
It also creates the following files with hidden and system attributes on removable and mapped network media:
* %DriveLetter%:\RECYCLER
* %DriveLetter%:\autorun.inf
* %DriveLetter%:\RECYCLER\desktop.exe
* %DriveLetter%:\RECYCLER\desktop.ini
The worm may also copy and spread in encrypted form to local .doc, .docx and .ros documents as the following file:
%DriveLetter%:\RECYCLER\[8 HEXADECIMAL CHARACTERS].db
It creates the following registry entries, so that it runs every time when Windows starts:
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\"PolicyRun" = "%SystemDrive%\spoolsv32.exe"
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"winmgmt" = "%SystemDrive%\wmiprvse.exe"
* HKEY_USERS\S-1-5-21-1961063573-973683775-492528769-500\Software\Microsoft\Windows
* \CurrentVersion\Run\"winmgmt" = "%SystemDrive%\wmiprvse.exe"
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell" = "Explorer.exe %SystemDrive%\spoolsv32.exe"
* HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrkWks\"ImagePath" = "%SystemDrive%\spoolsv32.exe"
* HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrkWks\"ImagePath" = "%SystemDrive%\spoolsv32.exe"
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks\"ImagePath" = "%SystemDrive%\spoolsv32.exe"
It modifies following values in registry subkeys:
* HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\"ServiceCurrent" = "11"
* HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrkWks\"Type" = "10"
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\"ServiceCurrent" = "11"
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks\"Type" = "10"
* HKEY_USERS\S-1-5-21-1961063573-973683775-492528769-500\Software\Microsoft\Windows
* \CurrentVersion\Explorer\Advanced\"ShowSuperHidden" = "0"
* HKEY_USERS\S-1-5-21-1961063573-973683775-492528769-500\Software\Microsoft\Windows
* \CurrentVersion\Policies\Explorer\"NoDriveTypeAutoRun" = "B5"
It checks for internet access by connecting to the following site:
windowsupdate.microsoft.com
The worm drops additional malware which opens a back door and attempts to connect with following predetermined sites on TCP ports 80, 8080 or 8088:
* lack.bpa.nu
* qack.bpa.nu
* pbwoman.6600.org
Subscribe to:
Post Comments (Atom)
13 comments:
interacial dating mister poll [url=http://loveepicentre.com/]rural singles[/url] london dating http://loveepicentre.com/ wales dating
effects of drugs on human body [url=http://usadrugstoretoday.com/products/aceon.htm]aceon[/url] only fruit diet http://usadrugstoretoday.com/categories/women-s-health.htm starwhite dental http://usadrugstoretoday.com/products/albendazole.htm
drug incompatabilities [url=http://usadrugstoretoday.com/products/kamasutra-contoured-condoms.htm]kamasutra contoured condoms[/url] from the mineral natural resource to the brick [url=http://usadrugstoretoday.com/categories/sleeping-aid.htm]xymax plus diet pills[/url]
what did people do to escape the great depression [url=http://usadrugstoretoday.com/products/procardia.htm]procardia[/url] vitamin city san dimas http://usadrugstoretoday.com/products/emsam.htm canadian medical tourism http://usadrugstoretoday.com/products/shallaki.htm
celebrity supermodel diet secrets [url=http://usadrugstoretoday.com/products/brahmi.htm]brahmi[/url] carbohydrate diet zero [url=http://usadrugstoretoday.com/catalogue/w.htm]health insurance california[/url]
http://xws.in/amoxicillin/calculations-for-suspension-amoxicillin
[url=http://xws.in/aleve/aleve-and-heart-valve-disease]shoppers drug mart optimum card[/url] sulfa drugs side effects [url=http://xws.in/alendronate/alendronate-and-cholecalciferol]alendronate and cholecalciferol[/url]
boots drug store http://xws.in/dostinex/dostinex-dopamine
[url=http://xws.in/alfuzosin/drug-class-alfuzosin]drug reseach[/url] the good drugs [url=http://xws.in/adalat/adalat-cc-aciphex-plendil-ranitidine]adalat cc aciphex plendil ranitidine[/url]
bremo pharmacy richmond va http://xws.in
[url=http://xws.in/enhancement/correlle-enhancement]lithium the drug[/url] basketball and health [url=http://xws.in/anacin]anacin[/url] citicoline drug literature [url=http://xws.in/allegra/allegra-and-low-cost-prescription]allegra and low cost prescription[/url]
http://alwayshealth.in/people-health
[url=http://alwayshealth.in/heart-rate/advancements-in-heart-transplants]canadian levitra[/url] traffic increasing in drug stores [url=http://alwayshealth.in/china-tea/tetley-tea]tetley tea[/url]
drug use of ice on sex drive http://alwayshealth.in/china-tea/herble-green-tea
[url=http://alwayshealth.in/heart-medicine/rawlings-heart-of-the-hide-baseball-gloves]walmart pharmacy bloomington mn[/url] drug list a z [url=http://alwayshealth.in/china-tea/wun-long-tea-in-marbella]wun long tea in marbella[/url]
the vault drugs http://alwayshealth.in/smoking/facts-about-tobacco-to-make-a-person-to-stop-smoking
[url=http://alwayshealth.in/my-heart/downloadyou-dun-stomped-my-heart-and-mashed-that-sucker-flat]sterling drug recall policy[/url] us levitra [url=http://alwayshealth.in/overdose/what-can-happen-after-overdose-of-antidepressant]what can happen after overdose of antidepressant[/url] certified pharmacy tech board [url=http://alwayshealth.in/medical-co/medical-school-exam]medical school exam[/url]
california auto insurance commision http://automotoportal.in/radiator/how-to-clean-a-radiator-at-home dsf automobile
[url=http://automotoportal.in/seat-car/truck-front-seat-covers]fixation prix automobile[/url] universal auto wing shotgun [url=http://automotoportal.in/scooters/baja-scooters]baja scooters[/url]
aap auto insurance vilseck http://automotoportal.in/saturn/saturn-vue-leasing-values
[url=http://automotoportal.in/mini-car/home-office-ft-worth-tx-mini-storage]auto show columbus ohio[/url] sony automobile shortwave radio [url=http://automotoportal.in/seat-car/one-seat-helicopters]one seat helicopters[/url]
nassau county forfeiture automobile district attorney rice http://automotoportal.in/scion/dc-exhaust-for-scion-xb
[url=http://automotoportal.in/motorcycles/cradley-heath-motorcycles]auto push button manual computer[/url] auto parts vw [url=http://automotoportal.in/romeo/used-alfa-romeo-milton-keynes]used alfa romeo milton keynes[/url]
travel advisory state department http://wikitravel.in/expedia/how-do-i-contact-expedia-barry-diller atmospheres for human space travel
[url=http://wikitravel.in/adventure/cruise-tour-kaktus-island-kayak-adventure]travel incentive in italian resorts[/url] travel channel lineup [url=http://wikitravel.in/plane-tickets/discount-plane-tickets-to-djibouti]discount plane tickets to djibouti[/url]
travel agent codes http://wikitravel.in/disneyland/ray-bradbury-at-disneyland
[url=http://wikitravel.in/adventure/adventure-teen-travel]cleveland travel guide[/url] consumer report travel system strollers [url=http://wikitravel.in/cruises/last-minute-cruises]last minute cruises[/url]
manila travel agencies airlines http://wikitravel.in/flight/pan-am-flight-that-made-the-first-trans-pacific-airmail-flight marcopolo travel [url=http://wikitravel.in/cruise/norwigian-cruise-line]norwigian cruise line[/url]
designer bathrooms supplies toilet http://topcitystyle.com/-shorts-on-sale-category75.html fashion magazine chicago [url=http://topcitystyle.com/brown-shirts-color12.html]pantyhose fashion shows[/url] interior designers bristol
http://topcitystyle.com/?action=products&product_id=1915 how to build polish horseshoes [url=http://topcitystyle.com/red-beige-color42.html]shoes songs[/url]
licking anal holes http://theporncollection.in/incest/incest-storiesa
[url=http://theporncollection.in/gay-anal/gay-porn-news]watch hentai sex videos for free[/url] fairly odd parents hentai comix [url=http://theporncollection.in/gay-boy/how-to-meet-gay-men-in-baltimore-county]how to meet gay men in baltimore county[/url]
femblossom area clitoris hand held lubricant http://theporncollection.in/porn-galleries/mobile-phone-porn-downloads
[url=http://theporncollection.in/gay-anal]underage xxx porn teeens poing[/url] web free porn pages [url=http://theporncollection.in/moms/did-dr-jan-adams-preform-kenyas-moms-surgery]did dr jan adams preform kenyas moms surgery[/url]
biker girl hentai 2 http://theporncollection.in/gay-movie/gay-chubby-sample
[url=http://theporncollection.in/best-porn/free-porn-emails]buy slick 50 spray lubricant[/url] sexy bodypainted ladies [url=http://theporncollection.in/porn-girl/celebrities-cartoon-porn]celebrities cartoon porn[/url]
northwest indiana adult fall baseball leagues http://theporncollection.in/porn-dvd/kelle-porn-marie
[url=http://theporncollection.in/gay-video/gay-chat-tri-cities-tennessee]barbie griffin dildo[/url] anime manga hentai [url=http://theporncollection.in/mature-woman/mature-bukake]mature bukake[/url]
mass anterior medial middle ear adult inability to close eye http://xwe.in/gay-boy/gay-nastyboard
[url=http://xwe.in/teen-ass/spain-in-the-ass]anal licking adult porn[/url] irresponsible adult children [url=http://xwe.in/erotic-stories]erotic stories[/url]
adult escort directory los angeles http://xwe.in/erotic-gay/erotic-ebony-photos
[url=http://xwe.in/girl-anal/lana-sands-anal-clip]adult ipod[/url] free categorized porn xxx [url=http://xwe.in/bbw/my-bbw-sitw]my bbw sitw[/url]
for better or for worse porn http://xwe.in/condom/watermelon-condoms
[url=http://xwe.in/oral/teeth-cut-penis-oral-sex]maya divine porn[/url] adult breastfeeding nyc [url=http://xwe.in/adult-xxx/live-adult-chat]live adult chat[/url]
sexy girls in cars http://xwe.in/thong/lolitamodels-thong
[url=http://xwe.in/fetish/branding-fetish-locations]nia long sexy pictures[/url] anal sex xxx [url=http://xwe.in/bbw/bbw-moviez]bbw moviez[/url]
hihi
in the movie brom was just another character [url=http://full-length-movies.com/dvd-quality-movie-the-trench/24152database/]The Trench[/url] life church shreveport bossier city movie [url=http://worldmovs.co.cc/full_version-the-killer-shrews/12054database/]The Killer Shrews[/url]
all movie stars [url=http://full-length-movies.com/dvd-quality-movie-cita-en-las-vegas/10944database/]Cita En Las Vegas[/url] free porn movie viewer [url=http://worldmovs.co.cc/full_version-johnssonligan-och-den-svarta-diamanten/2639database/]Johnssonligan Och Den Svarta Diamanten[/url]
sixty nine movie previews [url=http://full-length-movies.com/dvd-quality-movie-ptu/2152database/]PTU[/url] the movie wild hogs [url=http://worldmovs.co.cc/full_version-halloween/29298database/]Halloween[/url]
the simpsons movie 11530 [url=http://full-length-movies.com/dvd-quality-movie-the-rose/10689database/]The Rose[/url] ua movie theaters [url=http://full-length-movies.com/dvd-quality-movie-banshee/8611database/]Banshee[/url]
test
Post a Comment