Threat Description

Bacalid.A

Details

Aliases:Bacalid.A, Bacalid.A
Category:Malware
Type:Virus
Platform:W32

Summary



Bacalid.A is a polymorphic virus that infects .EXE and .DLL files. It uses some stealth mechanisms and obfuscation techniques to hide itself, therefore preventing easy detection. See the details section for more information.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You may also refer to General Removal Instructions for a general guide on alternative disinfection actions.



Technical Details



Bacalid.A is a polymorphic file infector. Upon execution of an infected file it will drop the following DLL component into the temporary folder:

  • VCab.DLL

Note - some instances might drop:

  • VGod.DLL

It injects the DLL component primarily to EXPLORER.EXE, and also to other running processes. Bacalid.A queries the Windows ANSI code page identifier for the system. If it is equal to 936 (Simplified Chinese (GB2312); Chinese Simplified (GB2312-80)) it will not continue its malicious routine. Bacalid.A infinitely loops until it sees an Internet Connection. If no Internet connection is present it will not proceed to its malicious routine. It checks for the following event to ensure that only one instance of itself is running in memory:

  • WINXPGOD

Note - some instances check for:

  • WINXPGOOD

Bacalid.A infects files with the following extensions:

  • .DLL
  • .EXE

It searches for all fixed drives starting from Z: to C: It avoids infecting the following directories:

  • C:\Program Files
  • C:\Windows

It infects by appending 2 sections at the end of the file. It also removes the DOS stub (This program cannot be run in DOS mode). It also adds garbage code to itself to prevent easy detection. Aside from searching for files, it also waits for the following API calls to trigger its infection:

  • CreateFile
  • GetFileAttributes
  • LoadLibrary

It hooks the following APIs to hide the Dropped DLL component by returning "." instead of its original filename:

  • FindFirstFile
  • FindNextFile

Note: The code of this malware is very unstable, corrupting some instances of the infected files.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More