Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


P2P-Worm:W32/Bacteraloh


Aliases:


P2P-Worm:W32/Bacteraloh
P2P-Worm.Win32.Bacteraloh
Win32.Sality

Malware
P2P-Worm
W32

Summary

A type of worm that spreads over Peer-to-Peer (P2P) networks.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

P2P-Worm.Win32.Bacteraloh is a family of P2P-Worms similar to P2P.Worm.Win32.Backterra. Unlike Backterra, Bacteraloh variants may have the additional functionality of dropping Virus.Win32.Sality variants. For a description of Sality, please see our description of Virus.Win32.Sality.Q

Distribution

Bacteraloh spreads through file-sharing networks (primarily Emule) by disguising itself as a software crack. To give credibility to the illusion, when executed the worm will display a fake interface and a dialog box with the message "Missing MFClibary.dll", as seen in the samples below:


Installation

The Bateraloh variants that include functionality to install Virus.Win32.Sality will drop a standalone DLL in the folder %system32%. The DLL file is then injected into running processes. If Emule file sharing software is detected, Bacteraloh will create multiple copies of itself in:

  • C:\Windows\Temp\Bactera\Â

The copies are labeled using names selected from a long list. The names are mostly in the following format:

  • Crack & Keygen all Versions e.g., Spacetanks Crack & Keygen all Versions
  • Crack & Keygen and all lower versions e.g., Winamp 5.112 Pro and all lower Versions Crack & Keygen






Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.