P2P-Worm.Win32.Bacteraloh is a family of P2P-Worms similar to P2P.Worm.Win32.Backterra.
Unlike Backterra, Bacteraloh variants may have the additional functionality of dropping Virus.Win32.Sality variants. For a description of Sality, please see our description of Virus.Win32.Sality.Q
Bacteraloh spreads through file-sharing networks (primarily Emule) by disguising itself as a software crack.
To give credibility to the illusion, when executed the worm will display a fake interface and a dialog box with the message "Missing MFClibary.dll", as seen in the samples below:
The Bateraloh variants that include functionality to install Virus.Win32.Sality will drop a standalone DLL in the folder %system32%. The DLL file is then injected into running processes.
If Emule file sharing software is detected, Bacteraloh will create multiple copies of itself in:
The copies are labeled using names selected from a long list. The names are mostly in the following format:
- Crack & Keygen all Versions
e.g., Spacetanks Crack & Keygen all Versions
- Crack & Keygen and all lower versions
e.g., Winamp 5.112 Pro and all lower Versions Crack & Keygen