Summary
Bobic (also known as Bobax) is an email and network worm. It spreads in email messages and can also use different exploits to spread from computer to computer via Internet. However this variant doesn't have any exploits and it spreads only by email.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
- Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
- Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
- Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
When run, the worm's file drops a DLL component to temporary folder and injects it into Windows Explorer process.
Spreading in emails
The worm collects victims' email addresses before spreading. It scans Windows Address Book file and files with the following extensions:
.htm .txt .dbx
The worm ignores email addresses that have any of the following substrings in them:
ogle help admi ter@ micr supp yman viru tren secu .mil urhq pand afee soph kasp .gov nort
The worm spreads in email messages. It can use the following text strings in the Subject field:
Saddam Hussein - Attempted Escape, Shot dead Attached some pics that i found Osama Bin Laden Captured. Attached some pics that i found Testing Secret!
The following text strings are used to create message body of an infected email:
Hey, Remember this? Hello, Long time! Check this out! Hey, I was going through my album, and look what I found.. Hey, Check this out :-)
The worm can also append the following strings to the message to persuade a user that the message was scanned by an anti-virus and no infection was detected:
+++ Attachment: No Virus found +++ Panda AntiVirus - You are protected +++ www.pandasoftware.com +++ Attachment: No Virus found +++ Norman AntiVirus - You are protected +++ www.norman.com +++ Attachment: No Virus found +++ F-Secure AntiVirus - You are protected +++ www.f-secure.com +++ Attachment: No Virus found +++ Norton AntiVirus - You are protected +++ www.symantec.com
The infected attachment names can be any of the following:
Cool pics funny bush joke secret
Extensions of an infected attachment can be:
.pif .scr .exe .pif .zip
A remote system becomes infected when a recipient opens the worm's attachment.
Payload
The worm disables Windows firewall and also disables shared access. It changes several security-related settings in the Registry. The worm disables process manupulation and termination in Task Manager.
Bobic.k worm can modify Windows HOSTS file to block access to the following sites:
255.255.255.255 ar.atwola.com atdmt.com avp.ch avp.com avp.ru awaps.net ca.com dispatch.mcafee.com download.mcafee.com download.microsoft.com downloads.microsoft.com engine.awaps.net f-secure.com ftp.f-secure.com ftp.sophos.com go.microsoft.com liveupdate.symantec.com mast.mcafee.com mcafee.com msdn.microsoft.com my-etrust.com nai.com networkassociates.com office.microsoft.com phx.corporate-ir.net secure.nai.com securityresponse.symantec.com service1.symantec.com sophos.com spd.atdmt.com support.microsoft.com symantec.com update.symantec.com updates.symantec.com us.mcafee.com vil.nai.com viruslist.ru windowsupdate.microsoft.com www.avp.ch www.avp.com www.avp.ru www.awaps.net www.ca.com www.f-secure.com www.kaspersky.ru www.mcafee.com www.my-etrust.com www.nai.com www.networkassociates.com www.sophos.com www.symantec.com www.trendmicro.com www.viruslist.com www.viruslist.ru www3.ca.com
The worm can also download 3 files from Internet. These files are not malicious.
More Support
Community
Ask questions in our Community.
User guides
Check the user guide for instructions.
Contact Support
Chat with with or call an agent.
Submit a Sample
Submit a file or URL for analysis.