P2P-Worm:W32/Bacteraloh.H
Summary
The detection P2P-Worm.Win32.Bacteraloh.H refers to files that have been infected by Virus.Win32.Sality.S.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
- Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
- Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
- Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
While active, Sality.S terminates running processes with names associated with common antivirus programs.
Infection
Sality.S is an appending, polymorphic file infector that uses an entry point obscuring technique. During infection, it replaces 129 bytes from the beginning of the host file's code with its decryption routine, then hides the replaced code in its own code. The virus's own code is encrypted and appended to the host file as a new section, with a random name and a size of 28672 bytes.A detailed description of Sality's method of operation is available in the description of Virus.Win32.Sality.Q.
Installation
During installation, Sality.S creates the following files:
- %windir%\system32\wmdrtc32.dl_ - Archived copy of wmdrtc32.dll
- %windir%\system32\wmdrtc32.dll - Detected as Virus.Win32.Sality.S
- %windir%\system32\drivers\ekkkjn.sys - Detected as Virus.Win32.Sality.S
It modifies the file %windir%\system.ini by adding the following:
- [MCIDRV_VER] DEVICE=
In addition, the following is loaded into all processes
- %windir%\system32\wmdrtc32.dll
Registry
Sality.S deletes a large number of registry keys, a small sample of which is listed in this description.
Process Changes
Creates these mutexes:
- _kuku_joker_v4.00
Network Connections
Attempts to connect with HTTP to:
- https://www.bpfq02 .com
- https://www.inform1ongung .info
- https://www.g1ikddcvns3sdsal .info
- https://www.f5ds1jkkk4d .info
- https://www.lukki6dnd2kdnc .info
- https://www.h7smcnr1wlsdn34fgv .info
- https://wnt: KUKUww.hkukud123ncs .info
- https://www.kukutrustnet .info
- https://www.kukutrustnet7 .info
- https://www.kukutrustnet666 .info/[...]_nrl
Registry Modifications
Sets these values:
- HKLM\System\CurrentControlSet\Services\NdisFileServices32 Type = 00000001
- HKLM\System\CurrentControlSet\Services\NdisFileServices32 Start = 00000002
- HKLM\System\CurrentControlSet\Services\NdisFileServices32 ErrorControl = 00000001
- HKLM\System\CurrentControlSet\Services\NdisFileServices32 ImagePath = \??\C:\WINDOWS\system32\drivers\ekkkjn.sys
- [Launchpoint: Service]
- HKLM\System\CurrentControlSet\Services\NdisFileServices32 DisplayName = NdisFileServices32
- HKLM\System\CurrentControlSet\Services\NdisFileServices32\Security Security = \x01\x00\x14\x80\x90\x00\x00\x00\x9C\x00\x00\x00\x14\x00\x00\x00\x30\x00\x00\x00\x02\x00\x1C\x00\x01\x00\x00\x00\x02\x80\x14\x00\xFF\x01\x0F\x00\x01\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x02\x00\x60\x00\x04\x00\x00\x00\x00\x00\x14\x00\xFD\x01\x02\x00\x01\x01\x00\x00\x00\x00\x00\x05\x12\x00\x00\x00\x00\x00\x18\x00\xFF\x01\x0F\x00\x01\x02\x00\x00\x00\x00\x00\x05\x20\x00\x00\x00\x20\x02\x00\x00\x00\x00\x14\x00\x8D\x01\x02\x00\x01\x01\x00\x00\x00\x00\x00\x05\x0B\x00\x00\x00\x00\x00\x18\x00\xFD\x01\x02\x00\x01\x02\x00\x00\x00\x00\x00\x05\x20\x00\x00\x00\x23\x02\x00\x00\x01\x01\x00\x00\x00\x00\x00\x05\x12\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x05\x12\x00\x00\x00
- HKLM\System\CurrentControlSet\Services\ALG DeleteFlag = 00000001
- HKLM\System\CurrentControlSet\Services\ALG Start = 00000004
- HKLM\System\CurrentControlSet\Services\bdss DeleteFlag = 00000001
- HKLM\System\CurrentControlSet\Services\bdss Start = 00000004
- HKLM\System\CurrentControlSet\Services\F-Secure Gatekeeper Handler Starter DeleteFlag = 00000001
- HKLM\System\CurrentControlSet\Services\F-Secure Gatekeeper Handler Starter Start = 00000004
- HKLM\System\CurrentControlSet\Services\navapsvc DeleteFlag = 00000001
- HKLM\System\CurrentControlSet\Services\navapsvc Start = 00000004
- HKLM\System\CurrentControlSet\Services\AVP DeleteFlag = 00000001
- HKLM\System\CurrentControlSet\Services\AVP Start = 00000004
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings GlobalUserOffline = 00000000
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce shell = Explorer.exe [Launchpoint: RunOnce]
Deletes these values:
- HKLM\System\CurrentControlSet\Control\SafeBoot\AlternateShell
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Base\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmadmin\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmboot.sys\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmio.sys\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmload.sys\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmserver\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\EventLog\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\File system\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Filter\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys\ [Launchpoint: Safe mode (minimal)]
- HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys\ [Launchpoint: Safe mode (minimal)]
More Support
Community
Ask questions in our Community.
User guides
Check the user guide for instructions.
Contact Support
Chat with with or call an agent.
Submit a Sample
Submit a file or URL for analysis.