P2P-Worm:W32/Bacteraloh

Classification

Malware

P2P-Worm

W32

P2P-Worm:W32/Bacteraloh, P2P-Worm.Win32.Bacteraloh, Win32.Sality

Summary

P2P-Worm.Win32.Bacteraloh is a family of P2P-Worms similar to P2P.Worm.Win32.Backterra. Unlike Backterra, Bacteraloh variants may have the additional functionality of dropping Virus.Win32.Sality variants. For a description of Sality, please see our description of Virus.Win32.Sality.Q

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Distribution

Bacteraloh spreads through file-sharing networks (primarily Emule) by disguising itself as a software crack. To give credibility to the illusion, when executed the worm will display a fake interface and a dialog box with the message "Missing MFClibary.dll", as seen in the samples below:

Installation

The Bateraloh variants that include functionality to install Virus.Win32.Sality will drop a standalone DLL in the folder %system32%. The DLL file is then injected into running processes. If Emule file sharing software is detected, Bacteraloh will create multiple copies of itself in:

  • C:\Windows\Temp\Bactera\Â

The copies are labeled using names selected from a long list. The names are mostly in the following format:

  • Crack & Keygen all Versions e.g., Spacetanks Crack & Keygen all Versions
  • Crack & Keygen and all lower versions e.g., Winamp 5.112 Pro and all lower Versions Crack & Keygen

Date Created: -

Date Last Modified: -