P2P-Worm.Win32.Bacteraloh is a family of P2P-Worms similar to P2P.Worm.Win32.Backterra. Unlike Backterra, Bacteraloh variants may have the additional functionality of dropping Virus.Win32.Sality variants. For a description of Sality, please see our description of Virus.Win32.Sality.Q
Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.
More information on scanning and removal options available in your F-Secure product can be found in the Help Center.
You may also refer to the Knowledge Base on the F-Secure Community site for more information.
Bacteraloh spreads through file-sharing networks (primarily Emule) by disguising itself as a software crack. To give credibility to the illusion, when executed the worm will display a fake interface and a dialog box with the message "Missing MFClibary.dll", as seen in the samples below:
The Bateraloh variants that include functionality to install Virus.Win32.Sality will drop a standalone DLL in the folder %system32%. The DLL file is then injected into running processes. If Emule file sharing software is detected, Bacteraloh will create multiple copies of itself in:
The copies are labeled using names selected from a long list. The names are mostly in the following format:
- Crack & Keygen all Versions e.g., Spacetanks Crack & Keygen all Versions
- Crack & Keygen and all lower versions e.g., Winamp 5.112 Pro and all lower Versions Crack & Keygen