Home > Threat descriptions >

P2P-Worm:W32/Bacteraloh

Classification

Category: Malware

Type: P2P-Worm

Aliases: P2P-Worm:W32/Bacteraloh, P2P-Worm.Win32.Bacteraloh, Win32.Sality

Summary


P2P-Worm.Win32.Bacteraloh is a family of P2P-Worms similar to P2P.Worm.Win32.Backterra. Unlike Backterra, Bacteraloh variants may have the additional functionality of dropping Virus.Win32.Sality variants. For a description of Sality, please see our description of Virus.Win32.Sality.Q

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


Distribution

Bacteraloh spreads through file-sharing networks (primarily Emule) by disguising itself as a software crack. To give credibility to the illusion, when executed the worm will display a fake interface and a dialog box with the message "Missing MFClibary.dll", as seen in the samples below:

Installation

The Bateraloh variants that include functionality to install Virus.Win32.Sality will drop a standalone DLL in the folder %system32%. The DLL file is then injected into running processes. If Emule file sharing software is detected, Bacteraloh will create multiple copies of itself in:

  • C:\Windows\Temp\Bactera\Â

The copies are labeled using names selected from a long list. The names are mostly in the following format:

  • Crack & Keygen all Versions e.g., Spacetanks Crack & Keygen all Versions
  • Crack & Keygen and all lower versions e.g., Winamp 5.112 Pro and all lower Versions Crack & Keygen