W32/Bodiru-A

Aliases	W32.HLLW.Bodiru PE_Bodiru.A
Category	Viruses and Spyware
Type	Worm
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary

Summary
Action
More Information


Protection available since	22 December 2003 15:17:01 (GMT)
Detected by	All Sophos products

Free virus scan
Download the Threat Detection Test

Free virus, spyware, and adware scan
Test your existing anti-virus protection
Find threats your anti-virus missed

Action

Summary
Action
More Information

Please follow the instructions for removing worms.

Delete the file c:\dllsystemhelp.bat if it is present.

Replace any system files that the worm has corrupted from backups or original installation media.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\App.EXEName

and delete it if it exists.

Close the registry editor.

More Information

Summary
Action
More Information

W32/Bodiru-A is a worm that uses peer-to-peer networks to spread. When run, the worm creates a large number of copies of itself in the Incoming folders of the popular peer-to-peer file sharing networks KaZaA, Kazaa Lite K++, Edonkey2000 and Emule.

W32/Bodiru-A uses the following filenames:

ACDSee 5.5.exe AOL Instant Messenger Crasher.exe AVP Antivirus Pro Key Crack.exe Adobe_Keyge.exe Age of Empires 2 crack.exe Aim bot ut3.exe All Microsoft Products CD Key Generator.exe All Norton Antivirus KEys!.exe Ana Kournikova Sex Video (downloader).exe Animated Screen 7.exe Any Nick Name Msn 6.0.exe Aol_cracker.exe AquaNox2 Crack.exe Audiograbber 2.05.exe BabeFest 2003 ScreenSaver 1.6.exe Battlefield1942_bloodpatch.exe Battlefield1942_keygen.exe Britney Spears Sex Video.exe Buffy Vampire Slayer Movie.exe BurnDvds.exe Business Card Designer Plus 7.9.exe Clone CD 5.0.0.3 (crack).exe Clone CD 5.0.0.3.exe Cool Edit Pro v2.55.exe Counter Strike - See Through Walls.exe Crack Passwords Mail.exe Credit Card Numbers generator(incl Visa,MasterCard).exe Credit_Card_Numbers_generator.exe DVD Copy Plus v5.0.exe DVD Region-Free 2.3.exe Darkness_Krew.exe DeadAim 4.0 KeyGen.exe Diablo 3 Crack.exe Diablo_2_Crack.exe DirectDVD 5.0.exe DirectX Buster (all versions).exe DivX Video Bundle 6.5.exe Divx_Pro_5.1_Serial.exe Divx_pro (FINAL!).exe Doom III (Cd KEys).exe Download Accelerator Plus 6.1.exe Dvd_Plus_Crack.exe Dvd_Ripper(The Best 04).exe Dvd_To_Vcd.exe Easy_Dvd_Ripper.exe Easy_Dvd_creator_Crack.exe Edonkey2000-Speed me up scotty.exe FIFA2003 crack.exe Fifa 2004 (Cd Crack).exe Final Fantasy VII XP Patch 1.5.exe Flash MX crack (trial).exe FlashGet 1.5.exe FreeRAM XP Pro 1.9.exe GTA 3 Crack.exe GTA 3 Serial.exe Game Cube Real Emulator.exe GetRight 5.0a.exe Gothic2 licence.exe Guitar Chords Library 5.5.exe Hack Any Kazaa User.exe Hack The School.exe Hack Website Easy.exe Hacker_The_LoveStory.exe Half Life 2 (Cd Crack).exe Half Life 2 (cd Keys).exe Harry potter2 Crack.exe Hitman_2_no_cd_crack.exe Hotmail Hacker Gold (All Msn Versions!).exe Hotmail_Hacker_2003-Xss_Exploit.exe Ip Nuker V6 (Reall Works).exe KaZaA Hack 2.5.0.exe KaZaA Speedup 3.6.exe KaZaA-Hack_2.5.0.exe Kazaa Lite )FINALL!(.exe Kazaa SDK + Xbit speedUp for 2.xx.exe LYNDEN.exe Links 2003 Golf game (crack).exe Living Waterfalls 1.3.exe Love.exe MSN Password Hacker 5.7 (worked on my ex-girlfriend!).exe MWorld Of Warcraft (FULL) Installer and Downloader.exe Macromedia product keys.exe Macromedia_Keygen.exe Mafia_crack.exe Mail Bomber For msn messsenger 6.0.exe Matrix Screensaver 1.5.exe Mcafee Antivirus Scan Crack.exe MediaPlayer Update.exe Messenger Plus Latest!.exe Microsoft .NET hack.exe Microsoft KeyGenerator-Allmost all microsoft stuff.exe Msn 6.0 (Multi Messenger).exe Msn 6.0 Crasher!.exe Msn 6.0 Kicker.exe Msn 6.0 Password Cracker.exe Msn Emotions (Version 6.0).exe Msn Emotions (Version 6.1).exe Msn Ip Finder 2004.exe Msn Messenger 6.0 Bomber!.exe Msn Messenger Betta 6.2.exe Music Download 2003 (Full Albums).exe NBA2003_crack.exe Need 4 Speed crack.exe Nero_Burning_Rom_Crack.exe Netbios Nuker 2003.exe Netbios Nuker 2004.exe Netfast 1.8.exe Network Cable e ADSL Speed 2.0.5.exe Nimo CodecPack (new) 8.0.exe Nimo_Codec_PackUpdater.exe Norton Anvirus Key Crack.exe PS2 PlayStation Simulator.exe PalTalk 5.01b.exe Panda Antivirus Titanium Crack.exe Pop-Up Stopper 3.5.exe Popup Defender 6.5.exe Ps2 Real Emulator.exe Quake 3 Keygen (works Great).exe Quake3 - See through wallz.exe Quick Time Key Crack.exe QuickTime_Pro_Crack.exe Real Sex Toys!.exe Screen saver christina aguilera naked.exe Security-2003-Update.exe Serials 2003 v.8.0 Full.exe Serials 2004 v.8.0 Full.exe SmartFTP 2.0.0.exe SmartRipper v2.7.exe Space Invaders 1978.exe Splinter_Cell_Crack.exe Starcraft serials.exe Stripping MP3 dancer+crack.exe Sub 7 2.9.exe Trillian 0.85 (free).exe TweakAll 3.8.exe UT2003_bloodpatch.exe UT2003_keygen.exe UT2003_no cd (crack).exe UT2003_patch.exe Unreal Tournament 2003 (Cd Crack).exe Unreal Tournament 2003 (Cd KEys).exe Unreal2_bloodpatch.exe Unreal2_crack.exe VB6.exe Visual Basic (ALL KEYS GEN).exe Visual Basic 6.0 Msdn Plugin.exe Visual Basic Decompiler.exe WarCraft_3_crack.exe WinOnCD 4 PE_crack.exe WinRar 3.xx Password Cracker.exe WinZip 9.0b (CRACK).exe WinZip 9.0b.exe WinZipped Visual C++ Tutorial.exe WindowBlinds_4.0.exe Windows XP complete + serial.exe Windows Xp Exploit.exe Winzip KeyGenerator Crack.exe XNuker 2003 2.93b.exe XNuker_2003_2.93b.exe Xvid_Codec_Installer.exe Yahoo Account Stealer.exe Yahoo Messenger 6.0.exe Zelda Classic 2.00.exe aol password cracker.exe cable modem ultility pack.exe cable modem.exe counter-strike.exe mIRC 6.40.exe pamela_anderson.exe play station emulator.exe serials2000.exe warcraft 3 crack (Really Works).exe warcraft 3 serials.exe winamp plugin pack.exe winzip full version key generator.exe

The worm may drop and run a batch file c:\dllsystemhelp.bat. The script contains instructions to enable sharing of the local drives.

W32/Bodiru-A creates the following registry value so that the worm file is run during the Windows startup process:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\App.EXEName

W32/Bodiru-A attempts to infect the following files:

C:\Program Files\WinZip\WINZIP32.EXE C:\Program Files\Norton AntiVirus\Navw32.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Windows\Wscript.exe C:\Windows\Rundll.exe C:\Windows\Rundll32.exe C:\winnt\Regedit.exe C:\Windows\System\Underwater.scr C:\windows\Regedit.exe C:\winnt\system32/Regedit.exe

The infection routine incorrectly infects files so that they become corrupt.

W32/Bodiru-A launches a denial-of-service attack against symantec.com and
mess.be using ICMP ping flooding, sending large packets to the destination.

The worm attempts to terminate processes related to anti-virus and security software using this list:

_AVP.EXE _AVP32.EXE _AVPM.EXE ANTI-TROJAN.EXE APVXDWIN.EXE AUTODOWN.EXE AVCONSOL.EXE AVE32.EXE AVGCTRL.EXE AVKSERV.EXE AVNT.EXE AVP.EXE AVP32.EXE AVPCC.EXE AVPDOS32.EXE AVPM.EXE AVPMON.EXE AVPNT.EXE AVPTC32.EXE AVPUPD.EXE AVSCHED32.EXE AVWIN95.EXE AVWUPD32.EXE BLACKD.EXE BLACKICE.EXE CCAPP.EXE CFIADMIN.EXE ESAFE.EXE CFIAUDIT.EXE CFIND.EXE CFINET.EXE CFINET32.EXE CLAW95.EXE CLAW95CF.EXE CLAW95CT.EXE CLEANER.EXE CLEANER3.EXE DV95.EXE DV95_O.EXE DVP95.EXE DVP95_0.EXE TerminateEXE ECENGINE.EXE EFINET32.EXE ESPWATCH.EXE F-AGNT95.EXE FINDVIRU.EXE FPROT.EXE F-PROT.EXE FPROT95.EXE F-PROT95.EXE FP-WIN.EXE FRW.EXE F-STOPW.EXE IAMAPP.EXE IAMSERV.EXE IBMASN.EXE IBMAVSP.EXE ICLOAD95.EXE ICLOADNT.EXE ICMON.EXE ICMOON.EXE ICSSUPPNT.EXE ICSUPP95.EXE ICSUPPNT.EXE IFACE.EXE IOMON98.EXE JED.EXE JEDI.EXE KPF.EXE KPFW32.EXE LOCKDOWN2000.EXE LOOKOUT.EXE LUALL.EXE MOOLIVE.EXE MPFTRAY.EXE N32SCAN.EXE N32SCANW.EXE NAVAPW32.EXE NAVLU32.EXE NAVSCHED.EXE NAVW.EXE NAVW32.EXE NAVWNT.EXE NISUM.EXE NMAIN.EXE NORMIST.EXE NUPGRADE.EXE NVC95.EXE OUTPOST.EXE PADMIN.EXE PAVCL.EXE PAVSCHED.EXE PAVW.EXE PCCWIN98.EXE PCFWALLICON.EXE PERSFW.EXE RAV7.EXE RAV7WIN.EXE RESCUE.EXE SAFEWEB.EXE SCAN32.EXE SCAN95.EXE SCANPM.EXE SCRSCAN.EXE SERV95.EXE SMC.EXE SPHINX.EXE SWEEP95.EXE TBSCAN.EXE TCA.EXE TDS2-98.EXE TDS2-NT.EXE VCONTROL.EXE VET32.EXE VET95.EXE VET98.EXE VETTRAY.EXE VSCAN40.EXE VSECOMR.EXE VSHWIN32.EXE VSSCAN40.EXE VSSTAT.EXE WEBSCAN.EXE WEBSCANX.EXE WFINDV32.EXE ZAPRO.EXE zonealarm.EXE mcafee.exe navapsvc.exe zaplus.exe vsmon.exe

Get reports about the latest virus and spyware threats delivered to your computer

In this section

W32/Bodiru-A

Summary

Action

More Information