Kent_CM Blog

Virus: W32/Almanahe.B
Date discovered: 14/06/2007
Type: File infector
In the wild: Yes
Reported Infections: Low to medium
Distribution Potential: Medium to high
Damage Potential: Medium to high
Static file: No
IVDF version: 6.39.00.12 - Thu, 14 Jun 2007 09:01 (GMT+1)

General Method of propagation:
• Local network


Aliases:
• Symantec: W32.Almanahe.B
• Mcafee: W32/Almanahe.c virus
• Kaspersky: Virus.Win32.Alman.b
• TrendMicro: PE_CORELINK.C-1
• F-Secure: Virus.Win32.Alman.b
• Sophos: W32/Alman-C
• Panda: W32/Almanahe.C
• Grisoft: Win32/Alman
• VirusBuster: Win32.Alman.B
• Eset: Win32/Alman.NAB virus
• Bitdefender: Win32.Almanahe.D


Platforms / OS:
• Windows 95
• Windows 98
• Windows 98 SE
• Windows NT
• Windows ME
• Windows 2000
• Windows XP
• Windows 2003


Side effects:
• Drops malicious files
• Makes use of software vulnerability

Files The following files are created:

– %WINDIR%\linkinfo.dll Further investigation pointed out that this file is malware, too. Detected as: W32/Rectix.A

– %SYSDIR%\drivers\IsDrv118.sys Further investigation pointed out that this file is malware, too. Detected as: Rkit/Agent.GA

– %SYSDIR%\drivers\nvmini.sys Further investigation pointed out that this file is malware, too. Detected as: Rkit/Agent.GA

File infection Method:
This direct-action infector actively searches for files.

Network Infection In order to ensure its propagation the malware attemps to connect to other machines as described below.


It uses the following login information in order to gain access to the remote machine:

– The following username:
• Administrator

– The following list of passwords:
• admin; aaa; !@; $; asdf; asdfgh; !@; $%; !@; $%^; !@; $%^&; !@; $%^&*;
!@; $%^&*(; !@; $%^&*(); qwer; admin123; love; test123; owner;
mypass123; root; letmein; qwerty; abc123; password; monkey; password1;
1; 111; 123; 12345; 654321; 123456789


Process termination List of processes that are terminated:
• c0nime.exe; cmdbcs.exe; ctmontv.exe; explorer.exe; fuckjacks.exe;
iexpl0re.exe; iexpl0re.exe; iexplore.exe; internat.exe; logo_1.exe;
logo1_.exe; lsass.exe; lying.exe; msdccrt.exe; msvce32.exe;
ncscv32.exe; nvscv32.exe; realschd.exe; rpcs.exe; run1132.exe;
rundl132.exe; smss.exe; spo0lsv.exe; spoclsv.exe; ssopure.exe;
svch0st.exe; svhost32.exe; sxs.exe; sysbmw.exe; sysload3.exe;
tempicon.exe; upxdnd.exe; wdfmgr32.exe; wsvbs.exe


Injection – It injects the following file into a process: linkinfo.dll

Process name:
• explorer.exe


Rootkit Technology Hides the following:

– The following files:
• autorun.inf
• boot.exe
• linkinfo.dll
• nvmini.sys

– Registry keys that contain the following substring:
• nvmini


Download Tool for Remove >> Here !!

1. http://www.google.com/profiles
Create a Profile -> Edit your profile info -> Scroll down to the section "Add
custom links to my profile"
PR 10

2. http://www.flickr.com/help/forum/en-us/
Sign Up -> Personalize Your Profile -> Describe Yourself Box -> Add HTML
Code For Your URL + Anchor Text
PR 9

3.http://www.excite.com /
Create an account → My Bookmarks ->Edit it
PR 9

4.http://www.businessweek.com/
Choose an article → Leave a Comment (Older Articles will have a Higher PR).
PR 8

5.http://www.philly.com/
Register → Choose any (or related) story you like → Leave a 'comment' (Older
Story’s will have a Higher PR).
PR 7

6.http://yedda.com/
Again Like yahoo answers. Look for questions related to your
niches/keywords and answer them linking to your site. You'll receive backlinks
and traffic.
PR 7

7.http://abovethelaw.com/
Register - > Edit Profile → Edit 'Bio' box to create your anchor text backlink
PR 7

8.http://www.blurtit.com/
Like yahoo answers, just answer a question with a backlink included. Niche
related questions will then also send you traffic
PR 5

9.http://www.wired.com/
Register → Choose an article of your interest → Leave a 'comment'
PR 9

10.http://forge.mysql.com/
Register → Edit Profile → Enter your backlink in the 'Your Website' section
PR 7

Thank adsene5438 >thaiseo