Virus: W32/Almanahe.B
Date discovered: 14/06/2007
Type: File infector
In the wild: Yes
Reported Infections: Low to medium
Distribution Potential: Medium to high
Damage Potential: Medium to high
Static file: No
IVDF version: 6.39.00.12 - Thu, 14 Jun 2007 09:01 (GMT+1)

General Method of propagation:
• Local network


Aliases:
• Symantec: W32.Almanahe.B
• Mcafee: W32/Almanahe.c virus
• Kaspersky: Virus.Win32.Alman.b
• TrendMicro: PE_CORELINK.C-1
• F-Secure: Virus.Win32.Alman.b
• Sophos: W32/Alman-C
• Panda: W32/Almanahe.C
• Grisoft: Win32/Alman
• VirusBuster: Win32.Alman.B
• Eset: Win32/Alman.NAB virus
• Bitdefender: Win32.Almanahe.D


Platforms / OS:
• Windows 95
• Windows 98
• Windows 98 SE
• Windows NT
• Windows ME
• Windows 2000
• Windows XP
• Windows 2003


Side effects:
• Drops malicious files
• Makes use of software vulnerability

Files The following files are created:

– %WINDIR%\linkinfo.dll Further investigation pointed out that this file is malware, too. Detected as: W32/Rectix.A

– %SYSDIR%\drivers\IsDrv118.sys Further investigation pointed out that this file is malware, too. Detected as: Rkit/Agent.GA

– %SYSDIR%\drivers\nvmini.sys Further investigation pointed out that this file is malware, too. Detected as: Rkit/Agent.GA

File infection Method:
This direct-action infector actively searches for files.

Network Infection In order to ensure its propagation the malware attemps to connect to other machines as described below.


It uses the following login information in order to gain access to the remote machine:

– The following username:
• Administrator

– The following list of passwords:
• admin; aaa; !@; $; asdf; asdfgh; !@; $%; !@; $%^; !@; $%^&; !@; $%^&*;
!@; $%^&*(; !@; $%^&*(); qwer; admin123; love; test123; owner;
mypass123; root; letmein; qwerty; abc123; password; monkey; password1;
1; 111; 123; 12345; 654321; 123456789


Process termination List of processes that are terminated:
• c0nime.exe; cmdbcs.exe; ctmontv.exe; explorer.exe; fuckjacks.exe;
iexpl0re.exe; iexpl0re.exe; iexplore.exe; internat.exe; logo_1.exe;
logo1_.exe; lsass.exe; lying.exe; msdccrt.exe; msvce32.exe;
ncscv32.exe; nvscv32.exe; realschd.exe; rpcs.exe; run1132.exe;
rundl132.exe; smss.exe; spo0lsv.exe; spoclsv.exe; ssopure.exe;
svch0st.exe; svhost32.exe; sxs.exe; sysbmw.exe; sysload3.exe;
tempicon.exe; upxdnd.exe; wdfmgr32.exe; wsvbs.exe


Injection – It injects the following file into a process: linkinfo.dll

Process name:
• explorer.exe


Rootkit Technology Hides the following:

– The following files:
• autorun.inf
• boot.exe
• linkinfo.dll
• nvmini.sys

– Registry keys that contain the following substring:
• nvmini


Download Tool for Remove >> Here !!