|
Threat Center |
| Threat Center Threats Explained Threat Encyclopedia Threat Blog Security Tips Case Studies White Papers Newsletter Signup |
W32.Beglur.BW32.Beglur.B, W32.Narita Win32/Gluber.B is a worm spreading in the form of an attachment of the e-mail messages, and within the shared disks of PC networks. It works in Windows 95 or newer versions of Windows operating system. Its body has a length of 19526 bytes, and it is compressed by UPX utility. After it is decompressed its length is approximately 188 Kb. Note: In following text a symbolic inscription %windir% is used instead of the name of directory in which Windows operating system is installed. Of course, this may differ from installation to installation. The subdirectory System or System32 placed in %windir% has a name %system%. The worm arrives with an e-mail message having the subject, text of the body and the name of the file in the attachment randomly chosen from predefined text strings located in the worm's body. The message subject is one of the following. Hi! The name of the file in attachment of an e-mail message is created so that one of the extensions exe, com, pif or bat is attached to one of the following text strings. setup In the body of the message there is one of the following texts. Hey! It's that what you want! I hope so! Check the file
first then reply back if you have problem! After the file with the worm is run Win32/Gluber.B copies itself as a file djfgucxr.exe into the directory %system%, and also into the root directory of C: drive using randomly created filename. It assures its activation after restarting the operating system modifying the file system.ini in Windows 95/98/Me or system registry in Windows NT/2000/XP. It adds following line to the section [boot] of the system.ini file. shell=Explorer.exe Djfgucxr.exe Win32/Gluber.B acquires addresses for its spreading searching the files on the hard disk. Doing this it scans the files having extension WAB, TXT, MHT, HTM, HTML, EML, JSE, ASP, DBX, MBX, MMF, TBB, NCH, ODS and VCF. Win32/Gluber.B spreads also via available shared disks of an network. It copies itself to these disks as a file with randomly chosen name having one of the following extensions exe, com, pif or bat. It inactivates processes having names as per following list. AVPM.EXE In addition to above given processes the worm inactivates also processes having following strings in their names. Norton Win32/Gluber.B enables the remote control of an infected computer. There is a text W32.Narita in the body of the worm. The detection of Win32/Gluber.B using sample is added from the version 1.587. PROTECT YOUR COMPUTER!
|
|
Solutions -
Products -
Purchase -
Download -
Support -
Threat Center -
Partners -
Company -
Global Sites
Copyright© 2006 by ESET, LLC. All rights reserved. |