Worm: Worm.Win32.Bototer.cr

Acquisition time :2010-5-26

Risk level: Medium

virus symptoms:

The sample is the trojan downloader prepared by “VC”, size, “1,489,408″ bytes, the icon is ““, Virus extension” exe “, mainly through the” removable storage media “,” file bundle “,” download manager “,” page linked to race “, etc., the viruses main purpose is to download and run the virus.
After the user’s computer was infected, the system will appear to run Slow, the network slows down, system error for no reason, a large number of unknown processes, anti-virus software can not start, can not enter safe mode and so on.

Infected object:

Windows 2000/Windows XP / Windows 2003/Windows Vista / Windows 7

Transmission:

Removable storage media, Web Trojans, file bundle, download manager

Manually delete method:

1. Replace the following documents with a normal system file:

% SystemRoot% \ system32 \ appmgmts.dll
% SystemRoot% \ system32 \ drivers \ etc \ hosts

2. Note the table with the normal values into the following location:

HKEY_LOCAL_MACHINE \ SYSTEM \ ControlSet001 \ Control \ SafeBoot
HKEY_LOCAL_MACHINE \ SYSTEM \ ControlSet001 \ Control \ Network

Variable declaration:

% SystemDriver% system where the partition, typically “C: \”
% SystemRoot% WINDODWS directory, usually “C: \ Windows”
% Documents and Settings% user documentation directory, usually “C: \ Documents and Settings”
% Temp% temp folder, usually “C: \ Documents and Settings \ current user name \ Local Settings \ Temp”
% ProgramFiles% system program default installation directory, typically: “C: \ ProgramFiles”

The virus creates a file:

% SystemRoot% \ DelInfo.bin
% SystemRoot% \ booter.exe
% SystemRoot% \ system32 \ appmgmts.dll
X: \ autorun.inf (X is the letter of the infected disk)
X: \ recycle. (645FF040-5081-101B-9F08-00AA002F954E) \ Setup.exe

Virus delete the file:

% SystemRoot% \ DelInfo.bin
% SystemRoot% \ booter.exe

Viruses modify the file:

% SystemRoot% \ system32 \ appmgmts.dll
% SystemRoot% \ system32 \ drivers \ etc \ hosts

Virus delete the Registry:

HKEY_LOCAL_MACHINE \ SYSTEM \ ControlSet001 \ Control \ SafeBoot
HKEY_LOCAL_MACHINE \ SYSTEM \ ControlSet001 \ Control \ Network