P2P-Worm:W32/Bacteraloh

Classification

Category :

Malware

Type :

P2P-Worm

Platform :

W32

Aliases :

P2P-Worm:W32/Bacteraloh, P2P-Worm.Win32.Bacteraloh, Win32.Sality

Summary

P2P-Worm.Win32.Bacteraloh is a family of P2P-Worms similar to P2P.Worm.Win32.Backterra. Unlike Backterra, Bacteraloh variants may have the additional functionality of dropping Virus.Win32.Sality variants. For a description of Sality, please see our description of Virus.Win32.Sality.Q

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

Check for the latest database updates

First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample

After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning

If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

Note: You need administrative rights to change the settings.

Technical Details

Distribution

Bacteraloh spreads through file-sharing networks (primarily Emule) by disguising itself as a software crack. To give credibility to the illusion, when executed the worm will display a fake interface and a dialog box with the message "Missing MFClibary.dll", as seen in the samples below:

Installation

The Bateraloh variants that include functionality to install Virus.Win32.Sality will drop a standalone DLL in the folder %system32%. The DLL file is then injected into running processes. If Emule file sharing software is detected, Bacteraloh will create multiple copies of itself in:

C:\Windows\Temp\Bactera\Â

The copies are labeled using names selected from a long list. The names are mostly in the following format:

Crack & Keygen all Versions e.g., Spacetanks Crack & Keygen all Versions
Crack & Keygen and all lower versions e.g., Winamp 5.112 Pro and all lower Versions Crack & Keygen

More Support

Community

Ask questions in our Community .

User Guides

Check the user guide for instructions.

Contact Support

Chat with or call an expert.

Submit a Sample

Submit a file or URL for analysis.