Selected viruses, spyware, and other threats: sorted alphabetically

O
P
Q
R
S
T
U
V
W
X
Y
Z
Glossary

Win32/Anilogo.F

Aliases:	Worm.Win32.Anilogo.f (Kaspersky), W32.Mumawow.F (Symantec), TrojanDownloader:Win32/Cekar.gen!A (Microsoft)
Type of infiltration:	Worm
Size:	28000 B
Affected platforms:	Microsoft Windows
Signature database version:	2766 (20080104)

Short description

Win32/Anilogo.F is a worm which tries to download other malware from the Internet.

Installation

When executed, the worm copies itself into the following location:

%windir%Fontssyn00-23-7D-C5-B7-B9systemsmss.exe (28000
B)

In order to be executed on every system start, the worm sets the following Registry entry:

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
Run]
"TBMonEx" =
"%windir%Fontssyn00-23-7D-C5-B7-B9systemsmss.exe"

The following Registry entries are created:

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersion
Image File Execution Options%application%]
"Debugger" = "net"

The %application% is one of the following strings:

_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
360rpt.exe
360Safe.exe
360tray.exe

Spreading on removable media

The worm copies itself into the root folders of fixed and/or removable drives using the following filename:

%drive%ntldr.exe (28000 B)

The following file is dropped in the same folder:

%drive%autorun.inf

Thus, the worm ensures it is started each time infected media is inserted into the computer.

Executable file infection

Win32/Anilogo.F can infect executable files.

The worm searches local and network drives for files with one of the following extensions:

.exe

It avoids files which contain any of the following strings in their path:

Common Files
Internet Explorer
recycler
system volume information
windows
Windows NT

It avoids files with the following filenames:

AdBalloonExt.exe
BackgroundDownloader.exe
BugReport.exe
CA.exe
CONFIG.exe
CoralQQ.exe

Files are infected by adding a new section that contains the worm .

The host file is modified in a way that causes the worm to be executed prior to running the original code.

The size of the inserted code is 29 KB.

Other information

The worm acquires data and commands from a remote computer or the Internet.

The worm contains a list of (7) URLs. The HTTP protocol is used.

It can execute the following operations:

download files from a remote computer and/or the Internet
run executable files

The worm may create the following files:

%windir%Fontssyn00-23-7D-C5-B7-B9systemsmss.exe.tmp
%windir%Fontssyn00-23-7D-C5-B7-B9systemSYSTEM128.tmp
%windir%Fontssyn00-23-7D-C5-B7-B9systemSYSTEM128.vxd
%windir%Fontssyn00-23-7D-C5-B7-B9system10074.INC
%windir%Fontssyn00-23-7D-C5-B7-B9system%variable1%
%variable2%.bat

A string with variable content is used instead of %variable1-2%.

The worm may set the following Registry entries:

[HKEY_CURRENT_USERControl PanelCursors]
"AppStarting" = "%systemroot%Cursors3dwarro.cur"
"AppStarting" = ""
[HKEY_LOCAL_MACHINESOFTWAREGoogleBA]
"setup" = "yes"

The worm launches the following processes:

explorer.exe
iexplore.exe