Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Win32/VB.NUU

Aliases:Backdoor.Win32.VB.lea (Kaspersky), Generic BackDoor!bzm (McAfee) 
Type of infiltration:Worm  
Size:135168 B 
Affected platforms:Microsoft Windows 
Signature database version:3761 (20090113) 

Short description

Win32/VB.NUU is a worm that spreads via shared folders and on removable media.

Installation

When executed the worm copies itself in the following locations:
  • %windir%winste.exe
  • %allusersprofile%winste.exe
In order to be executed on every system start, the worm sets the following Registry entries:
  • [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion
    Run]
    "Winlogon" = "%windir%winste.exe"
  • [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion
    Run]
    "Winlogon" = "%allusersprofile%winste.exe"

Spreading via P2P networks

Win32/VB.NUU is a worm that spreads via P2P networks.

The worm searches for shared folders of the following programs:
  • Ares
  • Kazaa
  • LimeWire
  • WinMX
  • Morpheus
  • BearShare
  • Ares
  • Kazaa
  • LimeWire
  • WinMX
  • Morpheus
  • BearShare
  • Grokster
It tries to place a copy of itself into the folders.

The following filename is used:
  • %variable%
A string with variable content is used instead of %variable%.

Spreading on removable media

Win32/VB.NUU is a worm that spreads via removable media.

The worm copies itself into the root folders of removable drives using the following filename:
  • Setup.exe
The following file is dropped in the same folder:
  • autorun.inf
Thus, the worm ensures it is started each time infected media is inserted into the computer.

Other information

The worm is sent data and commands from a remote computer or the Internet.

The worm connects to the following addresses:
  • pajero2010exe.no-ip.biz
It can execute the following operations:
  • download files from a remote computer and/or Internet
  • run executable files
  • perform DoS/DDoS attacks
  • update itself to a newer version
  • remove itself from the infected computer
  • send files to a remote computer
  • download files from a remote computer and/or Internet
  • run executable files
  • perform DoS/DDoS attacks
  • update itself to a newer version
  • remove itself from the infected computer
  • send files to a remote computer
  • delete files
  • move files
  • capture screenshots