Gnutella Forums  

Go Back   Gnutella Forums > Current Gnutella Client Forums > LimeWire+WireShare (Cross-platform) > Technical Support > General Windows Support
Register FAQ The Twelve Commandments Members List Calendar Arcade Find the Best VPN Today's Posts

General Windows Support For questions about Windows issues regarding LimeWire or WireShare or related questions


Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old February 18th, 2007
mickjapa108's Avatar
Valued Member contributor
 
Join Date: February 2nd, 2006
Location: England
Posts: 1,405
mickjapa108 has a spectacular aura about
Default

Hi every one
This is expansion of 2nd Link that Birdy Gave, Users can check if they have any of these files n folders present on there computer
By copying the names EXACTLY to Notepad, then Boot in safe mode.

Note: In file options, you must enable SHOW hidden files.
Before Boot in safe mode

Then Go, Start/Search n enter exact file names. If found please make short
posts in this thread ONLY, No life history just list of file names & anything
related directly. We appreciate you help, Thank you.

Win32.Worm.VB.Ymeak.A
Spreading: MEDIUM
Damage: MEDIUM
Size: 236,136
Discovered: 2006 Mar 02

SYMPTOMS:

Presence of the following files:

%windir%\b.exe (usually C:\Windows\b.exe), 155,648 bytes
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\svchost.exe, 236,136 bytes
The file xzxzxzxzxzxz.exe (236,136 bytes) may appear in a subdirectory called "_" (underscore)
in the shared folders of peer-to-peer file sharing applications.
TECHNICAL DESCRIPTION:
This is a worm that spreads itself via peer-to-peer file sharing networks,
dropping a backdoor identified by BitDefender as Backdoor.RBot.CMQ. It has a file size of 236,136 bytes.

The first time it is run, it displays the following message to make the user believe it is a setup file downloaded with errors:

After displaying the message, it copies itself to the All Users' startup folder
(usually C:\Documents and Settings\All Users\Start Menu\Programs\Startup\)
as svchost.exe, and launches itself from that new location.
The original instance ends its execution at this point.

When launched from the afore mentioned (Startup) folder, it checks if the %system%
(usually C:\Windows\System32) folder contains any of the following files:
winlog.exe, p2pnetworking.exe, scvhost.exe, winlogi.exe or p2pnetwork.exe.
These are all file names used by the RBot trojan. If it can't find any of them,
it assumes the RBot trojan is not present so it dropps it into the Windows folder as b.exe and runs it.

To spread itself, it collects random application names from certain torrent and direct download sites.
It then places itself in the shared folder of five common P2P file sharing software (listed below)
using the previousely collected names, in a subfolder called "_" (underscore).
At regular intervals it looks for the executable files of the file sharing programs
Limewire, Shareaza, Bearshare, Morpheus and Morpheus Ultra and launches them.

To protect itself from being discovered, it opens the following files (requesting exclusive access):
cmd.exe, netstat.exe, tracert.exe, ping.exe, ipconfig.exe, taskkill.exe, regedt32.exe
and taskmgr.exe from the %system% folder and regedit.exe from the %windir% folder.
It keeps them open while it is active, so they can not be executed.
Removal instructions:

Please let BitDefender disinfect your files.
ANALYZED BY:

Vlad Ioan Topan, BitDefender Virus Researcher
__________________
mickjapa108
Reply With Quote
Reply


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Similar Threads
Thread Thread Starter Forum Replies Last Post
download avi cannot be converted Lowey Open Discussion topics 2 February 13th, 2006 03:04 AM
converted wma files show up in limewire not i tunes jillw General Mac OSX Support 1 January 5th, 2006 01:01 PM
Adding Files/ Folder from LimeWire Pro to iTunes without duplicating files. HELP!! rgagama Tips & Tricks 0 January 26th, 2005 06:37 AM
all downloaded files are limewire type files, unplayable Luna_Tick Download/Upload Problems 1 February 19th, 2004 10:51 PM
mp3s need to be converted now before i burn NeetFreek General Mac Support 6 August 5th, 2003 11:15 AM


All times are GMT -7. The time now is 06:27 AM.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2025, vBulletin Solutions, Inc.
SEO by vBSEO 3.6.0 ©2011, Crawlability, Inc.

Copyright © 2020 Gnutella Forums.
All Rights Reserved.