Thursday, November 10, 2011

Dorkbot (Worm) - 11.10.2011 - Analysis and Removal


====notes====
Creates a heh.cmd file with the following commands:
ping -n 15 127.0.0.1
taskkill /f /im gagajeje.exe
taskkill /f /im marcia.exe
taskkill /f /im hula.exe
taskkill /f /im official27.exe
taskkill /f /im ev0ga.exe
ping -n 15 127.0.0.1
ev0ga.exe

Creates the following files in user's %appdata%:
13.exe, 14.exe, 15.exe, 16.tmp, 17.exe, Ahiaia.exe.

Creates "kakao2" folder in user %appdata%.

"newmoon15.exe" in startup menu

a c:\documents folder according to CF.


====music====
Music: Bassnectar - Bass Head (MRK1 remix)

No comments:

Post a Comment