Worm.Win32.Slenfbot_1e484c4dce
HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Worm.Win32.Slenfbot!IK (Emsisoft)
Behaviour: Trojan, Worm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
The sample has been submitted by Lavasoft customers.
MD5: 1e484c4dcec88c3f624e998254526881
SHA1: 67b0b09f97ec14b22bb558490bd7095f37d04533
SHA256: 6db56cbcda4dd03433853eb9a256644b776d799f32979658e13417a262f92c06
SSDeep: 1536:lEXzfXeRZhjgu5VQrBanw5nTN8a9B1IuAbWhVtVmAKTwL:6PyhjguLQrTTN8a93I7b2DV7K8L
Size: 73728 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, BorlandDelphiv30, UPolyXv05_v6
Company: no certificate found
Created at: 2001-07-04 03:06:49
Analyzed on: WindowsXP SP3 32-bit
Summary:
Worm. A program that is primarily replicating on networks or removable drives.
Payload
No specific payload has been found.
Process activity
The Worm creates the following process(es):
No processes have been created.
The Worm injects its code into the following process(es):
No processes have been created.
File activity
No files have been created.
Registry activity
Network activity (URLs)
No activity has been detected.
HOSTS file anomalies
The Worm modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 11177 bytes in size. The following strings are added to the hosts file listed below:
| 127.0.0.1 | msnfix.changelog.fr |
| 127.0.0.1 | www.incodesolutions.com |
| 127.0.0.1 | virusinfo.prevx.com |
| 127.0.0.1 | download.bleepingcomputer.com |
| 127.0.0.1 | www.dazhizhu.cn |
| 127.0.0.1 | www.nabble.com |
| 127.0.0.1 | lurker.clamav.net |
| 127.0.0.1 | lexikon.ikarus.at |
| 127.0.0.1 | research.sunbelt-software.com |
| 127.0.0.1 | www.virusdoctor.jp |
| 127.0.0.1 | www.elitepvpers.de |
| 127.0.0.1 | www.superuser.co.kr |
| 127.0.0.1 | ntfaq.co.kr |
| 127.0.0.1 | v.dreamwiz.com |
| 127.0.0.1 | cit.kookmin.ac.kr |
| 127.0.0.1 | forums.whatthetech.com |
| 127.0.0.1 | forum.hijackthis.de |
| 127.0.0.1 | www.huaifai.go.th |
| 127.0.0.1 | www.mostz.com |
| 127.0.0.1 | www.krupunmai.com |
| 127.0.0.1 | www.cddchiangmai.net |
| 127.0.0.1 | forum.malekal.com |
| 127.0.0.1 | tech.pantip.com |
| 127.0.0.1 | sapcupgrades.com |
| 127.0.0.1 | www.247fixes.com |
| 127.0.0.1 | forum.sysinternals.com |
| 127.0.0.1 | forum.telecharger.01net.com |
| 127.0.0.1 | sophos.com |
| 127.0.0.1 | foros.softonic.com |
| 127.0.0.1 | avast-home.uptodown.com |
| 127.0.0.1 | www.f-secure.com |
| 127.0.0.1 | www.chkrootkit.org |
| 127.0.0.1 | diamondcs.com.au |
| 127.0.0.1 | www.rootkit.nl |
| 127.0.0.1 | www.sysinternals.com |
| 127.0.0.1 | z-oleg.com |
| 127.0.0.1 | espanol.dir.groups.yahoo.com |
| 127.0.0.1 | www.castlecrops.com |
| 127.0.0.1 | www.misec.net |
| 127.0.0.1 | safecomputing.umn.edu |
| 127.0.0.1 | www.antirootkit.com |
| 127.0.0.1 | www.greatis.com |
| 127.0.0.1 | ar.answers.yahoo.com |
| 127.0.0.1 | www.rootkit.com |
| 127.0.0.1 | www.pctools.com |
| 127.0.0.1 | www.pcsupportadvisor.com |
| 127.0.0.1 | www.resplendence.com |
| 127.0.0.1 | www.personal.psu.edu |
| 127.0.0.1 | foro.ethek.com |
| 127.0.0.1 | vil.nail.comm |
| 127.0.0.1 | search.mcafee.com |
| 127.0.0.1 | wwww.mcafee.com |
| 127.0.0.1 | download.nai.com |
| 127.0.0.1 | wwww.experts-exchange.com |
| 127.0.0.1 | www.bakunos.com |
| 127.0.0.1 | www.Merijn.org |
| 127.0.0.1 | www.spywareinfo.com |
| 127.0.0.1 | www.spybot.info |
| 127.0.0.1 | www.viruslist.com |
| 127.0.0.1 | www.hijackthis.de |
| 127.0.0.1 | www.f-secure.com |
| 127.0.0.1 | forum.kaspersky.com |
| 127.0.0.1 | majorgeeks.com |
| 127.0.0.1 | www.avp.com |
| 127.0.0.1 | www.virustotal.com |
| 127.0.0.1 | www.sophos.com |
| 127.0.0.1 | linhadefensiva.uol.com.br |
| 127.0.0.1 | cmmings.cn |
| 127.0.0.1 | www.sergiwa.com |
| 127.0.0.1 | www.avg-antivirus.net |
| 127.0.0.1 | www.kaspersky-labs.com |
| 127.0.0.1 | www.kaspersky.com |
| 127.0.0.1 | www.bleepingcomputer.com |
| 127.0.0.1 | www.free.grisoft.com |
| 127.0.0.1 | securityresponse.symantec.com |
| 127.0.0.1 | www.analysis.seclab.tuwien.ac.at |
| 127.0.0.1 | www.symantec.com |
| 127.0.0.1 | www.kztechs.com |
| 127.0.0.1 | ad-aware-se.uptodown.com |
| 127.0.0.1 | liveupdate.symantecliveupdate.com |
| 127.0.0.1 | liveupdate.symantec.com |
| 127.0.0.1 | customer.symantec.com |
| 127.0.0.1 | update.symantec.com |
| 127.0.0.1 | www.box.net |
| 127.0.0.1 | www.mcafee.com |
| 127.0.0.1 | www.free.avg.com |
| 127.0.0.1 | download.mcafee.com |
| 127.0.0.1 | mast.mcafee.com |
| 127.0.0.1 | www.tecno-soft.com |
| 127.0.0.1 | ladooscuro.es |
| 127.0.0.1 | ftp.drweb.com |
| 127.0.0.1 | guru0.grisoft.cz |
| 127.0.0.1 | guru1.grisoft.cz |
| 127.0.0.1 | guru2.grisoft.cz |
| 127.0.0.1 | guru3.grisoft.cz |
| 127.0.0.1 | download.bleepingcomputer.com |
| 127.0.0.1 | it.answers.yahoo.com |
| 127.0.0.1 | guru4.grisoft.cz |
| 127.0.0.1 | guru5.grisoft.cz |
| 127.0.0.1 | www.virusspy.com |
| 127.0.0.1 | www.download.f-secure.com |
| 127.0.0.1 | www.malwareremoval.com |
| 127.0.0.1 | forums.cnet.com |
| 127.0.0.1 | hjt-data.trend-braintree.com |
| 127.0.0.1 | www.pantip.com |
| 127.0.0.1 | secubox.aldria.com |
| 127.0.0.1 | www.forospyware.com |
| 127.0.0.1 | www.manuelruvalcaba.com |
| 127.0.0.1 | www.zonavirus.com |
| 127.0.0.1 | www.siteadvisor.com |
| 127.0.0.1 | blog.threatfire.com |
| 127.0.0.1 | www.threatexpert.com |
| 127.0.0.1 | blog.hispasec.com |
| 127.0.0.1 | www.configurarequipos.com |
| 127.0.0.1 | sosvirus.changelog.fr |
| 127.0.0.1 | mailcenter.rising.com.cn |
| 127.0.0.1 | mailcenter.rising.com |
| 127.0.0.1 | www.rising.com.cn |
| 127.0.0.1 | www.rising.com |
| 127.0.0.1 | www.babooforum.com.br |
| 127.0.0.1 | www.runscanner.net |
| 127.0.0.1 | sosvirus.changelog.fr |
| 127.0.0.1 | upload.changelog.fr |
| 127.0.0.1 | www.raymond.cc |
| 127.0.0.1 | changelog.fr |
| 127.0.0.1 | www.pcentraide.com |
| 127.0.0.1 | atazita.blogspot.com |
| 127.0.0.1 | www.final4ever.com |
| 127.0.0.1 | files.filefont.com |
| 127.0.0.1 | www.infos-du-net.com |
| 127.0.0.1 | www.trendsecure.com |
| 127.0.0.1 | forum.hardware.fr |
| 127.0.0.1 | www.utilidades-utiles.comwww.spychecker.com |
| 127.0.0.1 | www.geekstogo.com |
| 127.0.0.1 | forums.maddoktor2.com |
| 127.0.0.1 | www.smokey-services.eu |
| 127.0.0.1 | www.clubic.com |
| 127.0.0.1 | www.linhadefensiva.org |
| 127.0.0.1 | download.sysinternals.com |
| 127.0.0.1 | www.pcguide.com |
| 127.0.0.1 | www.thetechguide.com |
| 127.0.0.1 | www.ozzu.com |
| 127.0.0.1 | www.changedetection.com |
| 127.0.0.1 | espanol.groups.yahoo.com |
| 127.0.0.1 | community.thaiware.com |
| 127.0.0.1 | www.avpclub.ddns.info |
| 127.0.0.1 | www.offensivecomputing.net |
| 127.0.0.1 | www.grisoft.com |
| 127.0.0.1 | boardreader.com |
| 127.0.0.1 | www.guiadohardware.net |
| 127.0.0.1 | www.msnvirusremoval.com |
| 127.0.0.1 | www.cisrt.org |
| 127.0.0.1 | fixmyim.com |
| 127.0.0.1 | samroeng.hi5.com |
| 127.0.0.1 | foro.elhacker.net |
| 127.0.0.1 | www.daboweb.com |
| 127.0.0.1 | service1.symantec.com |
| 127.0.0.1 | forums.techguy.org |
| 127.0.0.1 | www.incodesolutions.com |
| 127.0.0.1 | hijackthis.download3000.com |
| 127.0.0.1 | www.cybertechhelp.com |
| 127.0.0.1 | www.superdicas.com.br |
| 127.0.0.1 | downloads.andymanchesta.com |
| 127.0.0.1 | andymanchesta.com |
| 127.0.0.1 | info.prevx.com |
| 127.0.0.1 | aknow.prevx.com |
| 127.0.0.1 | www.zonavirus.com |
| 127.0.0.1 | securitywonks.net |
| 127.0.0.1 | www.lavasoft.com |
| 127.0.0.1 | www.virscan.org |
| 127.0.0.1 | www.eeload.com |
| 127.0.0.1 | down.www.kingsoft.com |
| 127.0.0.1 | www.file.net |
| 127.0.0.1 | onecare.live.com |
| 127.0.0.1 | mvps.org |
| 127.0.0.1 | www.housecall.trendmicro.com |
| 127.0.0.1 | www.avast.com |
| 127.0.0.1 | www.free.avg.com |
| 127.0.0.1 | www.onlinescan.avast.com |
| 127.0.0.1 | www.ewido.net |
| 127.0.0.1 | www.trucoswindows.net |
| 127.0.0.1 | www.futurenow.bitdefender.com |
| 127.0.0.1 | www.bitdefender.com |
| 127.0.0.1 | www.f-prot.com |
| 127.0.0.1 | www.trendsecure.com |
| 127.0.0.1 | security.symantec.com |
| 127.0.0.1 | oldtimer.geekstogo.com |
| 127.0.0.1 | www.avira.com |
| 127.0.0.1 | www.eset.com |
| 127.0.0.1 | www.free.avg.com |
| 127.0.0.1 | www.free-av.com |
| 127.0.0.1 | kr.ahnlab.com |
| 127.0.0.1 | www.eset.com |
| 127.0.0.1 | forospyware.com |
| 127.0.0.1 | thejokerx.blogspot.com |
| 127.0.0.1 | www.2-spyware.com |
| 127.0.0.1 | www.antivir.es |
| 127.0.0.1 | www.prevx.com |
| 127.0.0.1 | www.ikarus.net |
| 127.0.0.1 | bbs.s-sos.net |
| 127.0.0.1 | www.housecall.trendmicro.com |
| 127.0.0.1 | www.superdicas.com.br |
| 127.0.0.1 | www.forums.majorgeeks.com |
| 127.0.0.1 | www.castlecops.com |
| 127.0.0.1 | www.virusspy.com |
| 127.0.0.1 | andymanchesta.com |
| 127.0.0.1 | www.kaspersky.es |
| 127.0.0.1 | subs.geekstogo.com |
| 127.0.0.1 | www.trendmicro.com |
| 127.0.0.1 | www.fortinet.com |
| 127.0.0.1 | www.safer-networking.org |
| 127.0.0.1 | www.fortiguardcenter.com |
| 127.0.0.1 | www.dougknox.com |
| 127.0.0.1 | www.vsantivirus.com |
| 127.0.0.1 | www.firewallguide.com |
| 127.0.0.1 | www.auditmypc.com |
| 127.0.0.1 | www.spywaredb.com |
| 127.0.0.1 | www.mxttchina.com |
| 127.0.0.1 | www.ziggamza.net |
| 127.0.0.1 | www.forospyware.es |
| 127.0.0.1 | www.antivirus.comodo.com |
| 127.0.0.1 | www.spywareterminator.com |
| 127.0.0.1 | www.eradicatespyware.net |
| 127.0.0.1 | www.freespywareremoval.info |
| 127.0.0.1 | www.personalfirewall.comodo.com |
| 127.0.0.1 | www.clamav.net |
| 127.0.0.1 | www.antivirus.about.com |
| 127.0.0.1 | www.pandasecurity.com |
| 127.0.0.1 | www.webphand.com |
| 127.0.0.1 | mx.answers.yahoo.com |
| 127.0.0.1 | www.securitywonks.net |
| 127.0.0.1 | www.sandboxie.com |
| 127.0.0.1 | www.clamwin.com |
| 127.0.0.1 | www.cwsandbox.org |
| 127.0.0.1 | www.ca.com |
| 127.0.0.1 | www.arswp.com |
| 127.0.0.1 | es.answers.yahoo.com |
| 127.0.0.1 | www.trucoswindows.es |
| 127.0.0.1 | www.networkworld.com |
| 127.0.0.1 | www.cddchiangmai.net |
| 127.0.0.1 | www.threatexpert.com |
| 127.0.0.1 | www.norman.com |
| 127.0.0.1 | espanol.answers.yahoo.com |
| 127.0.0.1 | www.tallemu.com |
| 127.0.0.1 | virscan.org |
| 127.0.0.1 | www.viruschief.com |
| 127.0.0.1 | scanner.virus.org |
| 127.0.0.1 | www.hijackthis.de |
| 127.0.0.1 | housecall65.trendmicro.com |
| 127.0.0.1 | www.guiadohardware.net |
| 127.0.0.1 | hjt.networktechs.com |
| 127.0.0.1 | www.techsupportforum.com |
| 127.0.0.1 | www.whatthetech.com |
| 127.0.0.1 | www.soccersuck.com |
| 127.0.0.1 | www.pcentraide.com |
| 127.0.0.1 | comunidad.wilkinsonpc.com.co |
| 127.0.0.1 | forum.piriform.com |
| 127.0.0.1 | www.tweaksforgeeks.com |
| 127.0.0.1 | www.daniweb.com |
| 127.0.0.1 | www.geekstogo.com |
| 127.0.0.1 | es.answers.yahoo.com |
| 127.0.0.1 | www.techsupportforum.com |
| 127.0.0.1 | www.pchell.com |
| 127.0.0.1 | www.spyany.com |
| 127.0.0.1 | forums.techguy.org |
| 127.0.0.1 | www.experts-exchange.com |
| 127.0.0.1 | www.wikio.es |
| 127.0.0.1 | www.pandasecurity.com |
| 127.0.0.1 | forums.devshed.com |
| 127.0.0.1 | forum.tweaks.com |
| 127.0.0.1 | www.wilderssecurity.com |
| 127.0.0.1 | www.techspot.com |
| 127.0.0.1 | www.thecomputerpitstop.com |
| 127.0.0.1 | es.wasalive.com |
| 127.0.0.1 | secunia.com |
| 127.0.0.1 | www.computing.net |
| 127.0.0.1 | discussions.virtualdr.com |
| 127.0.0.1 | forum.securitycadets.com |
| 127.0.0.1 | www.techimo.com |
| 127.0.0.1 | 13iii.com |
| 127.0.0.1 | www.dicasweb.com.br |
| 127.0.0.1 | www.infosecpodcast.com |
| 127.0.0.1 | www.usbcleaner.cn |
| 127.0.0.1 | www.net-security.org |
| 127.0.0.1 | www.bleedingthreats.net |
| 127.0.0.1 | acs.pandasoftware.com |
| 127.0.0.1 | www.funkytoad.com |
| 127.0.0.1 | www.360safe.cn |
| 127.0.0.1 | www.360safe.com |
| 127.0.0.1 | bbs.360safe.cn |
| 127.0.0.1 | bbs.360safe.com |
| 127.0.0.1 | codehard.wordpress.com |
| 127.0.0.1 | forum.clubedohardware.com.br |
| 127.0.0.1 | www.360.cn |
| 127.0.0.1 | www.360.com |
| 127.0.0.1 | bbs.360safe.cn |
| 127.0.0.1 | bbs.360safe.com |
| 127.0.0.1 | www.forospyware.es |
| 127.0.0.1 | p3dev.taringa.net |
| 127.0.0.1 | www.precisesecurity.com |
| 127.0.0.1 | baike.360.cn |
| 127.0.0.1 | baike.360.com |
| 127.0.0.1 | kaba.360.cn |
| 127.0.0.1 | kaba.360.com |
| 127.0.0.1 | deckard.geekstogo.com |
| 127.0.0.1 | www.taringa.net |
| 127.0.0.1 | forums.comodo.com |
| 127.0.0.1 | www.mvps.org |
| 127.0.0.1 | down.360safe.cn |
| 127.0.0.1 | down.360safe.com |
| 127.0.0.1 | x.360safe.com |
| 127.0.0.1 | dl.360safe.com |
| 127.0.0.1 | ftp.drweb.com |
| 127.0.0.1 | www.hotshare.net |
| 127.0.0.1 | es.wasalive.com |
| 127.0.0.1 | updatem.360safe.com |
| 127.0.0.1 | updatem.360safe.cn |
| 127.0.0.1 | update.360safe.cn |
| 127.0.0.1 | update.360safe.com |
| 127.0.0.1 | www.utilidades-utiles.com |
| 127.0.0.1 | forum.kaspersky.com |
| 127.0.0.1 | bbs.duba.net |
| 127.0.0.1 | www.duba.net |
| 127.0.0.1 | zhidao.baidu.com |
| 127.0.0.1 | hi.baidu.com |
| 127.0.0.1 | www.drweb.com.es |
| 127.0.0.1 | msncleaner.softonic.com |
| 127.0.0.1 | www.javacoolsoftware.com |
| 127.0.0.1 | file.ikaka.com |
| 127.0.0.1 | file.ikaka.cn |
| 127.0.0.1 | bbs.ikaka.com |
| 127.0.0.1 | zhidao.ikaka.com |
| 127.0.0.1 | www.eset-la.com |
| 127.0.0.1 | www.eset-la.com |
| 127.0.0.1 | software-files.download.com |
| 127.0.0.1 | www.ikaka.com |
| 127.0.0.1 | www.ikaka.cn |
| 127.0.0.1 | bbs.cfan.com.cn |
| 127.0.0.1 | www.cfan.com.cn |
| 127.0.0.1 | www.pandasecurity.com |
| 127.0.0.1 | es.mcafee.com |
| 127.0.0.1 | downloads.malwarebytes.org |
| 127.0.0.1 | bbs.kafan.cn |
| 127.0.0.1 | bbs.kafan.com |
| 127.0.0.1 | bbs.kpfans.com |
| 127.0.0.1 | bbs.taisha.org |
| 127.0.0.1 | www.manuelruvalcaba.com |
| 127.0.0.1 | support.f-secure.com |
| 127.0.0.1 | bbs.winzheng.com |
| 127.0.0.1 | alerta-antivirus.inteco.es |
| 127.0.0.1 | foros.zonavirus.com |
| 127.0.0.1 | alerta-antivirus.red.es |
| 127.0.0.1 | www.zonavirus.com |
| 127.0.0.1 | www.malwarebytes.org |
| 127.0.0.1 | www.ewido.net |
| 127.0.0.1 | www.infospyware.com |
| 127.0.0.1 | www.bitdefender.es |
| 127.0.0.1 | housecall.trendmicro.com |
| 127.0.0.1 | www.emsisoft.de |
| 127.0.0.1 | www.securitynewsportal.com |
Rootkit activity
No anomalies have been detected.
Propagation
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Delete the original Worm file.
- Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
127.0.0.1 localhost - Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
