BKDR_LITHIUM.B
ERROR (Microsoft); W32/Vifiter.worm (McAfee); W32.HLLW.Vifiter (Symantec); P2P-Worm.Win32.Vifiter (Kaspersky); BehavesLike.Win32.Malware.tsc (mx-v) (Sunbelt); Worm/Vifiter (AVG)
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Backdoor
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It deletes itself after execution.
TECHNICAL DETAILS
Arrival Details
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This backdoor drops the following copies of itself into the affected system:
- %System%\dtveazkj\webcam chat.exe
- %System%\dtveazkj\aria dildo hump screensaver.exe
- %System%\dtveazkj\webcam chatter.exe
- %System%\dtveazkj\webcam.exe
- %System%\dtveazkj\webcam talk.exe
- %System%\dtveazkj\webcam software.exe
- %System%\dtveazkj\SOF FULL.exe
- %System%\dtveazkj\Soldier Of Fortune 2 FULL.exe
- %System%\dtveazkj\UT2K3 FULL.exe
- %System%\dtveazkj\Unreal Tournament 2003 KEYGEN.exe
- %System%\dtveazkj\Unreal Tournament 2003 FULL with serial.exe
- %System%\dtveazkj\Hitman 2 FULL with CDKey.exe
- %System%\dtveazkj\Test Drive 5.exe
- %System%\dtveazkj
- %System%\dtveazkj\Sim unleashed FULL Cracked.exe
- %System%\dtveazkj\GTA3 Vice City FULL.exe
- %System%\dtveazkj\War Craft 3.exe
- %System%\dtveazkj\Counter Strike - Condition Zero FULL.exe
- %System%\dtveazkj\Star Wars Pod Racer FULL.exe
- %System%\dtveazkj\Age Of Empires 2 FULL.exe
- %System%\dtveazkj\tomb raider full.exe
- %System%\dtveazkj\tomb raider 3 full.exe
- %System%\dtveazkj\Dungeon Seige FULL.exe
- %System%\dtveazkj\Dungeon Seige 2 FULL.exe
- %System%\dtveazkj\strip poker sex porn slut.exe
- %System%\dtveazkj\mcafee antivirus.exe
- %System%\dtveazkj\b0b0rz.exe
- %System%\dtveazkj\duload.exe
- %System%\dtveazkj\borland delphi 6 enterprise.exe
- %System%\dtveazkj\paltalk crack.exe
- %System%\dtveazkj\paltalk.exe
- %System%\dtveazkj\visual basics .NET.exe
- %System%\dtveazkj\visual basics 6.exe
- %System%\dtveazkj\visual c++.exe
- %System%\dtveazkj\c++ compiler.exe
- %System%\dtveazkj\anal whore getting it from 2 guys in the ass.gif.exe
- %System%\dtveazkj\blond slut gets in every hole.gif.exe
- %System%\dtveazkj\porno slideshow.gif.exe
- %System%\dtveazkj\Star wars episode 2.mpg.exe
- %System%\dtveazkj\Britney spears naked.gif.exe
- %System%\dtveazkj\Windows XP Pro with cd key.exe
- %System%\dtveazkj\Windows xp cd key keygen.exe
- %System%\dtveazkj\borland software keygen.exe
- %System%\dtveazkj\microsoft apps keygen.exe
- %System%\dtveazkj\kiddie porn 9 year old.gif.exe
- %System%\dtveazkj\kiddie porn 14 year old.gif.exe
- %System%\dtveazkj\Adobe photoshop 7.exe
- %System%\dtveazkj\Adobe Photoshop 6.exe
- %System%\dtveazkj\Macromedia Flash 6 MX.exe
- %System%\dtveazkj\The Matrix Reloaded MOVIE.exe
- %System%\dtveazkj\counter strike.exe
- %System%\dtveazkj\half life with cd key.exe
- %System%\dtveazkj\counter strike cd key.exe
- %System%\dtveazkj\command and conquer renegade keygen.exe
- %System%\dtveazkj\password cracker.exe
- %System%\dtveazkj\hotmail password stealer.exe
- %System%\dtveazkj\aol password stealer.exe
- %System%\dtveazkj\CloneCD.exe
- %System%\dtveazkj\CloneCD Keygen.exe
- %System%\dtveazkj\Conceal PC Firewall.exe
- %System%\dtveazkj\Credit Card Generator.exe
- %System%\dtveazkj\Adult Password Generator.exe
- %System%\dtveazkj\DSL Uncapper.exe
- %System%\dtveazkj\hacking tools 2002.exe
- %System%\dtveazkj\Ghost Recon.exe
- %System%\dtveazkj\ICQ hack.exe
- %System%\dtveazkj\lesbians fucking.mpeg.exe
- %System%\dtveazkj\Macromedia Flash MX.exe
- %System%\dtveazkj\Macromedia Flash 5.exe
- %System%\dtveazkj\Kazaa advertisement remover.exe
- %System%\dtveazkj\Kazaa ad remover.exe
- %System%\dtveazkj\Max Payne Full iso.exe
- %System%\dtveazkj\Max Payne.exe
- %System%\dtveazkj\Microsoft Visual C++ 7.0 iso.exe
- %System%\dtveazkj\norton antivirus 2002.exe
- %System%\dtveazkj\Nero cd burning 5.5 full.exe
- %System%\dtveazkj\Microsoft Office XP Professional full.exe
- %System%\dtveazkj\X Box Xbox emulator.exe
- %System%\dtveazkj\Quake 4 beta.exe
- %System%\dtveazkj\Norton firewall 2002.exe
(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)
It creates the following folders:
- %System%\dtveazkj
(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)
Dropping Routine
This backdoor drops the following files:
- %System Root%\ornyri.exe
- %System Root%\advapi32.bat
(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)
Other Details
This backdoor deletes itself after execution.
This report is generated via an automated analysis system.
SOLUTION
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Search and delete these components
- %System Root%\ornyri.exe
- %System Root%\advapi32.bat
Step 3
Search and delete this folder
- %System%\dtveazkj
Step 4
Scan your computer with your Trend Micro product to delete files detected as BKDR_LITHIUM.B. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.