Virus

W32/Banwarum.L@mm

Analysis

  • It drops a file with a random file name in the same folder it was executed.
  • It uses the following mutex:
    • klllekkdkkd
    • ShimCacheMutex
  • It tries to terminate the following antivirus application:
    • mcafee
    • taskmgr
    • hijack
    • f-pro
    • lockdown
    • msconfig
    • firewall
    • blackice
    • vsmon
    • zonea
    • spybot
    • nod32
  • It uses one of the following as subject to the mail it sends
    • I Love You with All I Am
    • The Time for Love
    • When You Fall in Love
    • Your Love Has Opened
    • My Love
    • Our Love is Free
    • Eternity of Your Love
    • I Love You Soo Much
    • Wrapped in Your Arms
    • Our Love Nest
    • Hugging My Pillow
    • The Dance of Love
    • Falling In Love with You
    • Why I Love You
    • A Kiss So Gentle
    • Miracle of Love
    • A Token of My Love
    • For You....My Love
    • Our Love Will Last
    • Inside My Heart
    • The Miracle of Love
    • Our Love is Strong
    • Love Remains
    • I am Complete
    • I Dream of you
    • Dream Girl
    • I Believe
    • Unmatchable Beauty
    • Baby, I'll Be There
    • Rose for my Love
    • I Love You So
    • I Love Thee
    • I'll Be Your Man
    • Will You?
    • Want You to Know
    • Internet Love
    • Only You
    • Passionate Kiss
    • Kiss Coupon
    • Breakfast in Bed Coupon
    • Romantic Picnic Coupon
    • Dinner Coupon
    • Massage Coupon
    • A Relaxing Coupon
    • Steamy Sex Coupon
    • Bubble Bath Coupon
    • Dream Date Coupon
    • A Day in Bed Coupon
    • Feeling Horny?
    • Kisses, Hugs & Roses
    • The Love Bugs
    • A Little (sex) Card
    • A Kiss for You
    • A Monkey Rose for You
    • I Woof You
    • We Are Different
    • You Are My Guiding Star
    • Puppy Love
    • You Rock Me!
    • Times Are Hard, I Luv U
    • Crazy way to say I Luv U
    • You Were Worth the Wait
    • Showers Of Love
    • Can't Wait to See You!
    • You're My Hero
    • You Brighten My Day
    • Love at First Sight
    • The Mood for Love
    • I Love You Mower
    • A Romantic Place
    • We're a Perfect Fit
    • Love is in the Air
    • Emptiness Inside Me
    • Our Love Everyday
    • I Can't Function
    • 5 Reasons I Love You
    • You Lucky Duck!
    • Peek-A-Boo
    • Last Night was Hot!
    • When I look at you
    • You are out of this world
    • Memories
    • Wild Nights--Wild Nights
    • I Think of You
    • A Bouquet of Love
    • I Would Give you Anything
    • Hold Me (distant love)
    • Between Us
    • In My Heart
    • From this day forward
    • You're Soo kissable
    • Angel of Love
    • Thinking about you
    • Love for Granted
    • How Much I Love You
    • A Hug & Roses
    • Summer Love
    • A Weekend Getaway
    • My Heart is Thinking
    • Moonlit Waterfall
    • Steamy Dream
    • My Heart belongs to you
    • Every Inch of Your Body
    • Our love is torn by miles
    • A Special Kiss
    • Won't you dance with me
    • A Red Hot Kiss
    • The Sweet Taste of Love
    • A Special Flower for You
    • Just You & Me
    • Till Morninig's Light
    • Your Silly Smile
    • Trunk Full Of Love
    • Till Morning's Light
    • The Letter
    • Bewitching Moonlight
    • I Am Lost In You
    • Fields Of Love
    • We Have Walked
    • P.M.S
    • So Unique
    • Take My Hand
    • Solitary Beauty
    • Cuddle Me Please
    • Let's Get Frisky
    • Teddy Bear & Roses
    • Wish I Could Tell You
    • Twilight Paradise
    • Thinking of You
    • Longing for You
    • Twice Blest
    • Forever and Ever
    • Dancing With You
    • I Still Love You
    • Soul Mates
    • Two of a Kind
    • He Blessed Our Lives
    • Pockets of Love
    • Live With Me
    • Now I Know
    • The Kiss
    • Vacation Love
    • I Would Do Anything
    • You + Me
    • Sending Kiss
    • Safe With You
    • Love Birds
    • It's Your Move
    • In Love
    • Love You Deeply
    • The Long Haul
    • I wish
    • Together Again
    • You're so Far Away
    • Brand New Love
    • For You
    • Wish Upon a Star
    • You Asked Me Why
    • Our Two Hearts
    • All That Matters
    • Hold On
    • You and I
    • Someone at Last
    • Made for Each Other
    • Safe and Sound
    • Cuddle Up
    • With All My Love
    • Heart is Breaking
    • Everyone Needs Someone
    • When I'm With You
    • All For You
    • For Better of For Worse
    • To New Spouse
    • Forever in Love
    • Full Heart
    • Unique Love
    • My Eye on You
    • Our Wedding Day
    • Hey Cutie
    • Against All Odds
    • Cyber Love
    • Old Together
    • Our Love
    • That Special Love
    • I Give to You
    • Back Together
    • Wine and Roses
    • I Win with You
    • Hand in Hand
    • If I Could
    • A Song to You
    • Search for One
    • A Sweet Love
    • Just You
    • Thanks...Love
    • Now and Forever
    • Without Your Love
    • This Day Forward
    • Waiting for You
    • My Perfect Love
    • True Love
    • The Candle's Light
    • Words I Write
    • You and I Forever
    • You're the One
    • Worthy of You
    • My Invitation
    • Until the Day
    • Red Rose
    • This Feeling
    • So in Love
    • Want to Meet?
    • Awaiting Your Love
    • I Always Knew
    • With All of My Heart
    • Soul Partners
    • Tender Whispers
    • With This Ring
    • Til the End of Time
    • Heart of Mine
    • If I Knew
    • Touched by Love
    • Most Beautiful Girl
    • Wrapped Up
    • Evening Romance
    • Doing It for You
    • Window of Beauty
    • Together You and I
    • Sending You My Love
    • Magic of Flowers
    • Flash Postcard.exe
    • flash postcard.exe
    • greeting postcard.exe
    • Greeting Postcard.exe
    • greeting card.exe
    • Greeting Card.exe
    • postcard.exe
    • Postcard.exe
  • It also sends mail to the following addresses:
    • vsales@jpsoft.com
    • dealers@jpsoft.com
    • support@jpsoft.com.
    • izpq@fc.h
    • stone@one.se
    • rom@innocent.com
    • rom@innocent.com
    • dev@ethereal.com
    • users@ethereal.com
    • dev@ethereal.com.
    • njw@sequent.com
    • gerald@ethereal.com
    • agentx@dorothy.bmc.com
    • ellison@world.std.com
    • lheintz@cisco.com
    • sgudur@hotmail.com
    • ramk@cisco.com
    • disman@dorothy.bmc.com
    • dlevi@nortelnetworks.com
    • schoenw@ibr.cs.tu
    • hubmib@hprnd.rose.hp.com
    • johnf@rose.hp.com
    • jeff@redbacknetworks.com
    • mibs@ops.ietf.org
    • abierman@cisco.com
    • rpresuhn@bmc.com
    • waldbusser@lucent.com
    • hostmib@andrew.cmu.edu.
    • waldbusser@ins.com
    • iana@iana.org
    • kzm@cisco.com
    • fred@cisco.com
    • dhaskin@baynetworks.com
    • sonishi@baynetworks.com
    • daniele@zk3.dec.com
    • freed@innosoft.com
    • coders@lists.
    • coders@lists.
    • coders@lists.
    • coders@lists.
    • coders@lists.
    • coders@lists.
    • snmpv3@lists.tislabs.com
    • mundy@tislabs.com
    • rfrye@cosinecom.com
    • sar@epilogue.com
    • bwijnen@lucent.com
    • snmpv3@tis.com
    • dbh@ctron.com
    • presuhn@bmc.com
    • case@snmp.com
    • wijnen@vnet.ibm.com
    • levi@snmp.com
    • meyer@securecomputing.com
    • bstewart@cisco.com
    • uri@watson.ibm.com
    • mrose@dbc.mtview.ca.us
    • dthaler@dthaler.microsoft.com

    Recommended Action

  • Check the main screen using the web interface to ensure the latest AV/NIDS database has been downloaded and installed. If required, enable the "Allow Push Update" option