Anilrgowda

Virus Profile: Downloader-BAI.sys

Risk Assessment - Home Users: Low - Corporate Users: Low Date Discovered: 1/19/2007 Date Added: 1/19/2007 Origin: N/A Length: approximately 46 kb Type: Trojan SubType: Downloader DAT Required: 4943 Virus Characteristics

This detection is part of Downloader-BAI. Please refer to that vil description for more details. System Changes
Registry
The following registry keys are created:

• hkey_local_machine\system\currentcontrolset\servic es\wincom32
  \imagepath="\??\%SYSTEMDIR%\wincom32.sys"
• hkey_local_machine\system\currentcontrolset\servic es\wincom32
  \security\security="(binary registry data)
• hkey_local_machine\system\currentcontrolset\servic es\wincom32
  \errorcontrol="1"
• hkey_local_machine\system\currentcontrolset\servic es\wincom32
  \type="1"
• hkey_local_machine\system\currentcontrolset\servic es\wincom32
  \start="2"
• hkey_local_machine\system\currentcontrolset\servic es\wincom32
  \displayname="wincom32"
• hkey_local_machine\system\currentcontrolset\servic es\wincom32
• hkey_local_machine\system\currentcontrolset\servic es\wincom32
  \security

The .sys file is a device driver which performs network communication which prevents outgoing network traffic from being detected.

Indications of Infection

This detection is part of Downloader-BAI. Please refer to that vil description for more details.
This downloader drops W32/Nuwar@MM. It also downloads W32/Nuwar@MM., Downloader-ZQ, Uploader-AF, Spam-Mailbot,

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.

Removal Instructions

All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations