Once Virus:W32/Delf.BO has been executed, it will display a non-malicious file. Typically, office documents, text files, or log files.

The clean file is dropped into the following folder:

• %temp%PrgStart

Virus:W32/Delf.BO drops the following malicious file component in the Windows directory:

• reloc32.exe
• svhst32.exe

It also drops the following files in the Windows System Directory:

• updates.exe
• wandrv.exe

Moreover, it also drops the following file in the Startup folder:

• SQLNET.exe

Malicious drop files may use the following parameters to execute:

• -O
• -RS
• -A
• -V

To enable its automatic execution upon boot up it adds the following autostart registry entries:

• HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnce
  "Install part II" = "%sysdir%updates.exe -o"
• HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunServices
  "Memory relocation service" = "%windir%
  eloc32.exe -rs"
• HKLMSoftwareMicrosoftWindowsCurrentVersionRun
  "Microsoft Server Process" = "%windir%svhst32.exe -a"
  

Delf.BO modifies the default entry for the program used to open the clean file and executes itself upon opening the same file extension of the clean file.
Example for .TXT files:

• HCR xtfileshellopencommand
  
  Original data:
  %sysdir%NOTEPAD.EXE %1
  
  New data:
  %sysdir%
  otepd.exe "-v" "%1"
  

Along with adding or modifying registry entries for its autostart technique, it also adds the following entry in "%windir%win.ini"

• "%sysdir%wandrv.exe"

This is under the following criteria:

• Name = "windows"
• Key = "run"

It may connect to the following domain to download other files:

• ibrahi5834.0catch.com
• idalpi.freehostia.com
• iggywal.bravehost.com
• igor28.0catch.com/g[blocked].jpg

Note: As of this writing the domains above are unavailable.

It checks for Internet connection by querying the following site:

• www.google.de

It has a backdoor/proxy server functionality that may use the following commands:

• HEAD
• POST
• OPTIONS
• TRACE
• PUT
• CONNECT

Virus:W32/Delf.BO also connects to the following URL:

• 23.66.199.15

Last update 16 May 2007

 

TOP