Impove
boot up time

Run a free scan to diagnose your PC
Start Test!

Worm Morto

September 8, 2011 by NightWatcher
Filed under: Worm 
Install UnHackMe Install RegRun

The file CACHE.TXT is a computer worm.
The worm CACHE.TXT is a self-replicating malicious program,
which uses a computer network to send copies of itself to other computers.
You must fix the CACHE.TXT problem as soon as possible!
Delete the file CACHE.TXT from all infected computers in your network.
Set up your network firewall against CACHE.TXT intervention.

Malware Analysis of Worm Morto
Full path on a computer: %WinDir%\Offline Web Pages\cache.txt

After first reboot detected by UnHackMe:

Item Name: 6to4
Author: Unknown
Related File: %WinDir%\OFFLINE WEB PAGES\CACHE.TXT
Type: Svchost DLLs

Removal Results: Success
Number of reboot: 2

Worm Morto is known as:

BackDoor.Tsclient

Worm Morto hash:

  • MD5: 43f2cbfe48fdb3e0235e34d52ad323db
  • SHA1: bb47bd7b149e2f9377d5c991704c5d7e41bbc2a4
How to quickly detect Worm Morto presence? 

Registry:
  • HKLM\System\WPA\sn: “6to4″
Files:
  • %WinDir%\Offline Web Pages\1.40_TestDdos
  • %WinDir%\Offline Web Pages\2011-09-08 0737
  • %WinDir%\Offline Web Pages\cache.txt
  • %SysDir%\sens32.dll

Remove it now!

Comments

Tell me what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!