Worm Morto

September 8, 2011 by NightWatcher
Filed under: Worm 
: Solved!

Fix it immediately:

The file CACHE.TXT is a computer worm.
The worm CACHE.TXT is a self-replicating malicious program,
which uses a computer network to send copies of itself to other computers.
You must fix the CACHE.TXT problem as soon as possible!
Delete the file CACHE.TXT from all infected computers in your network.
Set up your network firewall against CACHE.TXT intervention.

Malware Analysis of Worm Morto
Full path on a computer: %WinDir%\Offline Web Pages\cache.txt

After first reboot detected by UnHackMe:

Item Name: 6to4
Author: Unknown
Related File: %WinDir%\OFFLINE WEB PAGES\CACHE.TXT
Type: Svchost DLLs

Removal Results: Success
Number of reboot: 2

Worm Morto is known as:

BackDoor.Tsclient

Worm Morto hash:

  • MD5: 43f2cbfe48fdb3e0235e34d52ad323db
  • SHA1: bb47bd7b149e2f9377d5c991704c5d7e41bbc2a4
How to quickly detect Worm Morto presence? 

Registry:
  • HKLM\System\WPA\sn: “6to4″
Files:
  • %WinDir%\Offline Web Pages\1.40_TestDdos
  • %WinDir%\Offline Web Pages\2011-09-08 0737
  • %WinDir%\Offline Web Pages\cache.txt
  • %SysDir%\sens32.dll


Recommended: UnHackMe anti-rootkit and anti-malware

Premium software: RegRun Security Suite (Good choice for removal and protection)

Written by

Malware Hunter.

Tags: cache.txt, Morto, Worm

Comments

Tell me what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!

You must be logged in to post a comment.