Home / malware

PDF

Banload.BBX

First posted on 13 September 2006.
Source: SecurityHome

Aliases :

Banload.BBX is also known as Trojan-Downloader.Win32.Banload.bbx, W32/Banload.BBX.

Explanation :

Banload.BBX connects to the internet and downloads other members of the Banker and Banload family.

Banload.BBX downloads other members of the Banker and Banload family from the internet.

It arrives on the system with the filename HUMORTADELA.exe.

Upon execution, it connects to the following sites:

http://www.guitarparts.com/zero/[REMOVED].exe
http://www.guitarparts.com/zero/[REMOVED].exe


And saves these files to the following hard-coded paths in the user's system:

c:windowssystem32svhootss.exe
c:windowssystem32Msn.exe


The said files are knwon as Trojan-Spy.Win32.Bancos.uy and Trojan-Downloader.Win32.Banload.bby respectively.

As a stealth mechanism, it displays the following fake error message to fool the users into believeing that the malware did not run on their system.

Solution :

To manually disinfect standalone malware (backdoors, worms, trojans, etc.) it's usually enough to delete all infected files from a computer and to restart it. Active malware files are usually locked by operating system so different disinfection approaches are required for different operating systems.
Please note that manual disinfection is a risky process, so it is recommended only for advanced users.

If Windows 95, 98 and ME operating system is used, it is recommended to restart a computer from a bootable system diskette and to delete an infected file from command prompt. For example if a malicious file named ABC.EXE is located in Windows folder, it is usually enough to type the following command at command prompt:

DEL C:\WINDOWS\ABC.EXE

and to press Enter. After that an infected file will be gone. If Windows NT, 2000 or XP is used, a malicious file has to be renamed with a different extension (for example .VIR) and then a system has to be restarted. After restart a renamed malicious file will no longer be active and it can be easily deleted manually.

Windows System Restore Issues

If Windows ME or XP is used, it is recommended to disable System Restore feature of these operating systems to prevent a computer from re-infection by an already removed malware. The fact is that System Restore feature of these operating systems might save an infected file into the special folder and copy it back to a hard drive it every time it's been renamed or deleted.
It is recommended to re-enable System Restore after disinfection in order to restore stable system configuration in the future, if any crash or incompatibility issue occurs.

Last update 13 September 2006

 

TOP