W32/Bakain Worm

 Information about the W32/Bakain Worm:

W32/Bakain is a worm. The worm will infect Windows systems and spreads by copying itself to network shares protected by weak passwords.

The worm arrives from the network.

Upon execution, it creates;

Folder.htt and Desktop.ini in the Windows\Web folder,
PCGuard.exe in the Windows\PCHEALTH folder,
lExplorer.exe and SERVICE5.exe in the Windows folder,
Script.exe in the Windows System folder,
Desktop.ini and SysFix.htt in the User Profile,
Desktop.ini, SysFix.htt and About Linda.exe in the Network Share and
Welcome.exe in the User Profile\All Users\Start Menu\Programs\Startup folder.

The worm modifies registry at the following locations;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Command Processor
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SystemFileProtection

The worm connects to the following Web site:

http://notebook.GustoNetwork.com/inde[Removed]

This worm first appeared on December 20, 2006.

 Other names of W32/Bakain Worm:

This Worm is also known as W32.Bakain.