Win32.Gael.3666

( Backdoor.Win32.Small.gl, Virus.Win32.Tenga.a, BackDoor-CTM, W32/Gael.worm.a, W32/Tenga-A, PE_TENGA.A )

SYMPTOMS:

Slowdown of the network.

TECHNICAL DESCRIPTION:

Win32.Gael.3666 is blended threat which uses multiple methods for spreading:

• By infecting executable files

• By scanning for machines which have not been patched Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability

The worm tries to download and execute several files from the Internet. It also drops an executable which acts as a backdoor.

Removal instructions:

Please let BitDefender disinfect your files. If you decide to reinstall your machines please make sure you follow these steps:

• disconnect your machine from the network

• reinstall the operating system on it. during the install, do not connect the machine to the network

• install the latest service pack available for the given version of the operating system (this can be accomplished either by downloading the service pack on a different, clean computer and burning it on a CD. It is very important that the machine used to download the service pack is not infected, because otherwise the service )

• now you can reconnect the computer to the network and download any additional security updates available for the operating system, install antivirus and firewall software

• at no point should you execute files which have passed through a non-computer or connect to the network before applying the latest service pack.

ANALYZED BY:

Attila-Mihály Balázs,virus researcher