W32.Sillyban.A

20 October 2007 Worm 11 Comments

W32.Sillyban.A propagates by copying itself to unsecured mapped network drives. It may display warning messages if infected computer visited Orkut and YouTube pages. W32.Sillyban.A will create numerous malicious files and modify Windows registry to run itself when Windows is started. It also monitors Internet browser title if it belongs to Mozilla Firefox. The message it will display will contain this text:

“USE INTERNET EXPLORER YOU DOPE, I DONT HATE MOZILLA BUT USE IE OR ELSE…”

 If Orkut or YouTube pages were visited, the worm will display the following messages accordingly:

“Orkut is BANNED you fool, The administrators didn’t write this program guess who did?”
“YouTube is BANNED you fool, The administrators didn’t write this program guess who did?”

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

How to Remove W32.Sillyban.A:

FIRST AID TO STOP W32.Sillyban.A:
If this virus have infected the system, registry and legitimate Windows files are also compromised. System Restore can reinstate clean system files by restoring the configuration to an earlier date. If a restore point was created before you got infected with W32.Sillyban.A, please restore Windows to previous configuration.

MANUAL REMOVAL OF W32.Sillyban.A:
1. Update installed anti-virus application to have the latest definition file.
2. Reboot Windows in Safe Mode
- After turning on the power, press F8 on the keyboard.
- Select Safe Mode from the menu.

3. Thoroughly scan the system and clean/delete all infected file(s).
4. Delete/Modify any values added to the registry if present.
- Click on Start. Search or Run regedit.exe to begin registry editor.

Note: You may refer to links on sidebar for a complete tutorial on Safe Mode and Registry Editor.

5. Exit registry editor and restart Windows.

ADDITIONAL TOOLS AND PROGRAMS:

Scan with Norton Power Eraser:
A free removal tool from Norton Antivirus was developed to remove virus and unfamiliar threats without using the traditional AV signatures. Download the tool from this location and start scanning the computer for viruses.

Technical Details and Additional Information:

Other functionalities of this Trojan:
- This worm can close any active windows and plays an .MP3 audio.
- It will place an autorun.inf file on each drive so that it executes when the drive is accessed.
- W32.Sillyban.A also duplicate itself on any drive as text file named reproduce.txt.

Malicious Files Added by W32.Sillyban.A:
C:\heap41\2.mp3
C:\heap41\autorun.inf
C:\heap41\drivelist.txt
C:\heap41\reproduce.txt
C:\heap41\script1.txt
C:\heap41\std.txt
C:\heap41\svchost.exe
C:\heap41\offspring\autorun.inf
%Temp%\MicrosoftPowerPoint\2.mp3
%Temp%\MicrosoftPowerPoint\drivelist.txt
%Temp%\MicrosoftPowerPoint\Icon.ico
%Temp%\MicrosoftPowerPoint\Install.txt
%Temp%\MicrosoftPowerPoint\pathlist.txt
%Temp%\MicrosoftPowerPoint\svchost.exe
%UserProfile%\Start Menu\Programs\Startup\.lnk

File Location for Windows Versions:

• %Temp% for all versions of Windows can be found on C:\Windows\Temp

Associated Windows Registry Entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\policies\Explorer\Run\”status” = “present”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\policies\Explorer\Run\”winlogon” = “C:\heap41a\svchost.exe C:\heap41a\std.txt”