Home Malware Programs Worms P2P-Worm.Win32.Palevo.boic

P2P-Worm.Win32.Palevo.boic

Posted: July 4, 2011

P2P-Worm.Win32.Palevo.boic is a dropper Trojan and worm that slashes at your web browser's security, installs other files without permission and may use network resources or removable disk drives to infect other computers. Because P2P-Worm.Win32.Palevo.boic hidesP2P-Worm.Win32.Palevo.boic's activities by using Windows component names, you may not be able to detect a P2P-Worm.Win32.Palevo.boic infection without help from an anti-virus application. P2P-Worm.Win32.Palevo.boic has major characteristics of being a serious threat to your computer's security, and as such, you should remove P2P-Worm.Win32.Palevo.boic with appropriate security software once you've notice a P2P-Worm.Win32.Palevo.boic infection on your PC.

Observing How P2P-Worm.Win32.Palevo.boic Takes Advantage of Your Registry

P2P-Worm.Win32.Palevo.boic is designed to attack Windows computers by exploiting the Windows Registry in several ways. Some common behavior that's been seen in a P2P-Worm.Win32.Palevo.boic attack includes:

  • Adding a startup entry to the Registry. This lets P2P-Worm.Win32.Palevo.boic start whenever Windows starts. The guilty entry may be difficult to detect since P2P-Worm.Win32.Palevo.boic can use randomized file names such as 'jvxqnu.exe.'
  • Modifying Internet Explorer settings in various harmful ways. Most noticeably, P2P-Worm.Win32.Palevo.boic may add an entry setting that disables Protected Mode and delete certain values that allow IE's security zones to function.

These subtle attacks may show no real symptoms, and even P2P-Worm.Win32.Palevo.boic itself may hide under a Windows component name so that you don't suspect P2P-Worm.Win32.Palevo.boic's existence. In particular, P2P-Worm.Win32.Palevo.boic has shown a preference to create multiple forms of 'svchost.exe' processes. In ordinary circumstances, multiple svchost.exe processes will be active constantly, so P2P-Worm.Win32.Palevo.boic can easily avoid being seen unless you resort to PC threat detection software.

P2P-Worm.Win32.Palevo.boic – A Worm and Much More

Worms like P2P-Worm.Win32.Palevo.boic can create multiple clones of their files and spread these copies throughout your PC to avoid being deleted. In many cases, P2P-Worm.Win32.Palevo.boic and similar worms will infect removable drives (such as USB storage devices) or network-shared folders; a second computer only needs to access this location to become infected itself.

Rather than being happy with just duplicating itself and destroying your browser's security, P2P-Worm.Win32.Palevo.boic can also make contact with remote third parties to download harmful files or upload your personal information. P2P-Worm.Win32.Palevo.boic infections show all the traits of a potential remote attack enabler and may attempt to:

  • Steal passwords and other information that can be sent to criminals.
  • Allow criminals to control your PC for DDoS attacks and other harmful actions. This behavior does not necessarily show any obvious symptoms aside from unusual usage of system resources.
  • Install other malicious programs onto your PC, including ransomware, viruses, rogue security programs and many other PC threats.

P2P-Worm.Win32.Palevo.boic attackers have been reported as recently as July of 2011 and should be considered a proliferating and vibrant PC threat. You can remove P2P-Worm.Win32.Palevo.boic from your computer with the help of an anti-virus application, preferably one that's used in Safe Mode and has had full updates.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Programs%\Startup\igfxtray.exe
    2 %System%\ieunitdrf.inf
    3 %Temp%\6.tmp

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]HKEY..\..\..\..{RegistryKeys}1609 =randomTabProcGrowth = "0"
Loading...