Home Malware Programs Worms Worm.Win32.VBNA.a

Worm.Win32.VBNA.a

Posted: February 17, 2011

Worm.Win32.VBNA.a is a worm that takes advantage of networked-shared resources to infect new PCs. Some versions of Worm.Win32.VBNA.a may also be Trojans that can download other malware onto the PC, such as viruses or keyloggers. Because Worm.Win32.VBNA.a runs as a hidden background process, Worm.Win32.VBNA.a's activity may go overlooked until specifically scanned for using dedicated anti-malware routines. You should remove Worm.Win32.VBNA.a from your computer if you catch Worm.Win32.VBNA.a, since it has the capacity to create heavy security weaknesses and can spread to other systems very easily.

Worm.Win32.VBNA.a is Fast to Spread and Fast to Hide

Worm.Win32.VBNA.a infections can be caught by downloading files from peer to peer networks or even just visiting websites that use dangerous malware-injecting code. Most users, however, will catch Worm.Win32.VBNA.a as part of a network-based infection. Worms like Worm.Win32.VBNA.a will copy their bodies as Hidden attribute files to any folders shared on a network, and then use Autorun exploits to infect any computer that accesses the shared folder.

You can detect these files by changing your file-viewing preferences, but deleting any one copy of Worm.Win32.VBNA.a is useless unless you delete Worm.Win32.VBNA.a entirely! Worm.Win32.VBNA.a will simply copy itself anew if any files are missed.

Worm.Win32.VBNA.a may also be able to copy itself to removable drive devices. This allows Worm.Win32.VBNA.a to infect any computer that uses the same device through similar tricks to those mentioned above. Between these two functions, Worm.Win32.VBNA.a can spread to many different PCs very rapidly if security isn't strict.

Unless you go looking for these invisible files, you will not see Worm.Win32.VBNA.a working. Worm.Win32.VBNA.a adds extra entries to the Windows Registry to let Worm.Win32.VBNA.a run whenever Windows starts, but the worm will run as an unseen background memory process. If your access to Task Manager hasn't been cut off, you may be able to see this process running in the Task Manager's Processes tab. However, in many cases the worm's process will be named after a native Windows process to avoid being noticed.

What Worm.Win32.VBNA.a Puts Your Computer Through

The worm Worm.Win32.VBNA.a may attack infected computers in the following ways:

  • Some versions of Worm.Win32.VBNA.a may create backdoors in your security. This can be accomplished by making unauthorized firewall exceptions or even by completely shutting down the firewall. This creates vulnerabilities that other attackers can easily exploit.
  • Worm.Win32.VBNA.a may also use Trojan functions to download malicious programs without your permission. This can include other Trojans and worms, spyware that steal personal information or rogue security applications that look like real security products.
  • In some cases, Worm.Win32.VBNA.a may be the initial aggression that leads to a remote attack. Remote attacks by hackers are used for all of the above behavior, and can additionally be responsible for taking over your computer and forcing it to do things like participate in illegal Denial-of-service-attacks.

Deleting Worm.Win32.VBNA.a or other worms is preferably accomplished by using anti-malware applications that can find every copy of the infection with little chance of mistakes. Worm.Win32.VBNA.a may try to hide copies of itself in your system folder, temporary files folder or other locations that are troublesome to tamper with.

Deleting Worm.Win32.VBNA.a should also encompass ridding yourself of the worm's Registry changes. Most good anti-malware products will do this automatically when removing the Worm.Win32.VBNA.a.

Worm.Win32.VBNA.a infections have been noted primarily in 2010 and 2011. If your anti-virus scanners have threat databases that are older than that, you need to update them at once to have a good chance of deleting Worm.Win32.VBNA.a.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Windir%\CGZipLibrary.dll
    2 %Windir%\libmySQL.dll
    3 %Windir%\Unzip32.dll

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}\InprocServer32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}\ProgIDHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}\VERSIONHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293364BA-43F8-11D3-BC2D-4000000A2806}\VERSION

Related Posts

Loading...