W32/Brontok.BB is a mass mailing worm. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be any one of the following;

Fotoku yg Paling Cantik
My Best Photo

The body of the infected mail will be any one of the following;

Hi,
Aku lg iseng aja pengen kirim foto ke kamu
Jangan lupain aku ya !.

Thanks

Hi,
I want to share my photo with you.
Wishing you all the best.

Regards,

The name of the infected attachment will be Photo.zip

Upon execution of the infected attachment, the worm copies itself as;

dv(random number)\yesbron.com
jalak(random number).com
in the (User Account)\Local Settings\Application Data folder

_default(random numbers).pif
j(random numbers).exe
o(random number).exe
sa(random number)\ib(random number).exe
\Tasks\At1.job
\Tasks\At2.job
in the Windows folder

n(random numbers)\b(random numbers).exe
n(random numbers)\csrss.exe
n(random numbers)\lsass.exe
n(random numbers)\services.exe
n(random numbers)\smss.exe
n(random numbers)\sv(random numbers).exe
n(random numbers)\winlogon.exe
\n5817\c.bron.tok.txt
in the Windows System folder

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

To propagate itself, the worm collects all the available email addresses from the infected system and mails itself to these addresses using its own SMTP engine.

It also tries to terminate some of the security related processes.

This worm first appeared on July 04, 2006.

 Other names of W32/Brontok.BB Worm:

This Worm is also known as W32/Brontok-BB.