WORM_VB.BDN

This worm usually arrives on a system as a dropped file of other malware, or as a file downloaded from the Internet by an unsuspecting user when visiting malicious Web sites.

Upon execution, it drops copies of itself as CTFMON.EXE in the created folder RECYCLED, which is located in the root folder. It also creates its own AUTORUN.INF file in the created folder. The said file contains certain codes that execute this worm.

It uses the icon of the Recycle Bin folder to disguise the folder it creates. This technique is a stealth mechanism done to trick users into thinking that the said folder is the legitimate Recycle Bin.

It propagates by dropping a copy of itself in removable drives along with the non-malicious file AUTORUN.INF.

Related Items