My Bitdefender
  • 0 Shopping Cart

SHARE
THIS ON

Facebook Twitter Google Plus

Win32.P2P.Poit.A

VERY LOW
VERY LOW
61952 bytes
(N/A)

Symptoms

Files:
  • %WINDIR%\System32\Inf\poet.exe
  • %WINDIR%\System32\poet.log containing the following text:
    Programming is a poetry for our time
  • Many zip and exe files in %WINDIR%\System32\Inf

Registry key:
HKLM\Software\Microsoft\Windows\CurrentVersion
with the value:
"poet" = >%WINDIR%\System32\Inf\poet.exe

Removal instructions:

Let BitDefender delete files found infected by this worm.
Also after disinfection, delete the %WINDIR%\System32\Inf directory and all the files within.

Be careful NOT to delete the %WINDIR%\Inf directory.

Analyzed By

Mihai Neagu BitDefender Virus Researcher

Technical Description:

When ran, the worm creates the following files:

  • %WINDIR%\System32\Inf\poet.exe
  • %WINDIR%\System32\poet.log containing the following text:
    Programming is a poetry for our time
  • Many zip and exe files in %WINDIR%\System32\Inf

and the registry key:

HKLM\Software\Microsoft\Windows\CurrentVersion
with the value:
"poet" = >%WINDIR%\System32\Inf\poet.exe

Also it copies itself in Kazaa, eMule, eDonkey, lphant or Overnet shared directories, or creates zips of different sizes that contain fake movies or cracks, the worm and a readme.txt file containing the created zip file name.

The file names it creates in P2P shared directories are constructed using the following words:

  • -. DIVX .-
  • www.CompressedXXXVideos.com
  • DIVX 5.1.1
  • --The Best Compressed videos DIVX 5--
  • --Video Collection--
  • -. Self-Extracting .-
  • HENTAI
  • Anime
  • Norton
  • Shaved
  • -. MONICA .-
  • fucked
  • Girl
  • amateur
  • espa
  • olas
  • preteen
  • ANIME .- Hentai -.
  • cumshot
  • casting
  • 13 years
  • Sylvia Saint
  • Pamela Anderson
  • Merrit Cabal and Pamela Anderson
  • playboy
  • 3000 photos
  • video
  • hidden camera
  • couple
  • bed
  • naked
  • Sucks
  • fucking
  • fuck
  • sex
  • sybian
  • sister
  • porn
  • adult
  • incest
  • rape
  • bitch
  • slut
  • french
  • cute
  • young
  • teen
  • qwerty
  • pussy
  • lolita
  • britney spears
  • lesbian
  • upskirt
  • sexe
  • porno
  • photos
  • 019.-.Nikki.-.fuckingmachines.com.-(on-sex-machines-sybian-lesbian-dildo-penetration-vibrator)-.shadow
  • Young.Blonde.Lesbians...#129..-..Candy.Films..HOT!.CD.Girls.Als.Porn.Lesbian.xxx.breasts.vibrator.sybian.dildo.piss.pissing.fisting
  • cdgirls_movie-.sybian-.aria.giovanni.HOT.orgasm
  • BEST.young.teen.underage.anal.rape.sex.hot.fucking.blond.porn.xxx.-.COMPLETE.10megs
  • Teen.Anal.Sex.Pornos.Videos.Pics.Pictures.Movies.Mpegs.Mpgs.Avis.Black.Asian.Gay.Lesbian.Hardcore.Girls.Teens.Nude.Fucki.mpg
  • hot.drunk.teen.topless.15yr.-.homemade.sister.nude.tits.sex.xxx.qwerty.ddoggprn.topless.rape.incest
  • Private-Xxx-Julia.Chanel.1Er.Casting.Hard-Video.DivX.Fr.Teen.Sex.Sexe.avi
  • teen.couple.on.bed.naked.having.sex.14.15.16.17.amateur.xxx.girl.boy.tits.ass.lolita.illegal.high.school.voyeur(1)
  • Teen.Girl.Gets.Fucked.With.Cock.In.Pussy.And.Sucks.French.Cumshot.(Blowjob).Ass.Anal.Lesbian.Dildo.Cunt.Porno.Dick.Xxx.A
  • Birthday.Parties.(Home.Movie
  • .Mpg
  • .Self-Extracting)....Incest.Xxx.Fuck.Porn.Sex.Fisting.Oral.Blow.Job.Pre-Teen.Asian
  • Young.Teen.Casting.Firts.Time.On.Cam.(Thehunter.10Min).(Teen.Girl.Preteen.Webcam.Sex.Child.Amateur.Voyeur.Boy.Thai.Asian.Nu
  • Katherine-young.13.year.old.pre-teen.lolita.bounces.on.a.much.older.mans.love.muscle(incest.rape.teen.hardcore.sex.xxx)
  • My.Friend\'s.Hot.Blonde.Wife.Nude.At.A.Party.-.Slutty.XXX.Teen.Slut.Sex.Porn.Fuck.Amateur.Tits.Ass.Pussy.Blowjob(5)
  • naughty.college.school.girls.6-best.porn.clip.ever.-.Divx.mpg.avi.Porno.teen.XXX.movie.sex.blonde.redhead.gangbang.cumshot.mpg
  • 17yr.boy.doggyfuck.16yr.sister.brother.lolita.child.preteen.1(1)(lolitas,.sex,.porn,.hentai,.manga,.rape,.anime,.tenchi,.britney.spears)
  • 18.Year.Old.Being.Taught.By.Daddy.--.Fisting.Incest.Child.Teen.Preteen.Lolita.Young.Gay.Porn
  • 18.Year.Old.Girlfriend.Playing.With.Her.Pussy.(Tits.Amateur.Sex.Teen.Lolita.Fuck.Orgasm)
  • 16yo.cute.shaved.lolita.spread.legs.-.7ee3.-..bald.pussy.teen.cunt..-.sex.ass.incest.preteen.kiddy.porn.bdsm.bitch.whore
  • BAMBINA-Collection_01-Real_Child_Porn!!!(illegal_preteen_underage_lolita_kiddy_incest_little_girl_rape_anal_cum_sex_lesb(1).mpg
  • spying.on.my.sister.-.young.teen,.hidden.camera,.exhibitionists,.amateur,.voyeur,.spycams,.movies,.lolita,.lolitas,.ince.mpg
  • young.topless.pulling.down.panties...........porn.teen.lolita.young.amatuer.fuck.playboy.pussy.tits.nude.voyeur.girl.sex
  • Incest.18Yr.Fucks.His.Mature.Mom.Mpg.Mpeg.Avi.Lolita.Porn.Teen
  • Lolita.College.Chick.Sucks.And.Fucks.Cucumber.In.Shaved.Hairless.Pussy.Xxx.Teen.Sex.Porno
  • Pussy.Anna.Oman.Virginia.Pussy.Fistfuck.Shaved.Young.Teen.Sex.Fuck.Fist.Anal.Lesbian.Hardcore.Dick.Porno.Lolita
  • teen.couple.on.bed.naked.having.sex.14.15.16.17.amateur.xxx.girl.boy.tits.ass.lolita.illegal.high.school.voyeur
  • 5.young.student.girls.fucked.by.2.gym.teachers.(Lolita.Teen.Preteen.Porn.Rape.Sex.Nude).QWER
  • LOLITA....Italian.teen.-.best.ever....(xxx.porn.sex)
  • Young.Cute.French.Slut.Bitch.Practically.Rape.Incest.Sex.Xxx.Porno.Preteenage.Lolita.Hardcore.Fuck.Anal.Blow.Job.Fuck.Ki
  • 3000.fotos.photos.porno.XXX.sexe_upskirt_lesbian_britney.spears_lolita_pussy_qwerty_teen_young
  • Full Downloader
  • LAST Official Patch
  • ALL Cracks
  • KeyGen
  • NOCD
  • Crack
  • I LiKe SuRFing on THe Web
  • Aprende a programar virus en 7 dias
  • More than 300 Game Cracks (astalavista.com Group)
  • How to crack Windows Xp and Office XP
  • Windows XP Password Recovery - Unlock Administrator
  • Mahjongg Deluxe
  • Pamela Anderson Multimedia Screen Saver
  • 3d Studio Max All Cracks
  • All Panda Editions Cracks
  • NetsKy && Sasser Patch WIN XP Anti Virus
  • All Codecs (XVID, DIVX, OGG, OGM, AC3) for WIN Media Player
  • All Codecs (XVID, DIVX, OGG, OGM, AC3)
  • XVID Codec For Windows Media Player
  • Windows XP Pro Serial Key Changer
  • Adobe Photoshop CS 8
  • All Windows (95, 98, Me, Nt, 2000, Xp)
  • Service Pack 1 & 2 WIN XP
  • Windows Xp Sp2 Service Pack
  • Windows Xp Sp1 Service Pack
  • WindowsXP-KB835732-x86-ESN
  • Patch Sasser FixTool
  • Gran Turismo 4
  • Gran Turismo 3
  • City of Heroes
  • Metal Gear Solid 3 - Snake Eater
  • EverQuest 2
  • EverQuest
  • The Sims (all expansions)
  • The Sims 2
  • Halo 2
  • Metal Gear Acid
  • Metal Gear Solid
  • Psi - Ops
  • Black Window
  • Empire Earth Art of Conquest
  • Empire Earth
  • Halflife 2
  • Halflife
  • Lord of the Rings - The Two Towers
  • Lord of the Rings - Return of the King
  • Lord of the Rings - Fellowship of The Ring
  • Dynomite
  • World of Warcraft (play online free)
  • Star Wars Galaxies (how to play free online)
  • Ragnarok Online
  • Warcraft Online
  • Dungeon keeper 2
  • Diablo
  • Diablo 2
  • Diablo 2 Lord Of Destruction
  • Unreal Tournament 2003
  • Unreal 2 - The Awakening
  • Unreal Tournament
  • Unreal 2
  • Quake 4
  • Quake 3
  • Battlefield Vietnam
  • Battlefield 1942 - Secret Weapons of WWII
  • Battlefield 1942 - Road To Rome
  • Battle Realms
  • Battle Realms - Winter of Wolf
  • Baldurs Gate
  • Baldurs Gate 2
  • Baldurs Gate 2 - Throne of bhaal
  • Counter Strike - Condition Zero
  • Counter Strike (serials for internet)
  • Command & Conquer - Renegade
  • Commandos
  • Commandos 2
  • Commandos 3 - Destination Berlin
  • Colin McRae Rally 3
  • Civilization 3 - Conquests
  • Civilization 3
  • ChampionShip Manager
  • Call of Duty PRIVATE SERVER
  • Principe de Persia - Sand of time
  • Pc Futbol
  • Pc Real Madrid
  • Phantasy Star Online
  • Alien Vs Predator 2
  • Alien Vs Predator
  • Age of Mythology - The Titans Expansion
  • Age of Mythology
  • Age of Empires - The Conquerors
  • Age of Empires - The age of Kings
  • Age of Empires - Rise of Rome
  • Age of Empires 2
  • Universal Combat
  • Battlecruiser Millennium Gold
  • PainKiller
  • Warcraft 3 - Reign Of Chaos
  • Warcraft 3 - Frozen Throne
  • Call of Duty
  • Splinter Cell Pandora Tomorrow
  • Splinter Cell
  • Starcraft BroodWar
  • BattleField 1942
  • Age of Empires

The worm also attempts to remove the registry keys created by the Netsky and Sasser worms.