Other names for this worm include: W32/Rontokbro.gen@MM, W32.Rontokbro@mm, BackDoor.Generic.1138, W32/Korbo-B, Worm/Brontok.a, Win32.Brontok.A@mm, Worm.Mytob.GH, W32/Brontok.C.worm, Win32/Brontok.E, and W32.Rontokbro.D@mm.
Origin
Brontok originated in Indonesia. The name refers to elang brontok, a bird species native to South & Southeast Asia. It arrives as an attachment of e-mail named kangen.exe. The virus/email itself contains a message in Indonesian. When translated, this reads: -- stop the collapse in this country—1. Try the Hoodlums, the Smugglers, the Bribers, the gamblers, & drugs Port -- 2.Stop Free Sex, Abortion, & Prostitution 3.Stop, forest burning, & wild hunting. 4.SAY NO TO DRUGS!!! - THE END IS NEAR - 5. Do you think you're smart? Inspired by: that is almost extinct By: HVM31 JowoBot #VM Communityunity -- It also contains a [JavaScriptpop-up. The worm also carried out a ping flood attack on two websites: Israel.gov.il and playboy.com. This virus may be an example of Hacktivism. Brontok inspired the creation of a more persistent trojan / worm such as Daprosy Worm which attacked internet cafes on July 2009.
Symptoms
When Brontok is first run, it copies itself to the user's application data directory. It then sets itself to start up with Windows, by creating a registry entry in the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key. It disables the Windows Registry Editor and modifies Windows Explorer settings. It removes the option of "Folder Options" in the Tools menu so that the hidden files, where it is concealed, are not easily accessible to the user. It also turns off Windows firewall. In some variants, when a window is found containing certain strings in the window title, the computer reboots. User frustration also occurs when an address typed into Windows Explorer is blanked out before completion. Using its own mailing engine, it sends itself to email addresses it finds on the computer, even faking the own user's email address as the sender. The computer also restarts when trying to open the Windows Command Prompt and prevents the user from downloading files. It also pop ups the default Web browser and loads a web page which is located in the "My Pictures" folder. It creates.exe files in folders usually named as the folder itself this also includes all mapped network drives.
Removal
Brontok can be removed by the latest updated antivirus software although there are various standalone tools available by antivirus providers.
