BF4P.EXE - Dangerous

What you should do about BF4P.EXE:

You should urgently check your PC and remove any malicious software including BF4P.EXE as soon as possible.

The free version of Prevx CSI will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't take the risk, check your PC now.

Download Prevx CSI Now

What we know about BF4P.EXE:

BF4P.EXE

AUTOMATED MALWARE PROFILE, ANALYSIS, REMOVAL AND SIGNATURE INFORMATION:

DEFINITION OF: BF4P.EXE

Safety Rating: Known Malware, do not run
Malware Family: Part of Malware group - Worm Ircbot Gen
Determination: Automatically determined using Prevx centralized heuristics
Malware Form: BOT
Protection: Prevx provides powerful security products that you can use to detect, remove and protect you from BF4P.EXE and safeguard your PC against viruses, trojans, worms, spyware, rootkits and adware
Why risk having spyware on your PC when it takes less than 2 minutes to thoroughly check it with Prevx CSI? Click here to check your PC with Prevx CSI Now.
First seen: Apr 8 2006 (GMT)
Last seen: Apr 8 2006 (GMT)
File Size: 15,360 bytes

MALWARE ASSESSMENT: PREVX 4 AXES OF EVIL METHODOLOGY

1. COVERT ANALYSIS OF: BF4P.EXE

File Names Used: 44
Paths Used: 21
Common File Name: BF4P.EXE
Common Path: %WINDIR%\SYSTEM32\
Vendor Information: No Vendor details specified
BF4P.EXE may use 44 or more path and file names, these are the most common:
1 :%CACHE%\CONTENT.IE5\????????\SHOOT[12].TAR
2 :%CACHE%\CONTENT.IE5\????????\SHOOT[13].TAR
3 :%CACHE%\CONTENT.IE5\????????\SHOOT[14].TAR
4 :%CACHE%\CONTENT.IE5\????????\SHOOT[15].TAR
5 :%CACHE%\CONTENT.IE5\????????\SHOOT[2].TAR
6 :%CACHE%\CONTENT.IE5\????????\SHOOT[3].TAR
7 :%CACHE%\CONTENT.IE5\????????\SHOOT[4].TAR
8 :%CACHE%\CONTENT.IE5\????????\SHOOT[5].TAR
9 :%CACHE%\CONTENT.IE5\????????\SHOOT[6].TAR
10:%CACHE%\CONTENT.IE5\????????\SHOOT[7].TAR
11:%CACHE%\CONTENT.IE5\????????\SHOOT[8].TAR
12:%CACHE%\CONTENT.IE5\????????\SHOOT[9].TAR
13:?:\01345.EXE
14:?:\23452.EXE
15:?:\34623.EXE
File Name Structure: Common
File and Path Structure: Suspicious, unusually high number of file and path combinations

2. RELATIONSHIP ANALYSIS OF: BF4P.EXE

Malicious Objects Created: 1 objects
Malicious Creators: 6
Malware Run Keys: Creates registry run keys for known malware objects
Self Persists: Yes, creates copies of itself
Antivirus Detection: No third party antivirus detection observed
Anti-Spyware Detection: No third party anti-spyware detection observed

3. ACTIVITY ANALYSIS OF: BF4P.EXE

The following behaviors have been observed for this object:
Installs programs.
Deletes programs.
Invokes dll components.
Creates Run Keys.
Runs other programs.
Has mass mail capabilities.
Communicates with other computers across the web.
Has outbound communications.
Creates registry entries.
Creates run keys for known malware.
Creates known malware.
Creates copies of itself.
Packed Executable.

4. PROPAGATION ANALYSIS OF: BF4P.EXE

Malware Group Propagation Rate: Moderate (spreading)
Malware Group: Worm Ircbot Gen