Effects 

Brontok.KN carries out the following actions:

• It infects the files with an EXE extension it finds in the affected computer. The infected files have the icon of a folder and the name of an existing folder.
• It adds a copy of itself to the files with a ZIP extension of the affected computer. This way, if the user descompresses a ZIP file and runs the malicious file, the computer will get infected.
• It deletes the files belonging to several antivirus programs, leaving the computer vulnerable against possible malware.
• It ends the processes whose window title contains any of the following text strings:
  CMD.EXE
  COMMAND PROMPT
  CONFIRM FILE DELETE
  CONFIRM MULTIPLE FILE DELETE
  DISPLAY PROPERTIES
  EASYRECOVERY
  EXESCOPE
  HEX WORKSHOP
  HIJACKTHIS
  IDA
  INTERNET OPTIONS
  KILLBOX
  NORMAN
  NVC
  PC MEDIA
  PEID
  POCKET KILLBOX
  POWERQUEST
  PROCESS
  REGISTRY EDITOR
  RESOURCE HACKER
  SETUP
  SHOW/KILL RUNNING PROCESS
  SUPERDAT
  SYSTEM MECHANIC
  SYSTEM RESTORE
  SYSTUNER
  TASK MANAGER
  taskkill.exe /f /im explorer.exe
  taskkill.exe /f /im explorer.exe
  TUNEUP
  URSOFT W32DASM
  WINDOWS TASK MANAGER
  XREFS
  ZONEALARM
  These processes are related to security programs and applications like the Task manager or the command shell, among others.

Infection strategy 

Brontok.KN creates the file ASSHOLEFUCKING.EXE and other 5 random files in the following directories:

• in a folder created by itself in any Windows subdirectory. It also creates the files: BITCHKICKASS.OCX and FUCKINGBITCH.OCX.
• in the root directory of the C: drive.
• in the Windows directory.

An example of the random files it creates are the following:

- GUHEL.EXE

- BUHAX.EXE

- YIXUC.EXE

- YITUB.EXE

- XESID.EXE

Additionally, it creates the file .EXE in the root directory of the C: drive.

Brontok.KN modifies the file HOSTS leaving it empty.

On the other hand, Brontok.KN infects the files with an EXE extension it finds in the computer, using the technique called prepending which consists in entering its code at the beginning of the file it infects. By doing this, it ensures that the virus is run every time the infected file is executed, but without interfering the functioning of the file.

Additionally, before infecting the files, it creates a copy of the original files in the Windows temporary directory with the same name as the original files and with a NITRO.A extension.

Brontok.KN creates the following entries in the Windows Registry:

• HKEY_LOCAL_MACHINE\SOFTWARE\Nitro.A
  BitchHoletoFuck = guhel.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Nitro.A
  ChatApplication = buhax.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Nitro.A
  FuckMeBitch = yixuc.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Nitro.A
  MainApplication = yitub.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Nitro.A
  PolitikusBusuk = xesid.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Nitro.A
  PlaceOfApplication = C:\WINDOWS

Means of transmission 

Brontok.KN infects files with an EXE extension. They reach computers when previously infected files are distributed, entering computers through any of the usual channels: floppy disks, email messages with attachments, Internet download, files transferred via FTP, IRC channels, P2P file sharing networks, etc.

Further Details  

Brontok.KN is 143,365 bytes in size.