Worm.Bondat

If your computer is processing things slower than the usual and you see random warning message on your screen, you have most probably been infected with Worm.Bondat. This program is a malicious infection that can replicate itself and spread on its own. Computer worms are usually designed to spread, but some infections from this group can install a backdoor in the affected computer so that the computer would turn into a so-called “zombie.” In other words, if you do not remove Worm.Bondat at once, sooner rather than later hackers might take control of your system, and they will make use of your network to send spam and organize distributed denial-of-service (DDoS) attacks.

It is possible to avoid getting infected with Worm.Bondat, if only you would be careful about plugging your external storage devices to unfamiliar computers. Our research shows that Worm.Bondat spreads through USB flash drives by creating a copy of itself in the affected device automatically. The thing is that once you plug the external storage device into an infected computer, Worm.Bondat detects the drive and automatically transfers itself into it. It also checks what kind of files you have stored on the device, and then creates additional files with .lnk extension, copying the file names of .mp3, .doc, .pdf, .avi, .jpg, and many other popular file extensions. If a user gets mixed up and clicks any .lnk file, it automatically redirects a randomly named file with a .js (javascript) extension that launches the Worm.Bondat infection.

In order to work properly, Worm.Bondat kills various files and processes, including many common system administration tools and some antivirus applications. It also collects information on your user name, computer name, language settings, and operating system configuration, so that it could send it to a remote server. This clearly shows that Worm.Bondat breaches your privacy, as it connects to the Internet behind your back and communicates with its command and control server. What is more, Worm.Bondat can easily download more malware onto your computer, thus totally crippling your system and exposing you to cyber-criminal schemes.

If you happen to see the following notification on your screen, then you can be sure that you have been infected with Worm.Bondat:

procexp.exe – Common Language Runtime Debugging Services

Application has generated an exception that could not be handled.
Process id=0xef3814 (15677460), Thread id=0xef98e1 (15702241).

Click OK to terminate the application.
Click CANCEL to debug the application.

This is a fake warning message that has nothing to do with the actual state of your computer. Please do not panic and get yourself a legitimate security application that would remove Worm.Bondat automatically at once. Manual removal is not recommended because worm infections are a lot more complicated than your random adware programs. Therefore, unless you have superb programming skills, you should leave the Worm.Bondat removal to professionals.