Nume:TR/Hamweq.A
Descoperit pe data de:15/10/2009
Tip:Troian
ITW:Da
Numar infectii raportate:Scazut
Potential de raspandire:Scazut
Potential de distrugere:Scazut
Fisier static:Da
Marime:65.536 Bytes
MD5:0a55c1a79534b88592487c92c54f5b69
Versiune IVDF:7.01.06.111 - Donnerstag, 15. Oktober 2009

 General Alias:
   •  Sophos: Mal/Delf-Z
   •  Panda: W32/IRCBot.CKA.worm
   •  Eset: Win32/IRCBot.ANC
   •  Bitdefender: Backdoor.Bot.91975


Sistem de operare:
   • Windows 2000
   • Windows XP
   • Windows 2003


Efecte secundare:
   • Creeaza fisiere malware
   • Modificari in registri




   Continuously creates a child process of itself and exits the parent process, within an interval of 1 sec, making difficult to locate and terminate from task manager.

 Fisiere Se copiaza in urmatoarea locatie:
   • %SYSDIR%\svhost.exe

 Registrii sistemului Urmatoarea cheie este adaugata in registri pentru a rula procesul la repornirea sistemului:

– [HKLM\SYSTEM\CurrentControlSet\Services\MSNETDED]
   • "Description"=" intrusion detection."
   • "DisplayName"="Network Monitor service"
   • "ErrorControl"=dword:0x00000000
   • "FailureActions"=hex:0A,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,B8,0B,00,00
   • "ImagePath"=""%SYSDIR%\svhost.exe""
   • "ObjectName"="LocalSystem"
   • "Start"=dword:0x00000002
   • "Type"=dword:0x00000110



Urmatoarele chei sunt adaugate in registrii sistemului:

– [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSNETDED]
   • "@"="Service"

– [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSNETDED]
   • "@"="Service"

 Detaliile fisierului Limbaj de programare:
 Limbaj de programare folosit: Delphi.

Die Beschreibung wurde erstellt von Petre Galan am Montag, 23. November 2009
Die Beschreibung wurde geändert von Petre Galan am Montag, 23. November 2009

zurück . . . .