Du brauchst Hilfe? Frage die Community oder wende dich an einen Experten.
Zu Avira Answers
Name:TR/Drop.Agent.83968
Entdeckt am:01/12/2009
Art:Trojan
Nebenart:Dropper
In freier Wildbahn:Ja
Gemeldete Infektionen:Niedrig bis mittel
Verbreitungspotenzial:Niedrig bis mittel
Schadenspotenzial:Mittel
Statische Datei:Ja
Dateigre:83.968 Bytes
MD5 Prfsumme:eb5577ee02bfd94320ddee505f03f25e
IVDF Version:7.10.01.126 - Dienstag, 1. Dezember 2009

 General Verbreitungsmethode:
    Autorun Dateien
   • Lokales Netzwerk
    Messenger


Aliases:
   •  Mcafee: W32/Sdbot.worm
   •  Sophos: Troj/Agent-MNE
   •  Panda: W32/IRCbot.CVC
   •  Eset: Win32/AutoRun.IRCBot.DI
   •  Bitdefender: Backdoor.IRCBot.ACWT


Betriebsysteme:
   • Windows 2000
   • Windows XP
   • Windows 2003


Auswirkungen:
   • Erstellt schdliche Dateien
   • Setzt Sicherheitseinstellungen herunter
   • nderung an der Registry
   • Ermglicht unbefugten Zugriff auf den Computer

 Dateien Kopien seiner selbst werden hier erzeugt:
   • %SYSDIR%\wmisrpd.exe
   • %Laufwerk%\.DEBUG-93013\drvf.sys



Die anfnglich ausgefhrte Kopie der Malware wird gelscht.



Folgende Datei wird gelscht:
   • %SYSDIR%\drivers\etc\hosts



Es werden folgende Dateien erstellt:

%Laufwerk%\autorun.inf Diese Datei ist eine nicht virulente Textdatei mit folgendem Inhalt:
   • %Programmcode, der Malware startet%

%SYSDIR%\drivers\kernelx86.sys Weitere Untersuchungen haben ergeben, dass diese Datei auch Malware ist. Erkannt als: TR/Patched.jlw




Es versucht folgende Dateien auszufhren:

Dateiname:
   • "%SYSDIR%\wmisrpd.exe"


Dateiname:
   • sc config "avast! Antivirus" start= disabled


Dateiname:
   • CMD /C net stop AntiVirService


Dateiname:
   • sc delete "avast! Antivirus"


Dateiname:
   • CMD /C sc stop AntiVirService


Dateiname:
   • net1 stop "avast! Antivirus"


Dateiname:
   • net stop AntiVirService


Dateiname:
   • CMD /C sc config AntiVirService start= disabled


Dateiname:
   • sc stop AntiVirService


Dateiname:
   • net1 stop AntiVirService


Dateiname:
   • CMD /C sc delete AntiVirService


Dateiname:
   • CMD /C del /F /S /Q *.zip


Dateiname:
   • sc config AntiVirService start= disabled


Dateiname:
   • CMD /C net stop PASRV


Dateiname:
   • CMD /C sc stop PASRV


Dateiname:
   • sc delete AntiVirService


Dateiname:
   • net stop PASRV


Dateiname:
   • CMD /C sc config PASRV start= disabled


Dateiname:
   • sc stop PASRV


Dateiname:
   • net1 stop PASRV


Dateiname:
   • CMD /C sc delete PASRV


Dateiname:
   • sc config PASRV start= disabled


Dateiname:
   • %SYSDIR%\wmisrpd.exe


Dateiname:
   • CMD /C net stop VSSERV


Dateiname:
   • CMD /C sc stop VSSERV


Dateiname:
   • sc delete PASRV


Dateiname:
   • net stop VSSERV


Dateiname:
   • CMD /C sc config VSSERV start= disabled


Dateiname:
   • sc stop VSSERV


Dateiname:
   • CMD /C sc delete VSSERV


Dateiname:
   • net1 stop VSSERV


Dateiname:
   • sc config VSSERV start= disabled


Dateiname:
   • CMD /C net stop avg8wd


Dateiname:
   • CMD /C net stop "avast! Antivirus"


Dateiname:
   • sc delete VSSERV


Dateiname:
   • CMD /C sc stop avg8wd


Dateiname:
   • CMD /C sc config avg8wd start= disabled


Dateiname:
   • net stop avg8wd


Dateiname:
   • sc stop avg8wd


Dateiname:
   • CMD /C sc delete avg8wd


Dateiname:
   • net1 stop avg8wd


Dateiname:
   • sc config avg8wd start= disabled


Dateiname:
   • CMD /C net stop NOD32krn


Dateiname:
   • sc delete avg8wd


Dateiname:
   • ipconfig /flushdns


Dateiname:
   • CMD /C sc stop NOD32krn


Dateiname:
   • CMD /C sc config NOD32krn start= disabled


Dateiname:
   • net stop NOD32krn


Dateiname:
   • sc stop NOD32krn


Dateiname:
   • net1 stop NOD32krn


Dateiname:
   • sc config NOD32krn start= disabled


Dateiname:
   • CMD /C sc delete NOD32krn


Dateiname:
   • CMD /C net stop SbPF.Launcher


Dateiname:
   • CMD /C sc stop SbPF.Launcher


Dateiname:
   • sc delete NOD32krn


Dateiname:
   • CMD /C sc stop "avast! Antivirus"


Dateiname:
   • net stop SbPF.Launcher


Dateiname:
   • CMD /C sc config SbPF.Launcher start= disabled


Dateiname:
   • sc stop SbPF.Launcher


Dateiname:
   • net1 stop SbPF.Launcher


Dateiname:
   • sc config SbPF.Launcher start= disabled


Dateiname:
   • CMD /C sc delete SbPF.Launcher


Dateiname:
   • CMD /C net stop SPF4


Dateiname:
   • sc delete SbPF.Launcher


Dateiname:
   • CMD /C sc stop SPF4


Dateiname:
   • CMD /C sc config SPF4 start= disabled


Dateiname:
   • CMD /C sc config "avast! Antivirus" start= disabled


Dateiname:
   • net stop SPF4


Dateiname:
   • sc stop SPF4


Dateiname:
   • CMD /C sc delete SPF4


Dateiname:
   • net1 stop SPF4


Dateiname:
   • sc config SPF4 start= disabled


Dateiname:
   • CMD /C net stop acssrv


Dateiname:
   • sc delete SPF4


Dateiname:
   • CMD /C sc stop acssrv


Dateiname:
   • net stop acssrv


Dateiname:
   • CMD /C sc config acssrv start= disabled


Dateiname:
   • net stop "avast! Antivirus"


Dateiname:
   • sc stop acssrv


Dateiname:
   • CMD /C sc delete acssrv


Dateiname:
   • net1 stop acssrv


Dateiname:
   • sc config acssrv start= disabled


Dateiname:
   • sc delete acssrv


Dateiname:
   • CMD /C sc delete "avast! Antivirus"


Dateiname:
   • sc stop "avast! Antivirus"

 Registry Der folgende Registryschlssel wird hinzugefgt um den Prozess nach einem Neustart des Systems erneut zu starten.

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "ctfmon.exe"="ctfmon.exe"



Um die Windows XP Firewall zu umgehen werden folgende Eintrge erstellt:

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\DomainProfile\AuthorizedApplications\List]
   • "%SYSDIR%\wmisrpd.exe"="%SYSDIR%\wmisrpd.exe:*:Enabled:Windows Live"



Folgende Registryschlssel werden hinzugefgt:

[HKLM\SOFTWARE\Policies\Microsoft\MRT]
   • "DontReportInfectionInformation"=dword:0x00000001

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions]
   • "GON"="%ausgefhrte Datei%"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
   Image File Execution Options\ctfmon.exe]
   • "Debugger"="wmisrpd.exe"

[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal]
   • "ctfmon.exe"="ctfmon.exe"

[HKLM\SOFTWARE\Microsoft\Security Center]
   • "AntiVirusDisableNotify"=dword:0x00000001
   • "AntiVirusOverride"=dword:0x00000001
   • "FirewallDisableNotify"=dword:0x00000001
   • "FirewallOverride"=dword:0x00000001

[HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
   • "DisableConfig"=dword:0x00000001

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\
   Layers]
   • "%SYSDIR%\wmisrpd.exe"="DisableNXShowUI"

[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network]
   • "ctfmon.exe"="ctfmon.exe"

[HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
   • "DoNotAllowXPSP2"=dword:0x00000001



Folgende Registryschlssel werden gendert:

[HKLM\SYSTEM\CurrentControlSet\Services\wscsvc]
   Neuer Wert:
   • "Start"=dword:0x00000004

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
   Neuer Wert:
   • "DisableSR"=dword:0x00000001

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   Neuer Wert:
   • "Hidden"=dword:0x00000002

Verschiedenste Einstellungen des Explorers:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
   Folder\SuperHidden]
   Neuer Wert:
   • "CheckedValue"=dword:0x00000001

[HKLM\SYSTEM\CurrentControlSet\Control\Lsa]
   Neuer Wert:
   • "restrictanonymous"=dword:0x00000001

[HKLM\SOFTWARE\Microsoft\Ole]
   Neuer Wert:
   • "EnableDCOM"="N"

 Messenger Es verbreitet sich ber Messenger. Die Charakteristiken sind folgende:

 AIM Messenger
 MSN Messenger

Die URL verweit auf eine Kopie der beschriebenen Malware. Ld der Benutzer die Datei auf seinen Computer und startet diese, so wiederholt sich der Infektionsprozess.

 Infektion ber das Netzwerk Um die weitere Verbreitung sicherzustellen versucht sich die Malware mit anderen Computern zu verbinden. Die Einzelheiten hierzu sind im Folgenden beschrieben.


Exploit:
Folgende Sicherheitslcken werden ausgenutzt:
– MS04-007 (ASN.1 Vulnerability)
 MS06-040 (Vulnerability in Server Service)


IP Adressen Erzeugung:
Es werden zufllige IP Adressen generiert wobei die erste Zahl die der eigenen Addresse ist. Es wird dann versuche eine Verbindung mit diesen Adressen aufzubauen.


Entfernte Aktivierung:
Es wird versucht die Malware auf dem neu infizierten Computer zu starten. Dies wird ber die NetScheduleJobAdd Funktion realisiert.

 IRC Um Systeminformationen zu bermitteln und Fernsteuerung sicherzustellen werden Verbindungen mit folgenden IRC Servern hergestellt:

Server: replicate.srv**********.info
Port: 31960
Channel: #w1sd0m
Nickname: [00|USA|XP|%Nummer%]

Server: apophis.dwn**********.info
Port: 36019
Channel: #w1sd0m
Nickname: [00|USA|XP|%Nummer%]

Server: merlin.fla**********.info
Port: 51930
Channel: #w1sd0m
Nickname: [00|USA|XP|%Nummer%]

Server: ancient.srv**********.info
Port: 52740
Channel: #w1sd0m
Nickname: [00|USA|XP|%Nummer%]

Server: jackson.upd**********.info
Port: 35920
Channel: #w1sd0m
Nickname: [00|USA|XP|%Nummer%]

Server: jackson.upd**********.info
Port: 48912
Channel: #w1sd0m
Nickname: [00|USA|XP|%Nummer%]

 Hosts Die hosts Datei wird wie folgt gendert:

In diesem Fall bleiben bestehende Eintrge erhalten.

Zugriffe auf folgende Domains werden auf andere Ziele umgeleitet:
   • 209.85.225.99 msnfix.changelog.fr;
      209.85.225.99 www.incodesolutions.com;
      209.85.225.99 virusinfo.prevx.com;
      209.85.225.99 download.bleepingcomputer.com;
      209.85.225.99 www.dazhizhu.cn; 209.85.225.99 foro.noticias3d.com;
      209.85.225.99 www.spybotupdates.com; 209.85.225.99 www.nabble.com;
      209.85.225.99 lurker.clamav.net; 209.85.225.99 lexikon.ikarus.at;
      209.85.225.99 research.sunbelt-software.com;
      209.85.225.99 www.virusdoctor.jp; 209.85.225.99 www.elitepvpers.de;
      209.85.225.99 guru.avg.com; 209.85.225.99 downloads.sophos.com;
      209.85.225.99 www.superuser.co.kr; 209.85.225.99 ntfaq.co.kr;
      209.85.225.99 v.dreamwiz.com; 209.85.225.99 cit.kookmin.ac.kr;
      209.85.225.99 forums.whatthetech.com;
      209.85.225.99 forum.hijackthis.de; 209.85.225.99 avg.vo.llnwd.net;
      209.85.225.99 ftp.drweb.com; 209.85.225.99 www.zonealarm.com;
      209.85.225.99 www.huaifai.go.th; 209.85.225.99 www.mostz.com;
      209.85.225.99 www.krupunmai.com; 209.85.225.99 www.cddchiangmai.net;
      209.85.225.99 forum.malekal.com; 209.85.225.99 tech.pantip.com;
      209.85.225.99 sapcupgrades.com;
      209.85.225.99 www.elguruinformatico.com;
      209.85.225.99 www.247fixes.com; 209.85.225.99 forum.sysinternals.com;
      209.85.225.99 forum.telecharger.01net.com; 209.85.225.99 sophos.com;
      209.85.225.99 foros.softonic.com;
      209.85.225.99 avast-home.uptodown.com;
      209.85.225.99 dr-web-cureit.softonic.com;
      209.85.225.99 www.f-secure.com; 209.85.225.99 www.chkrootkit.org;
      209.85.225.99 diamondcs.com.au; 209.85.225.99 www.rootkit.nl;
      209.85.225.99 www.sysinternals.com; 209.85.225.99 z-oleg.com;
      209.85.225.99 espanol.dir.groups.yahoo.com;
      209.85.225.99 ftp01net.telechargement.fr;
      209.85.225.99 www.castlecrops.com; 209.85.225.99 www.misec.net;
      209.85.225.99 safecomputing.umn.edu;
      209.85.225.99 www.antirootkit.com; 209.85.225.99 www.greatis.com;
      209.85.225.99 ar.answers.yahoo.com; 209.85.225.99 www.elhacker.org;
      209.85.225.99 research.pandasecurity.com;
      209.85.225.99 www.rootkit.com; 209.85.225.99 www.pctools.com;
      209.85.225.99 www.pcsupportadvisor.com;
      209.85.225.99 www.resplendence.com;
      209.85.225.99 www.personal.psu.edu; 209.85.225.99 foro.ethek.com;
      209.85.225.99 foro.elhacker.net; 209.85.225.99 download.zonealarm.com;
      209.85.225.99 vil.nail.com; 209.85.225.99 search.mcafee.com;
      209.85.225.99 wwww.mcafee.com; 209.85.225.99 download.nai.com;
      209.85.225.99 wwww.experts-exchange.com;
      209.85.225.99 www.bakunos.com; 209.85.225.99 www.darkclockers.com;
      209.85.225.99 www2.gmer.net; 209.85.225.99 www.Merijn.org;
      209.85.225.99 www.spywareinfo.com; 209.85.225.99 www.spybot.info;
      209.85.225.99 www.viruslist.com; 209.85.225.99 www.hijackthis.de;
      209.85.225.99 ftp.f-secure.com; 209.85.225.99 forum.kaspersky.com;
      209.85.225.99 es.trendmicro-europe.com; 209.85.225.99 majorgeeks.com;
      209.85.225.99 www.avp.com; 209.85.225.99 www.virustotal.com;
      209.85.225.99 www.sophos.com; 209.85.225.99 linhadefensiva.uol.com.br;
      209.85.225.99 cmmings.cn; 209.85.225.99 www.sergiwa.com;
      209.85.225.99 www.el-hacker.com; 209.85.225.99 dl2.agnitum.com;
      209.85.225.99 www.avg-antivirus.net;
      209.85.225.99 www.kaspersky-labs.com; 209.85.225.99 www.kaspersky.com;
      209.85.225.99 www.bleepingcomputer.com;
      209.85.225.99 www.free.grisoft.com;
      209.85.225.99 alerta-antivirus.inteco.es;
      209.85.225.99 securityresponse.symantec.com;
      209.85.225.99 www.analysis.seclab.tuwien.ac.at;
      209.85.225.99 www.symantec.com; 209.85.225.99 www.kztechs.com;
      209.85.225.99 ad-aware-se.uptodown.com;
      209.85.225.99 stdio-labs.blogspot.com;
      209.85.225.99 liveupdate.symantecliveupdate.com;
      209.85.225.99 liveupdate.symantec.com;
      209.85.225.99 customer.symantec.com;
      209.85.225.99 update.symantec.com; 209.85.225.99 www.box.net;
      209.85.225.99 foro.el-hacker.com; 209.85.225.99 acs.pandasoftware.com;
      209.85.225.99 www.mcafee.com; 209.85.225.99 www.free.avg.com;
      209.85.225.99 download.mcafee.com; 209.85.225.99 mast.mcafee.com;
      209.85.225.99 www.tecno-soft.com; 209.85.225.99 ladooscuro.es;
      209.85.225.99 ftp.drweb.com;
      209.85.225.99 download.microsoft.comguru0.grisoft.cz;
      209.85.225.99 guru1.grisoft.cz; 209.85.225.99 guru2.grisoft.cz;
      209.85.225.99 guru3.grisoft.cz;
      209.85.225.99 download.bleepingcomputer.com;
      209.85.225.99 it.answers.yahoo.com; 209.85.225.99 www.softonic.com;
      209.85.225.99 guru4.grisoft.cz; 209.85.225.99 guru5.grisoft.cz;
      209.85.225.99 www.virusspy.com; 209.85.225.99 download.f-secure.com;
      209.85.225.99 www.malwareremoval.com; 209.85.225.99 forums.cnet.com;
      209.85.225.99 foros.softonic.com;
      209.85.225.99 hjt-data.trend-braintree.com;
      209.85.225.99 www.pantip.com; 209.85.225.99 secubox.aldria.com;
      209.85.225.99 www.forospyware.com;
      209.85.225.99 www.manuelruvalcaba.com;
      209.85.225.99 www.zonavirus.com; 209.85.225.99 www.leforo.com;
      209.85.225.99 www.siteadvisor.com; 209.85.225.99 blog.threatfire.com;
      209.85.225.99 www.threatexpert.com; 209.85.225.99 blog.hispasec.com;
      209.85.225.99 www.configurarequipos.com;
      209.85.225.99 sosvirus.changelog.fr; 209.85.225.99 www.psicofxp.com;
      209.85.225.99 mailcenter.rising.com.cn;
      209.85.225.99 mailcenter.rising.com; 209.85.225.99 www.rising.com.cn;
      209.85.225.99 www.rising.com; 209.85.225.99 www.babooforum.com.br;
      209.85.225.99 www.runscanner.net; 209.85.225.99 www.blogschapines.com;
      209.85.225.99 sosvirus.changelog.fr;
      209.85.225.99 upload.changelog.fr; 209.85.225.99 www.raymond.cc;
      209.85.225.99 changelog.fr; 209.85.225.99 www.pcentraide.com;
      209.85.225.99 atazita.blogspot.com; 209.85.225.99 www.thinkpad.cn;
      209.85.225.99 www.sunbeltsoftware.com;
      209.85.225.99 www.final4ever.com; 209.85.225.99 files.filefont.com;
      209.85.225.99 www.infos-du-net.com; 209.85.225.99 www.trendsecure.com;
      209.85.225.99 forum.hardware.fr;
      209.85.225.99 www.utilidades-utiles.com;
      209.85.225.99 blogs.icerocket.com; 209.85.225.99 www.spychecker.com;
      209.85.225.99 www.geekstogo.com; 209.85.225.99 forums.maddoktor2.com;
      209.85.225.99 www.smokey-services.eu; 209.85.225.99 www.clubic.com;
      209.85.225.99 www.linhadefensiva.org;
      209.85.225.99 www.rolandovera.com;
      209.85.225.99 download.sysinternals.com;
      209.85.225.99 www.pcguide.com; 209.85.225.99 www.thetechguide.com;
      209.85.225.99 www.ozzu.com; 209.85.225.99 www.changedetection.com;
      209.85.225.99 espanol.groups.yahoo.com;
      209.85.225.99 www.sunbeltsecurity.com;
      209.85.225.99 community.thaiware.com;
      209.85.225.99 www.avpclub.ddns.info;
      209.85.225.99 www.offensivecomputing.net;
      209.85.225.99 www.grisoft.com; 209.85.225.99 boardreader.com;
      209.85.225.99 www.guiadohardware.net; 209.85.225.99 www.webroot.com;
      209.85.225.99 www.msnvirusremoval.com; 209.85.225.99 www.cisrt.org;
      209.85.225.99 fixmyim.com; 209.85.225.99 samroeng.hi5.com;
      209.85.225.99 foro.elhacker.net; 209.85.225.99 www.daboweb.com;
      209.85.225.99 service1.symantec.com;
      209.85.225.99 us3.download.comodo.com;
      209.85.225.99 forums.techguy.org;
      209.85.225.99 www.incodesolutions.com;
      209.85.225.99 hijackthis.download3000.com;
      209.85.225.99 www.cybertechhelp.com;
      209.85.225.99 www.superdicas.com.br; 209.85.225.99 www.51nb.com;
      209.85.225.99 us4.download.comodo.com;
      209.85.225.99 downloads.andymanchesta.com;
      209.85.225.99 andymanchesta.com; 209.85.225.99 info.prevx.com;
      209.85.225.99 aknow.prevx.com; 209.85.225.99 www.zonavirus.com;
      209.85.225.99 securitywonks.net; 209.85.225.99 www.yoreparo.com;
      209.85.225.99 www.lavasoft.com; 209.85.225.99 www.virscan.org;
      209.85.225.99 www.eeload.com; 209.85.225.99 down.www.kingsoft.com;
      209.85.225.99 www.file.net; 209.85.225.99 onecare.live.com;
      209.85.225.99 mvps.org; 209.85.225.99 www.laneros.com;
      209.85.225.99 www.housecall.trendmicro.com;
      209.85.225.99 www.avast.com; 209.85.225.99 www.free.avg.com;
      209.85.225.99 www.onlinescan.avast.com; 209.85.225.99 www.ewido.net;
      209.85.225.99 www.trucoswindows.net;
      209.85.225.99 www.mozilla-hispano.org;
      209.85.225.99 www.futurenow.bitdefender.com;
      209.85.225.99 www.bitdefender.com; 209.85.225.99 www.f-prot.com;
      209.85.225.99 www.trendsecure.com;
      209.85.225.99 security.symantec.com;
      209.85.225.99 oldtimer.geekstogo.com; 209.85.225.99 www.avira.com;
      209.85.225.99 www.eset.com; 209.85.225.99 www.free.avg.com;
      209.85.225.99 www.free-av.com; 209.85.225.99 kr.ahnlab.com;
      209.85.225.99 www.eset.com; 209.85.225.99 forospyware.com;
      209.85.225.99 thejokerx.blogspot.com; 209.85.225.99 www.2-spyware.com;
      209.85.225.99 www.antivir.es; 209.85.225.99 www.prevx.com;
      209.85.225.99 www.ikarus.net; 209.85.225.99 bbs.s-sos.net;
      209.85.225.99 www.housecall.trendmicro.com;
      209.85.225.99 www.superdicas.com.br;
      209.85.225.99 www.forums.majorgeeks.com;
      209.85.225.99 www.castlecops.com; 209.85.225.99 www.virusspy.com;
      209.85.225.99 andymanchesta.com; 209.85.225.99 www.kaspersky.es;
      209.85.225.99 subs.geekstogo.com; 209.85.225.99 www.forospanish.com;
      209.85.225.99 www.trendmicro.com; 209.85.225.99 www.fortinet.com;
      209.85.225.99 www.safer-networking.org;
      209.85.225.99 www.fortiguardcenter.com;
      209.85.225.99 www.dougknox.com; 209.85.225.99 www.vsantivirus.com;
      209.85.225.99 static.commentcamarche.net;
      209.85.225.99 www.firewallguide.com; 209.85.225.99 www.auditmypc.com;
      209.85.225.99 www.spywaredb.com; 209.85.225.99 www.mxttchina.com;
      209.85.225.99 www.ziggamza.net; 209.85.225.99 www.forospyware.es;
      209.85.225.99 pogonyuto.forospanish.com;
      209.85.225.99 www.antivirus.comodo.com;
      209.85.225.99 www.spywareterminator.com;
      209.85.225.99 www.eradicatespyware.net;
      209.85.225.99 www.freespywareremoval.info;
      209.85.225.99 www.personalfirewall.comodo.com;
      209.85.225.99 www.clamav.net; 209.85.225.99 www.antivirus.about.com;
      209.85.225.99 www.pandasecurity.com; 209.85.225.99 www.webphand.com;
      209.85.225.99 mx.answers.yahoo.com;
      209.85.225.99 www.securitywonks.net;
      209.85.225.99 www.messengeradictos.com;
      209.85.225.99 www.sandboxie.com; 209.85.225.99 www.clamwin.com;
      209.85.225.99 www.cwsandbox.org; 209.85.225.99 www.ca.com;
      209.85.225.99 www.arswp.com; 209.85.225.99 es.answers.yahoo.com;
      209.85.225.99 www.trucoswindows.es; 209.85.225.99 www.ipaddresser.com;
      209.85.225.99 www.networkworld.com;
      209.85.225.99 www.cddchiangmai.net;
      209.85.225.99 www.threatexpert.com; 209.85.225.99 www.norman.com;
      209.85.225.99 espanol.answers.yahoo.com;
      209.85.225.99 www.tallemu.com; 209.85.225.99 foro.portalhacker.net;
      209.85.225.99 virscan.org; 209.85.225.99 www.viruschief.com;
      209.85.225.99 scanner.virus.org; 209.85.225.99 www.hijackthis.de;
      209.85.225.99 housecall65.trendmicro.com;
      209.85.225.99 www.guiadohardware.net;
      209.85.225.99 forums.whatthetech.com;
      209.85.225.99 hjt.networktechs.com;
      209.85.225.99 www.techsupportforum.com;
      209.85.225.99 www.whatthetech.com; 209.85.225.99 www.soccersuck.com;
      209.85.225.99 www.pcentraide.com;
      209.85.225.99 comunidad.wilkinsonpc.com.co;
      209.85.225.99 forum.piriform.com;
      209.85.225.99 www.tweaksforgeeks.com; 209.85.225.99 www.daniweb.com;
      209.85.225.99 www.geekstogo.com; 209.85.225.99 es.answers.yahoo.com;
      209.85.225.99 www.techsupportforum.com;
      209.85.225.99 dnl-eu8.kaspersky-labs.com;
      209.85.225.99 www.pchell.com; 209.85.225.99 www.spyany.com;
      209.85.225.99 forums.techguy.org;
      209.85.225.99 www.experts-exchange.com; 209.85.225.99 www.wikio.es;
      209.85.225.99 www.pandasecurity.com; 209.85.225.99 forums.devshed.com;
      209.85.225.99 forum.tweaks.com; 209.85.225.99 www.wilderssecurity.com;
      209.85.225.99 www.techspot.com;
      209.85.225.99 www.thecomputerpitstop.com;
      209.85.225.99 es.wasalive.com; 209.85.225.99 secunia.com;
      209.85.225.99 www.killtrojan.net; 209.85.225.99 es.kioskea.net;
      209.85.225.99 www.taringa.net; 209.85.225.99 www.cyberdefender.com;
      209.85.225.99 www.feedage.com; 209.85.225.99 new.taringa.net;
      209.85.225.99 forum.zazana.com;
      209.85.225.99 forum.clubedohardware.com.br;
      209.85.225.99 www.computing.net;
      209.85.225.99 discussions.virtualdr.com;
      209.85.225.99 forum.securitycadets.com; 209.85.225.99 www.techimo.com;
      209.85.225.99 13iii.com; 209.85.225.99 www.dicasweb.com.br;
      209.85.225.99 www.javacoolsoftware.net;
      209.85.225.99 www.infosecpodcast.com; 209.85.225.99 www.usbcleaner.cn;
      209.85.225.99 www.net-security.org;
      209.85.225.99 www.bleedingthreats.net;
      209.85.225.99 acs.pandasoftware.com; 209.85.225.99 www.funkytoad.com;
      209.85.225.99 www.360safe.cn; 209.85.225.99 www.360safe.com;
      209.85.225.99 bbs.360safe.cn; 209.85.225.99 bbs.360safe.com;
      209.85.225.99 codehard.wordpress.com;
      209.85.225.99 forum.clubedohardware.com.br;
      209.85.225.99 antitrick.com; 209.85.225.99 www.360.cn;
      209.85.225.99 www.360.com; 209.85.225.99 bbs.360safe.cn;
      209.85.225.99 bbs.360safe.com; 209.85.225.99 www.forospyware.es;
      209.85.225.99 p3dev.taringa.net;
      209.85.225.99 www.precisesecurity.com; 209.85.225.99 dlpe.antivir.com;
      209.85.225.99 baike.360.cn; 209.85.225.99 baike.360.com;
      209.85.225.99 kaba.360.cn; 209.85.225.99 kaba.360.com;
      209.85.225.99 deckard.geekstogo.com; 209.85.225.99 www.taringa.net;
      209.85.225.99 forums.comodo.com; 209.85.225.99 www.mvps.org;
      209.85.225.99 down.360safe.cn; 209.85.225.99 down.360safe.com;
      209.85.225.99 x.360safe.com; 209.85.225.99 dl.360safe.com;
      209.85.225.99 ftp.drweb.com; 209.85.225.99 www.hotshare.net;
      209.85.225.99 es.wasalive.com; 209.85.225.99 free.antivirus.com;
      209.85.225.99 updatem.360safe.com; 209.85.225.99 updatem.360safe.cn;
      209.85.225.99 update.360safe.cn; 209.85.225.99 update.360safe.com;
      209.85.225.99 www.utilidades-utiles.com;
      209.85.225.99 forum.kaspersky.com; 209.85.225.99 bbs.duba.net;
      209.85.225.99 www.duba.net; 209.85.225.99 zhidao.baidu.com;
      209.85.225.99 hi.baidu.com; 209.85.225.99 www.drweb.com.es;
      209.85.225.99 msncleaner.softonic.com;
      209.85.225.99 www.javacoolsoftware.com; 209.85.225.99 file.ikaka.com;
      209.85.225.99 file.ikaka.cn; 209.85.225.99 bbs.ikaka.com;
      209.85.225.99 zhidao.ikaka.com; 209.85.225.99 www.eset-la.com;
      209.85.225.99 download.eset.com;
      209.85.225.99 software-files.download.com;
      209.85.225.99 www.ikaka.com; 209.85.225.99 www.ikaka.cn;
      209.85.225.99 bbs.cfan.com.cn; 209.85.225.99 www.cfan.com.cn;
      209.85.225.99 www.pandasecurity.com; 209.85.225.99 es.mcafee.com;
      209.85.225.99 downloads.malwarebytes.org; 209.85.225.99 bbs.kafan.cn;
      209.85.225.99 bbs.kafan.com; 209.85.225.99 bbs.kpfans.com;
      209.85.225.99 bbs.taisha.org; 209.85.225.99 www.manuelruvalcaba.com;
      209.85.225.99 support.f-secure.com; 209.85.225.99 bbs.winzheng.com;
      209.85.225.99 alerta-antivirus.inteco.es;
      209.85.225.99 foros.zonavirus.com;
      209.85.225.99 alerta-antivirus.red.es;
      209.85.225.99 www.zonavirus.com; 209.85.225.99 www.malwarebytes.org;
      209.85.225.99 www.commentcamarche.net; 209.85.225.99 www.ewido.net;
      209.85.225.99 www.infospyware.com; 209.85.225.99 www.bitdefender.es;
      209.85.225.99 housecall.trendmicro.com;
      209.85.225.99 foros.toxico-pc.com; 209.85.225.99 www.identi.es;
      209.85.225.99 es.kioskea.net; 209.85.225.99 www.emsisoft.de;
      209.85.225.99 www.securitynewsportal.com;
      209.85.225.99 irc.ekizmedia.com; 209.85.225.99 zone.arminboutique.com;
      209.85.225.99 story.dnsentrymx.com; 209.85.225.99 W32.NyteMare2.RC11


 Prozess Beendigung Liste der Prozesse die beendet werden:
   • RAVP.EXEMBAM.EXE123.COM; UNIEXTRACT.EXE; SYSANALYZER_SETUP.EXE;
      STARTDRECK.EXE; SPF.EXE; REGX2.EXE; REGSHOT.EXE; REGSCANNER.EXE;
      REGISTRAR_LITE.EXE; REGCOOL.EXE; REGALYZ.EXE;
      PROJECTWHOISINSTALLER.EXE; PROCMON.EXE; CUREIT.EXE; FIXBAGLE.EXE;
      PGSETUP.EXE; OBJMONSETUP.EXE; NETALYZ.EXE; KILLBOX.EXE;
      INSTALLWATCHPRO25.EXE; AVENGER.EXE; IEFIX.EXE; HOSTSFILEREADER.EXE;
      FIXPATH.EXE; FILEFIND.EXE; FILEALYZ.EXE; EULALYZERSETUP.EXE;
      A2HIJACKFREESETUP.EXE; DLLCOMPARE.EXE; CPROCESS.EXE; CPORTS.EXE;
      ASVIEWER.EXE; APT.EXE; APM.EXE; WIRESHARK.EXE; SPYBOTSD.EXE;
      TEATIMER.EXE; SPYBOTSD160.EXE; PROCESSMONITOR.EXE; PROCDUMP.EXE;
      PG2.EXE; LORDPE.EXE; ICESWORD.EXE; REANIMATOR.EXE; ROOTKITNO.EXE;
      RKD.EXE; HACKMON.EXE; UNHACKME.EXE; ROOTKIT_DETECTIVE.EXE;
      AVGARKT.EXE; FSB.EXE; FSBL.EXE; ROOTKITREVEALER.EXE; PSKILL.EXE;
      TASKMON.EXE; TASKLIST.EXE; TASKMAN.EXE; PROCEXP.EXE; MSNFIX.EXE;
      HIJACKTHIS_V2.EXE; HIJACKTHIS.EXE; HIJACKTHIS_SFX.EXE; HJTSETUP.EXE;
      HJTINSTALL.EXE; OLLYDBG.EXE; NETSTAT.EXE; PORTMONITOR.EXE;
      PORTDETECTIVE.EXE; FPORT.EXE; APORTS.EXE; PAVARK.EXE; DARKSPY105.EXE;
      HELIOS.EXE; ROOTKITBUSTER.EXE; ROOTALYZER.EXE; BC5CA6A.EXE; SEEM.EXE;
      DELAYDELFILE.EXE; DUBATOOL_AV_KILLER.EXE; SUPERKILLER.EXE;
      KAKASETUPV6.EXE; BUSCAREG.EXE; MSNCLEANER.EXE; SRESTORE.EXE;
      BOOTSAFE.EXE; SUPERANTISPYWARE.EXE;
      REGUNLOCKER.EXETSNTEVAL.EXEXP_TASKMGRENAB.EXE; CF9409.EXE; GMER.EXE;
      CATCHME.EXE; SDFIX.EXE; COMBOFIX.EXE; SRENGPS.EXE; AUTORUNS.EXE;
      TASKKILL.EXE; REG.EXE; MYPHOTOKILLER.EXE; KILLAUTOPLUS.EXE;
      FOLDERCURE.EXE; REGEDIT.SCR; REGEDIT.COM; TCPVIEW.EXE; LISTO.EXE;
      GUARD.EXE; NTVDM.EXE; COMMAND.COM; COMBOFIX.COM; COMBOFIX.SCR;
      COMBOFIX.BAT; COMBO-FIX.EXE; REGMON.EXE; OTMOVEIT.EXEMBAM-SETUP.EXE;
      JAJA.EXE; AVZ.EXE; MBAM.EXE; MBAM-SETUP.EXE; PENCLEAN.EXE; ELISTA.EXE;
      HJ.EXE; WINDOWS-KB890930-V2.2.EXE; MRTSTUB.EXE; MRT.EXE;
      HIJACK-THIS.EXE; VIRUS.EXE;
      SAFEBOOTKEYREPAIR.EXEOTMOVEIT3.EXEHOSTSXPERT.EXEDAFT.EXE;
      ATF-CLEANER.EXE; COMPAQ_PROPIETARIO.EXE; REGUNLOCKER.EXE;
      UNLOCKERASSISTANT.EXE; UNLOCKER.EXE; VIPRE.EXE; ISSDM_EN_32.EXE;
      P08PROMO.EXE; K7TS_SETUP.EXE; AVINSTALL.EXE; WITSETUP.EXE;
      TrendMicro_TISPro_16.1_1063_x32.EXE;
      VBA32-PERSONAL-LATEST-ENGLISH.EXE; VIRUSUTILITIES.EXE;
      GUARDXSERVICE.EXE; GUARDXKICKOFF.EXE; MSASCUI.EXE; MSMPENG.EXE;
      SRENGLDR.EXE; HOOKANLZ.EXE


 Injektion Es injiziert sich als einen Remote Thread in einen Prozess.

    Prozessname:
   • explorer.exe


 Datei Einzelheiten Laufzeitpacker:
Um eine Erkennung zu erschweren und die Gre der Datei zu reduzieren wurde sie mit einem Laufzeitpacker gepackt.

Die Beschreibung wurde erstellt von Petre Galan am Freitag, 23. April 2010
Die Beschreibung wurde geändert von Petre Galan am Freitag, 23. April 2010

zurück . . . .