Nume:TR/Fake.SecSui.O
Descoperit pe data de:12/07/2010
Tip:Troian
ITW:Da
Numar infectii raportate:Scazut spre mediu
Potential de raspandire:Mediu
Potential de distrugere:Scazut
Fisier static:Da
Marime:293.632 Bytes
MD5:29891f565c522214bec5ee4e5f635ceb
Versiune VDF:7.10.09.72

 General Metoda de raspandire:
   • Functia autorun


Alias:
   •  Kaspersky: Trojan.Win32.FraudPack.azkf
   •  Microsoft: Trojan:Win32/FakeSpypro
   •  Panda: Trj/CI.A
   •  Eset: Win32/Adware.SpywareProtect2009
   •  AhnLab: Trojan/Win32.FraudPack
   •  DrWeb: Trojan.Fakealert.18283


Sisteme de operare:
   • Windows XP


Efecte secundare:
   • Reduce setarile de securitate
   • Inchide aplicatiile de securitate
   • Modificari in registri

 Fisiere Se copiaza in urmatoarea locatie:
   • %HOME%\Local Settings\Application Data\lphcpmrpw\mvcecmptssd.exe

 Registrii sistemului Urmatoarele chei sunt adaugate in registri pentru a rula procesul la repornirea sistemului:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • nehlqwro"="%HOME%\Local Settings\Application Data\lphcpmrpw\mvcecmptssd.exe

– [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   • nehlqwro"="%HOME%\Local Settings\Application Data\lphcpmrpw\mvcecmptssd.exe



Urmatoarele chei sunt adaugate in registrii sistemului:

– [HKCU\Software\AVSS]
– [HKLM\Software\AVSS]
– [HKCU\Software\AVSuitE]
– [HKLM\Software\AVSuitE]
– [HKCU\Software\Microsoft\Internet Explorer\Download]
   • "CheckExeSignatures"="no"
   • "RunInvalidSignatures"=dword:00000001

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\
   Attachments]
   • "SaveZoneInformation"=dword:00000001

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\
   Associations]
   • "LowRiskFileTypes"=".exe"



Urmatoarea cheie din registri este modificata:

Reduce setarile de securitate din Internet Explorer:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
   Vechea valoare:
   • "ProxyEnable"=dword:00000000
   Noua valoare:
   • "ProxyEnable"=dword:00000001
   • "ProxyServer"="http=127.0.0.1:5577"
   • "ProxyOverride"=""
   •

Die Beschreibung wurde erstellt von Florian Burlefinger am Mittwoch, 14. Juli 2010
Die Beschreibung wurde geändert von Florian Burlefinger am Donnerstag, 15. Juli 2010

zurück . . . .