BDS/Surila.i - Backdoor Server

Siehe auch

Vollständig

Alias:	BackDoor-CEB.c
Type:	Backdoor
Size:	234,496 bytes
Origin:
Date:	09-09-2004
Damage:	Spreads using different IRC servers.
VDF Version:	6.27.00.52 - Thu, 09 Sep 2004 09:57 (GMT+1)
Danger:	Medium
Distribution:	Low

General DescriptionAffected systems:
Windows NT, Windows 2000, Windows XP, Windows Server 2003

Technical DetailsThis backdoor Trojan is dropped by the email worm Mydoom.U.
When activated, it makes the following registry entry:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dx32cxel]

It creates two copies in the following directories:
%STARTUP%\dx32cpl.exe
%sysdir%\dx32cpl.exe

The following files are created also:
%sysdir%\dx32cxel.sys (4096 bytes)
%sysdir%\dx32cxconf.ini (17 bytes)
%sysdir%\SVKP.SYS (2368 bytes)

The 'hosts' file is modified, so that the websites of many antivirus providers can not be accessed. The 'hosts' file is usually:
%sysdir%\drivers\etc\hosts

The following IP addresses are contacted:
62.241.53.2
211.233.41.235
81.23.250.167
193.19.227.24
66.98.192.99
207.44.222.47
213.158.119.104
207.44.206.27
62.241.53.4
216.127.94.107
67.15.18.45
62.241.53.15
64.246.54.12
62.241.53.16
211.214.161.107
67.15.18.57
66.98.144.100
69.50.187.210
66.111.43.80
212.199.125.36
66.90.68.2
62.241.53.17
69.50.228.50
81.23.250.169
69.57.132.8
64.246.18.98
218.78.211.62
207.44.142.33
64.246.16.11
205.209.176.220
80.64.179.46
65.75.161.70

The above registry entry ensures that the file 'dx32cxel.sys' starts as service. When it starts, it will hide active processes and files from the user.

The following message appears, if there are any active monitoring programs, such as Filemon or Regmon:
"Application cannot be run with debugger or monitoring tool(s) loaded!
Please unload it and restart the application."

Manual Remove InstructionsTo remove the backdoor Trojan, the following registry entry has to be deleted:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Ser vices\dx32cxel]
After restarting Windows, the above mentioned files must be deleted.

Kurzfassung hier.

Beschreibung erstellt von Crony Walker am Tue, 15 Jun 2004 14:00 (GMT+1)

» Über Malware
» Über Phishing
» In-the-Wild-Viren

« zurück