Nume:TR/Renos.E
Descoperit pe data de:17/06/2010
Tip:Troian
ITW:Da
Numar infectii raportate:Scazut
Potential de raspandire:Scazut
Potential de distrugere:Scazut
Fisier static:Da
Marime:236.032 Bytes
MD5:63daf2bec38f2df0fd257e530B4fdd68
Versiune IVDF:7.10.08.119 - Thursday, June 17, 2010

 General Metoda de raspandire:
   • Nu are rutina proprie de raspandire


Alias:
   •  Kaspersky: Trojan.Win32.FraudPack.bivb
   •  TrendMicro: TROJ_FAKEAV.SMA5
   •  F-Secure: Trojan.Win32.FraudPack.bivb
   •  Eset: Win32/Kryptik.GID
   •  DrWeb: BackDoor.Click.1058


Sisteme de operare:
   • Windows XP


Efecte secundare:
   • Modificari in registri

 Registrii sistemului Urmatoarele chei sunt adaugate in registrii sistemului:

– [HKLM\SYSTEM\CurrentControlSet\Services\SSHNAS]
   • "Type"=dword:00000020
   • "Start"=dword:00000002
   • "ErrorControl"=dword:00000000
   • "ImagePath"=hex(2):%valori hex%
   • "DisplayName"="SSHNAS"
   • "ObjectName"="LocalSystem"

– [HKLM\SYSTEM\CurrentControlSet\Services\SSHNAS\Parameters]
   • "ServiceDll"=hex(2):%valori hex%

– [HKLM\SYSTEM\CurrentControlSet\Services\SSHNAS\Security]
   • "Security"=hex:%valori hex%



Urmatoarea cheie din registri este modificata:

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
   Noua valoare:
   • "netsvcs"=hex(7):%valori hex%

 Detaliile fisierului Limbaj de programare:
 Limbaj de programare folosit: C (compilat cu Microsoft Visual C++).

Description inserted by Christoph Baumann on Wednesday, September 8, 2010
Description updated by Christoph Baumann on Wednesday, September 8, 2010

Back . . . .