Nume:TR/Bagle.FU
Descoperit pe data de:28/03/2006
Tip:Troian
ITW:Nu
Numar infectii raportate:Scazut
Potential de raspandire:Scazut
Potential de distrugere:Mediu
Fisier static:Da
Marime:18.436 Bytes
MD5:a962a1c4e2808210666f07870Bf3daa7
Versiune VDF:6.34.00.108

 General Metoda de raspandire:
   • Nu are rutina proprie de raspandire


Alias:
   •  Symantec: W32.Beagle.DZ
   •  Kaspersky: Trojan-Proxy.Win32.Mitglieder.ea
   •  TrendMicro: TROJ_MITGLIED.AK


Sistem de operare:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Efecte secundare:
   • Inchide aplicatiile de securitate
   • Creeaza un fisier malware
   • Reduce setarile de securitate
   • Modificari in registri

 Fisiere Se copiaza in urmatoarea locatie:
   • %APPDATA%\hidires\hidr.exe



Sterge urmatoarele fisiere:
   • a2guard.exe
   • aavshield.exe
   • AckWin32.exe
   • ADVCHK.EXE
   • AhnSD.exe
   • airdefense.exe
   • ALERTSVC.EXE
   • ALMon.exe
   • ALOGSERV.EXE
   • ALsvc.exe
   • amon.exe
   • Anti-Trojan.exe
   • AntiVirScheduler
   • AntiVirService
   • ANTS.EXE
   • APVXDWIN.EXE
   • Armor2net.exe
   • ashAvast.exe
   • ashDisp.exe
   • ashEnhcd.exe
   • ashMaiSv.exe
   • ashPopWz.exe
   • ashServ.exe
   • ashSimpl.exe
   • ashSkPck.exe
   • ashWebSv.exe
   • aswUpdSv.exe
   • ATCON.EXE
   • ATUPDATER.EXE
   • ATWATCH.EXE
   • AUPDATE.EXE
   • AUTODOWN.EXE
   • AUTOTRACE.EXE
   • AUTOUPDATE.EXE
   • avciman.exe
   • Avconsol.exe
   • AVENGINE.EXE
   • avgamsvr.exe
   • avgcc.exe
   • AVGCC32.EXE
   • AVGCTRL.EXE
   • avgemc.exe
   • avgfwsrv.exe
   • AVGNT.EXE
   • avgntdd
   • avgntmgr
   • AVGSERV.EXE
   • AVGUARD.EXE
   • avgupsvc.exe
   • avinitnt.exe
   • AvkServ.exe
   • AVKService.exe
   • AVKWCtl.exe
   • AVP.EXE
   • AVP32.EXE
   • avpcc.exe
   • avpm.exe
   • AVPUPD.EXE
   • AVSCHED32.EXE
   • avsynmgr.exe
   • AVWUPD32.EXE
   • AVWUPSRV.EXE
   • AVXMONITOR9X.EXE
   • AVXMONITORNT.EXE
   • AVXQUAR.EXE
   • BackWeb-4476822.exe
   • bdmcon.exe
   • bdnews.exe
   • bdoesrv.exe
   • bdss.exe
   • bdsubmit.exe
   • bdswitch.exe
   • blackd.exe
   • blackice.exe
   • cafix.exe
   • ccApp.exe
   • ccEvtMgr.exe
   • ccProxy.exe
   • ccSetMgr.exe
   • CFIAUDIT.EXE
   • ClamTray.exe
   • ClamWin.exe
   • Claw95.exe
   • Claw95cf.exe
   • cleaner.exe
   • cleaner3.exe
   • CliSvc.exe
   • CMGrdian.exe
   • cpd.exe
   • DefWatch.exe
   • DOORS.EXE
   • DrVirus.exe
   • drwadins.exe
   • drweb32w.exe
   • drwebscd.exe
   • DRWEBUPW.EXE
   • ESCANH95.EXE
   • ESCANHNT.EXE
   • ewidoctrl.exe
   • EzAntivirusRegistrationCheck.exe
   • F-AGNT95.EXE
   • F-PROT95.EXE
   • F-Sched.exe
   • F-StopW.EXE
   • FAMEH32.EXE
   • FAST.EXE
   • FCH32.EXE
   • FireSvc.exe
   • FireTray.exe
   • FIREWALL.EXE
   • fpavupdm.exe
   • freshclam.exe
   • FRW.EXE
   • fsav32.exe
   • fsavgui.exe
   • fsbwsys.exe
   • fsdfwd.exe
   • FSGK32.EXE
   • fsgk32st.exe
   • fsguiexe.exe
   • FSM32.EXE
   • FSMA32.EXE
   • FSMB32.EXE
   • fspex.exe
   • fssm32.exe
   • gcasDtServ.exe
   • gcasServ.exe
   • GIANTAntiSpywareMain.exe
   • GIANTAntiSpywareUpdater.exe
   • GUARD.EXE
   • GUARDGUI.EXE
   • GuardNT.exe
   • HRegMon.exe
   • Hrres.exe
   • HSockPE.exe
   • HUpdate.EXE
   • iamapp.exe
   • iamserv.exe
   • ICLOAD95.EXE
   • ICLOADNT.EXE
   • ICMON.EXE
   • ICSSUPPNT.EXE
   • ICSUPP95.EXE
   • ICSUPPNT.EXE
   • IFACE.EXE
   • INETUPD.EXE
   • InocIT.exe
   • InoRpc.exe
   • InoRT.exe
   • InoTask.exe
   • InoUpTNG.exe
   • IOMON98.EXE
   • isafe.exe
   • ISATRAY.EXE
   • ISRV95.EXE
   • ISSVC.exe
   • JEDI.EXE
   • KAV.exe
   • kavmm.exe
   • KAVPF.exe
   • KavPFW.exe
   • KAVStart.exe
   • KAVSvc.exe
   • KAVSvcUI.EXE
   • KMailMon.EXE
   • KPfwSvc.EXE
   • KWatch.EXE
   • livesrv.exe
   • LOCKDOWN2000.EXE
   • LogWatNT.exe
   • lpfw.exe
   • LUALL.EXE
   • LUCOMSERVER.EXE
   • Luupdate.exe
   • MCAGENT.EXE
   • mcmnhdlr.exe
   • mcregwiz.exe
   • Mcshield.exe
   • MCUPDATE.EXE
   • mcvsshld.exe
   • MINILOG.EXE
   • MONITOR.EXE
   • MonSysNT.exe
   • MOOLIVE.EXE
   • MpEng.exe
   • mpssvc.exe
   • MSMPSVC.exe
   • myAgtSvc.exe
   • myagttry.exe
   • navapsvc.exe
   • NAVAPW32.EXE
   • NavLu32.exe
   • NAVW32.EXE
   • NDD32.EXE
   • NeoWatchLog.exe
   • NeoWatchTray.exe
   • NISSERV
   • NISUM.EXE
   • NMAIN.EXE
   • nod32.exe
   • nod32krn.exe
   • nod32kui.exe
   • NORMIST.EXE
   • notstart.exe
   • npavtray.exe
   • NPFMNTOR.EXE
   • npfmsg.exe
   • NPROTECT.EXE
   • NSCHED32.EXE
   • NSMdtr.exe
   • NssServ.exe
   • NssTray.exe
   • ntrtscan.exe
   • NTXconfig.exe
   • NUPGRADE.EXE
   • NVC95.EXE
   • Nvcod.exe
   • Nvcte.exe
   • Nvcut.exe
   • NWService.exe
   • OfcPfwSvc.exe
   • OUTPOST.EXE
   • PAV.EXE
   • PavFires.exe
   • PavFnSvr.exe
   • Pavkre.exe
   • PavProt.exe
   • pavProxy.exe
   • pavprsrv.exe
   • pavsrv51.exe
   • PAVSS.EXE
   • pccguide.exe
   • PCCIOMON.EXE
   • pccntmon.exe
   • PCCPFW.exe
   • PcCtlCom.exe
   • PCTAV.exe
   • PERSFW.EXE
   • pertsk.exe
   • PERVAC.EXE
   • PNMSRV.EXE
   • POP3TRAP.EXE
   • POPROXY.EXE
   • prevsrv.exe
   • PsImSvc.exe
   • QHM32.EXE
   • QHONLINE.EXE
   • QHONSVC.EXE
   • QHPF.EXE
   • qhwscsvc.exe
   • RavMon.exe
   • RavTimer.exe
   • Realmon.exe
   • REALMON95.EXE
   • Rescue.exe
   • rfwmain.exe
   • Rtvscan.exe
   • RTVSCN95.EXE
   • RuLaunch.exe
   • SAVAdminService.exe
   • SAVMain.exe
   • savprogress.exe
   • SAVScan.exe
   • SCAN32.EXE
   • ScanningProcess.exe
   • sched.exe
   • sdhelp.exe
   • SERVIC~1.EXE
   • SHSTAT.EXE
   • SiteCli.exe
   • smc.exe
   • SNDSrvc.exe
   • SPBBCSvc.exe
   • SPHINX.EXE
   • spiderml.exe
   • spidernt.exe
   • Spiderui.exe
   • SpybotSD.exe
   • SPYXX.EXE
   • SS3EDIT.EXE
   • stopsignav.exe
   • swAgent.exe
   • swdoctor.exe
   • SWNETSUP.EXE
   • symlcsvc.exe
   • SymProxySvc.exe
   • SymSPort.exe
   • SymWSC.exe
   • SYNMGR.EXE
   • TAUMON.EXE
   • TBMon.exe
   • TC.EXE
   • tca.exe
   • TCM.EXE
   • TDS-3.EXE
   • TeaTimer.exe
   • TFAK.EXE
   • THAV.EXE
   • THSM.EXE
   • Tmas.exe
   • tmlisten.exe
   • Tmntsrv.exe
   • TmPfw.exe
   • tmproxy.exe
   • TNBUtil.exe
   • TRJSCAN.EXE
   • Up2Date.exe
   • UPDATE.EXE
   • UpdaterUI.exe
   • upgrepl.exe
   • Vba32ECM.exe
   • Vba32ifs.exe
   • vba32ldr.exe
   • Vba32PP3.exe
   • VBSNTW.exe
   • vchk.exe
   • vcrmon.exe
   • VetTray.exe
   • VirusKeeper.exe
   • VPTRAY.EXE
   • vrfwsvc.exe
   • VRMONNT.EXE
   • vrmonsvc.exe
   • vrrw32.exe
   • VSECOMR.EXE
   • Vshwin32.exe
   • vsmon.exe
   • vsserv.exe
   • VsStat.exe
   • WATCHDOG.EXE
   • WebProxy.exe
   • Webscanx.exe
   • WEBTRAP.EXE
   • WGFE95.EXE
   • Winaw32.exe
   • winroute.exe
   • winss.exe
   • winssnotify.exe
   • WRADMIN.EXE
   • WRCTRL.EXE
   • xcommsvr.exe
   • zatutor.exe
   • ZAUINST.EXE
   • zlclient.exe
   • zonealarm.exe
   • _AVP32.EXE
   • _AVPCC.EXE
   • _AVPM.EXE



Este creat fisierul:

– %APPDATA%\hidires\m_hook.sys Analiza ulterioara a relevat ca si acest fisier este malware. Detectat ca: TR/Proxy.Mitglieder.EA

 Registrii sistemului Urmatoarea cheie este adaugata in registri pentru a rula procesul la repornirea sistemului:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • drvsyskit = %APPDATA%\hidires\hidr.exe



Urmatoarele chei sunt adaugate in registri pentru a incarca serviciul la repornirea sistemului:

– [HKLM\SYSTEM\CurrentControlSet\Services\m_hook]
   • Type = dword:00000001
   • Start = dword:00000003
   • ErrorControl = dword:00000000
   • ImagePath = \??\%APPDATA%\hidires\m_hook.sys
   • DisplayName = Empty

– [HKLM\SYSTEM\CurrentControlSet\Services\m_hook\Security]
   • Security = %valori hex%

– [HKLM\SYSTEM\CurrentControlSet\Services\m_hook\Enum]
   • 0 = Root\\LEGACY_M_HOOK\\0000
   • Count = dword:00000001
   • NextInstance = dword:00000001

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK]
   • NextInstance = dword:00000001

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK\0000]
   • Service = m_hook
   • Legacy = dword:00000001
   • ConfigFlags = dword:00000000
   • Class = LegacyDriver
   • ClassGUID = {8ECC055D-047F-11D1-A537-0000F8753ED1}
   • DeviceDesc = Empty

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK\0000\
   Control]
   • *NewlyCreated* = dword:00000000
   • ActiveService = m_hook

 Terminarea proceselor Lista cu procesele oprite:
   • a2guard.exe; aavshield.exe; AckWin32.exe; ADVCHK.EXE; AhnSD.exe;
      airdefense.exe; ALERTSVC.EXE; ALMon.exe; ALOGSERV.EXE; ALsvc.exe;
      amon.exe; Anti-Trojan.exe; AntiVirScheduler; AntiVirService; ANTS.EXE;
      APVXDWIN.EXE; Armor2net.exe; ashAvast.exe; ashDisp.exe; ashEnhcd.exe;
      ashMaiSv.exe; ashPopWz.exe; ashServ.exe; ashSimpl.exe; ashSkPck.exe;
      ashWebSv.exe; aswUpdSv.exe; ATCON.EXE; ATUPDATER.EXE; ATWATCH.EXE;
      AUPDATE.EXE; AUTODOWN.EXE; AUTOTRACE.EXE; AUTOUPDATE.EXE; avciman.exe;
      Avconsol.exe; AVENGINE.EXE; avgamsvr.exe; avgcc.exe; AVGCC32.EXE;
      AVGCTRL.EXE; avgemc.exe; avgfwsrv.exe; AVGNT.EXE; avgntdd; avgntmgr;
      AVGSERV.EXE; AVGUARD.EXE; avgupsvc.exe; avinitnt.exe; AvkServ.exe;
      AVKService.exe; AVKWCtl.exe; AVP.EXE; AVP32.EXE; avpcc.exe; avpm.exe;
      AVPUPD.EXE; AVSCHED32.EXE; avsynmgr.exe; AVWUPD32.EXE; AVWUPSRV.EXE;
      AVXMONITOR9X.EXE; AVXMONITORNT.EXE; AVXQUAR.EXE; BackWeb-4476822.exe;
      bdmcon.exe; bdnews.exe; bdoesrv.exe; bdss.exe; bdsubmit.exe;
      bdswitch.exe; blackd.exe; blackice.exe; cafix.exe; ccApp.exe;
      ccEvtMgr.exe; ccProxy.exe; ccSetMgr.exe; CFIAUDIT.EXE; ClamTray.exe;
      ClamWin.exe; Claw95.exe; Claw95cf.exe; cleaner.exe; cleaner3.exe;
      CliSvc.exe; CMGrdian.exe; cpd.exe; DefWatch.exe; DOORS.EXE;
      DrVirus.exe; drwadins.exe; drweb32w.exe; drwebscd.exe; DRWEBUPW.EXE;
      ESCANH95.EXE; ESCANHNT.EXE; ewidoctrl.exe;
      EzAntivirusRegistrationCheck.exe; F-AGNT95.EXE; F-PROT95.EXE;
      F-Sched.exe; F-StopW.EXE; FAMEH32.EXE; FAST.EXE; FCH32.EXE;
      FireSvc.exe; FireTray.exe; FIREWALL.EXE; fpavupdm.exe; freshclam.exe;
      FRW.EXE; fsav32.exe; fsavgui.exe; fsbwsys.exe; fsdfwd.exe; FSGK32.EXE;
      fsgk32st.exe; fsguiexe.exe; FSM32.EXE; FSMA32.EXE; FSMB32.EXE;
      fspex.exe; fssm32.exe; gcasDtServ.exe; gcasServ.exe;
      GIANTAntiSpywareMain.exe; GIANTAntiSpywareUpdater.exe; GUARD.EXE;
      GUARDGUI.EXE; GuardNT.exe; HRegMon.exe; Hrres.exe; HSockPE.exe;
      HUpdate.EXE; iamapp.exe; iamserv.exe; ICLOAD95.EXE; ICLOADNT.EXE;
      ICMON.EXE; ICSSUPPNT.EXE; ICSUPP95.EXE; ICSUPPNT.EXE; IFACE.EXE;
      INETUPD.EXE; InocIT.exe; InoRpc.exe; InoRT.exe; InoTask.exe;
      InoUpTNG.exe; IOMON98.EXE; isafe.exe; ISATRAY.EXE; ISRV95.EXE;
      ISSVC.exe; JEDI.EXE; KAV.exe; kavmm.exe; KAVPF.exe; KavPFW.exe;
      KAVStart.exe; KAVSvc.exe; KAVSvcUI.EXE; KMailMon.EXE; KPfwSvc.EXE;
      KWatch.EXE; livesrv.exe; LOCKDOWN2000.EXE; LogWatNT.exe; lpfw.exe;
      LUALL.EXE; LUCOMSERVER.EXE; Luupdate.exe; MCAGENT.EXE; mcmnhdlr.exe;
      mcregwiz.exe; Mcshield.exe; MCUPDATE.EXE; mcvsshld.exe; MINILOG.EXE;
      MONITOR.EXE; MonSysNT.exe; MOOLIVE.EXE; MpEng.exe; mpssvc.exe;
      MSMPSVC.exe; myAgtSvc.exe; myagttry.exe; navapsvc.exe; NAVAPW32.EXE;
      NavLu32.exe; NAVW32.EXE; NDD32.EXE; NeoWatchLog.exe; NeoWatchTray.exe;
      NISSERV; NISUM.EXE; NMAIN.EXE; nod32.exe; nod32krn.exe; nod32kui.exe;
      NORMIST.EXE; notstart.exe; npavtray.exe; NPFMNTOR.EXE; npfmsg.exe;
      NPROTECT.EXE; NSCHED32.EXE; NSMdtr.exe; NssServ.exe; NssTray.exe;
      ntrtscan.exe; NTXconfig.exe; NUPGRADE.EXE; NVC95.EXE; Nvcod.exe;
      Nvcte.exe; Nvcut.exe; NWService.exe; OfcPfwSvc.exe; OUTPOST.EXE;
      PAV.EXE; PavFires.exe; PavFnSvr.exe; Pavkre.exe; PavProt.exe;
      pavProxy.exe; pavprsrv.exe; pavsrv51.exe; PAVSS.EXE; pccguide.exe;
      PCCIOMON.EXE; pccntmon.exe; PCCPFW.exe; PcCtlCom.exe; PCTAV.exe;
      PERSFW.EXE; pertsk.exe; PERVAC.EXE; PNMSRV.EXE; POP3TRAP.EXE;
      POPROXY.EXE; prevsrv.exe; PsImSvc.exe; QHM32.EXE; QHONLINE.EXE;
      QHONSVC.EXE; QHPF.EXE; qhwscsvc.exe; RavMon.exe; RavTimer.exe;
      Realmon.exe; REALMON95.EXE; Rescue.exe; rfwmain.exe; Rtvscan.exe;
      RTVSCN95.EXE; RuLaunch.exe; SAVAdminService.exe; SAVMain.exe;
      savprogress.exe; SAVScan.exe; SCAN32.EXE; ScanningProcess.exe;
      sched.exe; sdhelp.exe; SERVIC~1.EXE; SHSTAT.EXE; SiteCli.exe; smc.exe;
      SNDSrvc.exe; SPBBCSvc.exe; SPHINX.EXE; spiderml.exe; spidernt.exe;
      Spiderui.exe; SpybotSD.exe; SPYXX.EXE; SS3EDIT.EXE; stopsignav.exe;
      swAgent.exe; swdoctor.exe; SWNETSUP.EXE; symlcsvc.exe;
      SymProxySvc.exe; SymSPort.exe; SymWSC.exe; SYNMGR.EXE; TAUMON.EXE;
      TBMon.exe; TC.EXE; tca.exe; TCM.EXE; TDS-3.EXE; TeaTimer.exe;
      TFAK.EXE; THAV.EXE; THSM.EXE; Tmas.exe; tmlisten.exe; Tmntsrv.exe;
      TmPfw.exe; tmproxy.exe; TNBUtil.exe; TRJSCAN.EXE; Up2Date.exe;
      UPDATE.EXE; UpdaterUI.exe; upgrepl.exe; Vba32ECM.exe; Vba32ifs.exe;
      vba32ldr.exe; Vba32PP3.exe; VBSNTW.exe; vchk.exe; vcrmon.exe;
      VetTray.exe; VirusKeeper.exe; VPTRAY.EXE; vrfwsvc.exe; VRMONNT.EXE;
      vrmonsvc.exe; vrrw32.exe; VSECOMR.EXE; Vshwin32.exe; vsmon.exe;
      vsserv.exe; VsStat.exe; WATCHDOG.EXE; WebProxy.exe; Webscanx.exe;
      WEBTRAP.EXE; WGFE95.EXE; Winaw32.exe; winroute.exe; winss.exe;
      winssnotify.exe; WRADMIN.EXE; WRCTRL.EXE; xcommsvr.exe; zatutor.exe;
      ZAUINST.EXE; zlclient.exe; zonealarm.exe; _AVP32.EXE; _AVPCC.EXE;
      _AVPM.EXE


Lista cu serviciile dezactivate:
   • Aavmker4; ABVPN2K; ADBLOCK.DLL; ADFirewall; AFWMCL; Ahnlab task
      Scheduler; alerter; AlertManger; AntiVir Service; AntiyFirewall;
      ARP.DLL; aswMon2; aswRdr; aswTdi; aswUpdSv; Ati HotKey Poller; avast!
      Antivirus; avast! Mail Scanner; avast! Web Scanner; AVEService;
      AVExch32Service; AvFlt; Avg7Alrt; Avg7Core; Avg7RsW; Avg7RsXP;
      Avg7UpdSvc; AvgCore; AvgFsh; AVGFwSrv; AvgFwSvr; AvgServ; AvgTdi;
      AVIRAMailService; AVIRAService; avpcc; AVUPDService; AVWUpSrv; AvxIni;
      awhost32; backweb client - 4476822; BackWeb Client - 7681197; backweb
      client-4476822; Bdfndisf; bdftdif; bdss; BlackICE; BsFileSpy;
      BsFirewall; BsMailProxy; CAISafe; ccEvtMgr; ccPwdSvc; ccSetMgr;
      ccSetMgr.exe; CONTENT.DLL; DefWatch; DNSCACHE.DLL; drwebnet; dvpapi;
      dvpinit; ewido security suite control; ewido security suite driver;
      ewido security suite guard; F-Prot Antivirus Update Monitor; F-Secure
      Gatekeeper Handler Starter; firewall; fsbwsys; FSDFWD; FSFW; FSMA;
      FTPFILT.DLL; FwcAgent; fwdrv; Guard NT; HSnSFW; HSnSPro; HTMLFILT.DLL;
      HTTPFILT.DLL; IMAPFILT.DLL; InoRPC; InoRT; InoTask; Ip6Fw; Ip6FwHlp;
      KAVMonitorService; KAVSvc; KLBLMain; KPfwSvc; KWatch3; KWatchSvc;
      MAILFILT.DLL; McAfee Firewall; McAfeeFramework; McShield;
      McTaskManager; mcupdmgr.exe; MCVSRte; Microsoft NetWork FireWall
      Services; MonSvcNT; MpfService; navapsvc; Ndisuio; NDIS_RD; Network
      Associates Log Service; nipsvc; NISSERV; NISUM; NNTPFILT.DLL;
      NOD32ControlCenter; NOD32krn; NOD32Service; Norman NJeeves; Norman
      Type-R; Norman ZANDA; Norton AntiVirus Server; NPDriver; NPFMntor;
      NProtectService; NSCTOP; nvcoas; NVCScheduler; nwclntc; nwclntd;
      nwclnte; nwclntf; nwclntg; nwclnth; NWService; OfcPfwSvc; Outbreak
      Manager; Outpost Firewall; OutpostFirewall; PASSRV; PAVAGENTE;
      PavAtScheduler; PAVDRV; PAVFIRES; PAVFNSVR; Pavkre; PavProc; PavProt;
      PavPrSrv; PavReport; PAVSRV; PCCPFW; PCC_PFW; PersFW; Personal
      Firewall; POP3FILT.DLL; PREVSRV; PROTECT.DLL; PSIMSVC; qhwscsvc; Quick
      Heal Online Protection; ravmon8; RfwService; SAVFMSE; SAVScan;
      SBService; schscnt; SECRET.DLL; SharedAccess; SmcService; SNDSrvc;
      SPBBCSvc; SpiderNT; SweepNet; SWEEPSRV.SYS; Symantec AntiVirus Client;
      Symantec Core LC; The_Hacker_Antivirus; Tmntsrv; TmPfw; tmproxy;
      tmtdi; tm_cfw; T_H_S_M; V3MonNT; V3MonSvc; Vba32ECM; Vba32ifs;
      Vba32Ldr; Vba32PP3; VBCompManService; VexiraAntivirus; VFILT; VisNetic
      AntiVirus Plug-in; vrfwsvc; vsmon; VSSERV; WinAntivirus; WinRoute;
      wuauserv; xcomm

 Tehnologie Rootkit  Este o tehnologie specifica malware. Acesta se ascunde de programele sistemului, de aplicatiile de securitate si in cele din urma, de utilizator.


Ascunde urmatoarele:
– Propriile fisiere
– Propriul proces
– Propria cheie de registru

– Urmatoarele fisiere:
   • filesnames001.exe
   • filesnames002.exe
   • filesnames003.exe
   • filesnames004.exe
   • filesnames005.exe
   • filesnames006.exe

– Urmatoarele procese:
   • filesnamec001.exe
   • filesnamec002.exe
   • filesnamec003.exe
   • filesnamec004.exe
   • filesnamec005.exe
   • filesnamec006.exe

– Urmatoarele chei de registru:
   • nkeyjej1
   • nkeyjej2

– Urmatoarele intrari in registru:
   • key000s01
   • key000s02
   • key000s03
   • key000s04
   • key000s05


Metoda folosita:
    • Ascuns de Windows API

Se ataseaza la urmatoarele functii API:
   • NtCreateFile/ZwCreateFile
   • NtEnumerateKey/ZwEnumerateKey
   • NtEnumerateValueKey/ZwEnumerateValueKey
   • NtQueryDirectoryFile/ZwQueryDirectoryFile
   • NtQueryKey/ZwQueryKey
   • NtQuerySystemInformation/ZwQuerySystemInformation
   • NtQueryValueKey/ZwQueryValueKey

 Detaliile fisierului Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit un program de compresie runtime.

Descripción insertada por Andrei Gherman el miércoles 29 de marzo de 2006
Descripción actualizada por Andrei Gherman el jueves 30 de marzo de 2006

Volver . . . .