Description complète

Nom:	Worm/Rbot.adf.5
La date de la découverte:	27/09/2005
Type:	Ver
En circulation:	Non
Infections signalées	Faible
Potentiel de distribution:	Moyen
Potentiel de destruction:	Moyen
Fichier statique:	Oui
Taille du fichier:	102.400 Octets
Somme de contrôle MD5:	0EEDD051A77802AC874E028A3B412517
Version VDF:	6.32.0.43

Général Méthode de propagation:
   • Le réseau local

Les alias:
   • Kaspersky: Backdoor.Win32.Rbot.adf
   • TrendMicro: WORM_RBOT.CHZ
   • Bitdefender: Backdoor.RBot.616173A4

Plateformes / Systèmes d'exploitation:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Effets secondaires:
   • Il modifie des registres
   • Il emploie les vulnérabilités de software
   • Il vole de l'information
   • Il facilite l'accès non autorisé à l'ordinateur

Fichiers Il s'autocopie dans l'emplacement suivant:
• %SYSDIR%\scrhost.exe

Il supprime sa propre copie, exécutée initialement

Registre Les clés suivantes sont en permanence ajoutées aux registres, dans une boucle infinie, afin de lancer les processus après le redémarrage.

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "Microsoft Windows Update"="scrhost.exe"

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
   • "Microsoft Windows Update"="scrhost.exe"

La clé de registre suivante est ajoutée:

– [HKCU\Software\Microsoft\OLE]
   • "Microsoft Windows Update"="scrhost.exe"

Infection du réseau Afin de assurer sa propagation, le malware essaye de se connecter à d'autres machines comme décrit ci-dessous.

Il s'autocopie dans les partages réseau suivants:
   • D:\
   • C:\
   • ADMIN$
   • IPC$

Il emploie les informations d'identification suivantes afin de gagner accès à la machine distante:

– La liste suivante de noms d'utilisateurs:
   • Zytowski; Zwiers; Zurn; Zucconi; Zoldak; Zerbini; Zegans; Zangwill;
      Zahedi; Zachary; Youk-See; Yoo; Yoffe; Yetiv; Yesson; Yedidia; Ybarra;
      Yates; Yarchuk; Yankee; Yamane; Yacono; Votey; Vorhaus; Woods-Powell;
      Woods; Wooden; Woo; VonHoffman; Wolk; Voigt; Viviani; Vitali; Wilson;
      Willstatter; Villarreal; Wilkinson; Wilkin; Wilk; Wilhelm; Wilder;
      Vignola; Viens; Wiener; Wiedersheim; Viano; Viana; Whittaker; Whitla;
      White; Whilton; Whately; Wetzel; Wescott; Verghese; Venne; Wengret;
      Welsh; Welles; Velasquez; Weissman; Weissbourd; Weinhaus; Weingarten;
      Weighart; Waugh; Vasquez; Wasowska; Warshafsky; Vanheeckeren;
      Vandenberg; VanZwet; vanAllen; Walter; Wallenberg; Wales; Valencia;
      Valberg; Waite; Vacca; Uzuner; Usdan; Urdang-Brown; Urban; Upsdell;
      Untermeyer; Ullman; Tzamarias; Twells; Tuttle; Turek; Turano; Tukan;
      Tudge; Tuck; Tsukurov; Tsomides; Tsiatis; Truss; Troy; Troiani;
      Tringali; Trewin; Trenga; Traebert; Toye; Towler; Torske; Torresi;
      Topulos; Toomer; Tomford; Tolman; Tolls; Tollestrup; Tofallis;
      Timmons; Till; Tierney; Throop; Thomsen; Thisted; Thibault; Theodos;
      Thavaneswaran; Than; Terracini; Tenney; Temmer; Temes; Teague;
      Tcherepnin; Tawn; Taveras; Tatar; Tanowitz; Tandler; Tambiah;
      Talaugon; Tai; Tagiuri; Swindle; Sweetser; Sweeting; Surdam; Suo;
      Sumner; Sullivan; Stringer; Streiff; Strauch; Strange; Stott; Storer;
      Stonich; Stolzenberg; Stockwell; Stockton; Stock; Stillwell; Stiepock;
      Stewart-Oaten; Stepniewska; Stephanian; Steiner; Stefani; Statlender;
      States; Stassinopolus; Stang; Stam; Stalvey; StMartin; Spinrad;
      Spiliotis; Spiegelhalter; Spicer; Sperber; Spence; Speizer; Spaulding;
      Sparrow; Spanier; Soultanian; Soule; Soukup; Sottak; Sorg; Sorabella;
      Sommariva; Somers; Solon; Socolow; Snodgrass; Sniffen; Smilow; Slowe;
      Sloan; Skoda; Skerry; Skane; Sites; Sirilli; Sinsabaugh; Silvetti;
      Silverman; Signa; Sigini; Sigalot; Siesto; Shimon; Shibata; Shia;
      Shesko; Shepstone; Sheppard; Shepherd; Sheats; Shea; Shavelson;
      Shatrov; Shar; Shanley; Shankland; Shakis; Shaikh; Seyfert; Sexton;
      Seterdahl; Sennett; Sen; Selvage; Sekler; Segal; Seeber; Seaton;
      Scudder; Scovel; Schwickrath; Schwan; Schuyler; Schutte; Schuman;
      Schossberger; Schmitt; Schilling; Schifini; Schiano; Scheiner;
      Scharlemann; Scharf; Scepan; Scarponi; Sayied; Sawtell; Satterthwaite;
      Satta; Satin; Sase; Sartore; Sarin; Sapers; Sanna; Sanchez-Ramirez;
      Samson; Sali; Sahu; Safire; Sadler; Sabatello; Ryu; Rush; Ruescher;
      Ruderman; Ruan; Royal; Row; Ronen; Rogers; Roesler; Rocha; Robinson;
      Rivera; Rish; Rineer; Rindos; Rielly; Richmond; Rhea; Resnik; Repetto;
      Renick; Remak; Reinold; Cunningham; Reedquist; Redden-Tyler; Rayport;
      Rapple; Rankin; Rangan; Raney; Rajagopalan; Radeke; Rabkin; Rabe;
      Quetin; Quaday; Pynchon; Pugh; Puccia; Prothrow-Stith; Proietti;
      Pritz; Pritchard; Prevost; Preucel; Presper; Powers; Poolman; Poma;
      Politis; Polanyi; Polak; Poirier; Pointer; Poincaire; Pocobene; Plous;
      Plasket; Plant; Plancon; Pinot; Pilbeam; Pfister; Pettit; Pettibone;
      Petruzello; Peters; Perrimon; Perone; Perna; Perlman; Perlak; Perko;
      Pereira; Penny; Peishel; Pederson; Pearlberg; Peabody; Paynter;
      Pawloski; Pavlon; Pavetti; Pattullo; Patrick; Patefield; Pascucci;
      Partridge; Parris; Parmeggiani; Paoletti; Pantilla; Panizzon;
      Panadero; Palmitesta; Pallara; Palepu; Palayoor; Paine; PaesDealmeida;
      Ovid; Ouchida; Otten; Ottaviani; Ostrowski; Ospina; Orsi; Orfield;
      Oray; Opel; O'meara; Oman; O'malley; Olszewski; Olson; Olsen; Oldford;
      O'hagan; Ogata; Ocougne; Nuzum; Notman; Nitabach; Nisenson; Nickoloff;
      Nickerson; Newlin; Newfeld; Neuman; Nesci; Nenna; Nelson; Nayduch;
      Naviaux; Nardone; Nardi; Napolitano; Naddeo; Mussachio; Mumford;
      Mulroy; Mulkern; Mugnai; Muello; Mudarri; Motooka; Mostafavi; Mosler;
      Mosher; Mortimer; Morrow; Morrison; Moreton; Morani; MooreDeCh.;
      Montilio; Monque; Moiamedi; Mohr; Moeller; Modestino; Mocroft; Mittal;
      Mitropoulos; Gonzalez; Minichiello; Mini; Minh; Mills; Mieher; Middle;
      Michelman; Meurer; Metropolis; Metelka; Merz; Merseth; Merminod;
      Merlani; Merikoski; Menzies; Memisoglu; Meccariello; Mcnulty; Mcnealy;
      Mclaren; Mclane; Mckenna; Mcintosh; McIlroy; Mcgoldrick; Mcghee;
      McFadden; Mcelroy; Mcdowell; Mcclearn; Mccall; Mccaffery; Mcbride;
      Mazziotta; Mazzali; May; Mauzy; Mattson; Matsukata; Matarazzo;
      Matalka; Mass; Marubini; Marton; Martochio; Martinez; Marques;
      Margetts; Margalit; Marcus; Marchbanks; March; Mantovan; Manganiello;
      Mandel; Manalis; Malova; Maller; Malatesta; Maisano; Maine-Hershey;
      Maier; Mahony; Maggio; Madigan; Macy; MacMillan; Mackenney; Macintyre;
      Maceachern; Macdonald; Maccormac; Luzader; Lutcavage; Lussier; Luoma;
      Lunetta; Luecke; Luczkow; Luciano; Lucas; Lubin; Loza; Lowenstein;
      Loveman; Loss; Longworth; Locatelli; Lizardo; Livolsi; Livi;
      Livernash; Litvak; Little; Lipponen; Lippmann; Linzee; Linehan; Line;
      Linder; Linda; Linares; Lim; Lightfoot; Light; Liem; Lidano; Liakos;
      Lessi; Lesser; l'Enclos; Lenard; Leite; Leclercq; Lecce; Lecar;
      Lawless; Lashley; Laserna; Lanzit; Lantieri; Lankes; Landes;
      Lallemant; Laing; Lafler; Labunka; Kuwabara; Kusman; Kumar; Kuenzli;
      Krysiak; Kroemer; Kraus; Krasney; Krailo; Kraemer; Kovaks; Kotter;
      Korzybski; Kool; Konrad; Koniaris; Kommer; Koivumaki; Kohn; Koch;
      Kobrick; Knuff; Klint; Klinkenborg; Kling; Klemperer; Kleinfelder;
      Kleiman; Kleckner; Kittridge; Kirscht; Kippenberger; Kinsley; Kindall;
      Kimura; Kimmett; Kimmel; Khong; Keul; Kerry; Kendall; Kemsley;
      Kempton; Kelsey; Kelker; Keith; Keepper; Keenan; Kee; Kawachi; Kasten;
      Kassower; Karpouzes; Kangis; Kamel; Kalman; Kalinowski; Kalil;
      Kaligian; Kalbfleisch; Kafadar; Kaboolian; Kabbash; Julious; Juliano;
      Jucks; Jorgensen; Jolly; Johns; Johannsen; Johannesson; Jewett;
      Jespersen; Jenkins; Jellis; Jeffers; Jay; Jarrell; Jarnagin;
      Janjigian; Jamil; Jain; Jagoe; Jagger; Jagers; Jackson; Jacenko; Iyer;
      Isserman; Isbill; Isaievych; Isaac; Inniss; Inamura; Igarashi;
      Ichikawa; Iaquinta; Hyde; Hutchings; Hurtubise; Hupp; Huntington;
      Hungerford; Huidekoper; Huey; Hoy; Howard; Hottle; Hostage; Hoshida;
      Horsley; Hopkins; Hooker; Holzman; Holway; Holter; Holoien; Holmes;
      Hokoda; Hokanson; Hoffman; Hoffer; Hock; Hoang; Hitchcock; Hirst;
      Hind; Himmelfarb; Heyeck; Heubert; Hester; Herrera; Hernandez;
      Henrichs; Henery; Hemphill; Helprin; Hellmiss; Hellman; Heiland; Heft;
      Heermans; Hazlewood; Haynes; Hayes; Hawkes; Haviaras; Harwell;
      Hartnett; Hartmann; Hartman; Harrigan; Harlow; Hargraves; Harding;
      Hanssen; Hand; Hammerness; Hamer; Hambarzumjan; Halpert; Hallowell;
      Halkias; Haley; Hackshaw; Hackman; Haar; Guo; Gunn; Guenthart; Gruppe;
      Gruner; Grummell; Grigoletto; Griffiths; Greenfeld; Greenberg;
      Gravell; Gozzi; Goody; Goodearl; Good; Goncalves; Goldfarb; Glendon;
      Glegg; Gleason; Gist; Gillispie; Gill; Gili; Gilbert; Gibson; Gibbens;
      Ghorai; Gerrett; Georgi; Gemberling; Geller; Garonna; Garman;
      Garfield; Gambini; Galwey; Galeotti; Gaggiotti; Gabrielli; Fusaro;
      Furth; Fuller; Fujii-Abe; Frye; Fryberger; Frowiss; Frisken;
      Friedland; Fried; Freundlich; Freid; Frazier-Davis; Franz;
      Franklin-Kenea; Francisco; Fossi; Fossey; Fortier; Fortes; Forester;
      Folks; Flores; Flier; Fitzmaurice; Fisk; Fiorina; Finnegan;
      Finkelstein; Fink; Field; Fido; Feuer; Ferriell; Ferrante; Fernandes;
      Fernald; Feldman; Fejzo; Feigenbaum; Fates; Fasso'; Farren; Farone;
      Faris; Falorsi; Falco-Acosta; Faioes; Fagan; Fabbris; Everett;
      Euripides; Etter; Estes; Espinoza; Erez; Erdos; Erdman; Erbach;
      Eppling; Enyeart; Encinas; Elvis; Elmerick; Elmendorf; Eliasson;
      Eickenhorst; Edward; Edner; Edley; Eckel; Ebeling; Eardley; Dwyer;
      Dussault; Durrett; Duffin; D'souza; Drinker; Dowsland; Doug; Doty;
      Dosi; Dorf; Dore; Doonan; Donner; Donahue; Doherty; Dockery; Dirksen;
      Dionysius; Dilworth; Difronzo; Difabio; Diefenbach; Dicks; D'fini;
      Deutsch; Desombre; Denison; Denham; Denault; Demusz; Dempster; Deming;
      Dell'acqua; Delger; Deleon-Rendon; Delattre; Defeciani; Dees; Debroff;
      deRousse; del'Enclos; DeLaPena; DeGennaro; Dawkins; David; Daskalu;
      Dasgupta; Das; D'arcangelo; Dapice; Dante; Danieli; D'Ambra; Daly;
      Daldalian; daSilva; Cyders; Cvek; Cutler; Currier; Cui; Croxton;
      Croxen; Croshaw; Crocker; Crawford; Coutaux; Counter; Cosmides;
      Cornish; Corey; Connors; Condodina; Concino; Comstock; Compton;
      Collis; Collard; Colella; Coldren; Coito; Coblenz; Clow; Clifton;
      Clement; Clark; Clancy; Claffey; Cifarelli; Cicero; Ciampaglia;
      Church; Chupasko; Chu; Christopher; Christie; Christiano; Christian;
      Christenson; Chinman; Chinipardaz; Childs; Childress; Chien;
      Chiassino; Chervinsky; Cherry; Cheang; Charles; Chapman; Cerioli;
      Ceniceros; Cavell; Cavanagh; Castelda; Caspar; Case; Cascio; Cartmill;
      Carper; Caroti; Carmichael; Carlyle; Carlos; Carlin; Carayannopoulos;
      Caratozzolo; Capursi; Cappuccio; Capodilupo; Capocaccia; Caperton;
      Capanni; Canley; Cammilleri; Cammelli; Calnan; Cage; Byrd; Byerly;
      Byatt; Busetta; Burridge; Burke; Burdzy; Burden; Bunton; Bullard;
      Budding; Buchan; Brzycki; Brook; Broca; Britz; Brinton; Bridges;
      Bridgeman; Brewer; Brennan; Brenan; Breed; Brecht; Bradach; Bradac;
      Bracalente; Boyne; Boym; Boyland; Boyes; Boyajian; Boxer; Bowers;
      Bourneuf; Boudrot; Boudin; Botosh; Bothman; Bossi; Borden; Borack;
      Boorstin; Boone; Bookbinder; Book; Bontempo; Boniface; Bonham; Boner;
      Bologna; Bollinger; Bolick; Bolger; Blyth; Bloxham; Bloemhof;
      Bloembergen; Bloch; Blizard; Bliss; Blanke; Blakemore; Blagg;
      Blackwell; Blackbourn; Bisho; Bisema; Bir; Binion; Bickel; Biagioli;
      Beynart; Betti; Berrizbeitia; Bernston; Bernassola; Bernardo;
      Berke-Jenkins; Bergson; Benedict-Dye; Belloc; Bellini; Bellhouse;
      Bellavance; Belin-Collart; Belfer; Belaoussof; Belanger; Behenna;
      Bedford; Beder; Beckman; Bean; Beal; Beacon; Bayo; Bayles; Baumiller;
      Batchelder; Bashevis; Basavappa; Bartoo; Bartolome; Bartholomew;
      Barry; Barriola; Barnett; Barneson; Barbetti; Barberi; Baranowska;
      Baranczak; Barajas; Barabesi; Banta; Baltz; Ballew; Ballatori; Baleja;
      Bakanowsky; Bailar; Bagnold; Baglivo; Bady; Backus; Bachmuth; Azima;
      Ayling; Aykroyd; Ayiemba; Axworthy; Axelrod; Aurelius; Augustus;
      Atkins; Arky; Arjas; Aristotle; Arellano; Arduini; Arbia; Antos;
      Anthony; Ansley; Anfinrud; Andron; Andrelus; Ando; Andel; Anand;
      Amsden; Ameer; Amatangelo; Amaral; Altenhofen; Altenberger; Altavilla;
      Alongi; Allison; Aleks; Alda; Alcorn; Alavi; Ahlers; Adorno; Adibe;
      Adelstein; Addison; Adams; Ackerman; Abdulrazak

– La liste suivante de mots de passe:
   • intranet; lan; main; winpass; blank; office; control; nokia; siemens;
      compaq; dell; cisco; ibm; orainstall; sqlpassoainstall; sql; db1234;
      db1; databasepassword; data; databasepass; dbpassword; dbpass; access;
      domainpassword; domainpass; domain; hello; hell; god; sex; slut;
      bitch; fuck; exchange; backup; technical; loginpass; login; mary;
      katie; kate; george; eric; chris; ian; neil; lee; brian; susan; sue;
      sam; luke; peter; john; mike; bill; fred; joe; jen; bob; qwe; zxc;
      asd; qaz; win2000; winnt; winxp; win2k; win98; windows; oeminstall;
      oemuser; oem; user; homeuser; home; accounting; accounts; internet;
      www; web; outlook; mail; qwerty; null; server; system; changeme;
      linux; unix; demo; none; test; 2004; 2003; 2002; 2001; 2000;
      1234567890; 123456789; 12345678; 1234567; 123456; 12345; 1234; 123;
      007; pwd; pass; pass1234; passwd; password; password1; adm; db2;
      oracle; dba; database; default; guest; wwwadmin; teacher; student;
      owner; computer; staff; admins; administrat; administrateur;
      administrador; administrator

La vulnérabilité:
Il se sert des vulnérabilités suivantes:
– MS02-018 (Patch for Internet Information Service)
– MS02-061 (Elevation of Privilege in SQL Server Web)
– MS03-049 (Buffer Overrun in the Workstation Service)
– MS04-007 (ASN.1 Vulnerability)
– MS05-039 (Vulnerability in Plug and Play)
– La porte dérobée Bagle (port 2745)
– La porte dérobée Kuang (port 17300)
– La porte dérobée Mydoom (port 3127)
– La porte dérobée NetDevil (port 903)
– La porte dérobée Optix (port 3140)
– La porte dérobée SubSeven (port 27347)
– Le contrôle à distance DameWare (port 6129)

Le processus d'infection:
Il crée un script FTP sur la machine compromise afin de télécharger le malware vers l'emplacement distant.

Ralentissement de connexion:
–Il crée de multiples fils d'infection.
– Selon la largeur de votre bande passante, il est possible d'avoir une baisse de votre vitesse de réseau. Car comme l'activité réseau de ce malware est moyen il est possible qu'il ne soit pas détecter si vous avez une connexion à haut débit.
– Il est également possible de remarquer un léger ralentissement du système dû aux multiples fils d'exécution créés en réseau.

IRC Afin de fournir des informations sur le système et un accès à distance, il se connecte au serveur IRC suivant:

Serveur: suksa.**********.com
Port: 28555
Canal: #r1
Pseudonyme: r%chaîne de caractères aléatoire de 10 digits%
Mot de passe: ahraz

– Ce Malware a la capacité de ramasser et d'envoyer des informations tel que:
    • Les mots de passe en antémémoire:
    • Capture de web caméra
    • Vitesse du CPU
    • Utilisateur courant
    • Espace libre sur le disque dur
    • Mémoire libre
    • Le temps de fonctionnement du Malware
    • Information sur le réseau
    • Information sur des processus courants
    • Taille de mémoire
    • Répertoire de système
    • Nom d'utilisateur
    • Répertoire de Windows

– Ensuite il a la capacité d'opérer des actions tel que:
    • Lancer des attaques DDoS ICMP
    • Lancer des attaques DDoS SYN
    • Lance des attaques DDoS TCP
    • Lance des attaques DDoS UDP
    • Désactiver DCOM
    • Désactiver les partages réseau
    • Télécharger un fichier
    • Activer DCOM
    • Activer les partages réseau
    • Exécuter un fichier
    • Joindre le canal IRC
    • Finir le processus
    • Quitter la canal IRC
    • Ouvrir une ligne de commande à distance
    • Opérer un attaque DDoS
    • Scanner le réseau
    • Opérer la redirection d'un certain port
    • Envoyer des e-mails
    • Commence le keylog
    • Démarrer une routine de propagation
    • Terminer un processus
    • Se mettre à jour tout seul
    • Charger un fichier
    • Visiter un site web

Arrêt de processus: La liste des processus qui sont terminés:
   • i11r54n4.exe; irun4.exe; d3dupdate.exe; rate.exe; ssate.exe;
      winsys.exe; winupd.exe; SysMonXP.exe; bbeagle.exe; Penis32.exe;
      mscvb32.exe; sysinfo.exe; PandaAVEngine.exe; F-AGOBOT.EXE;
      HIJACKTHIS.EXE; _AVPM.EXE; _AVPCC.EXE; _AVP32.EXE; ZONEALARM.EXE;
      ZONALM2601.EXE; ZATUTOR.EXE; ZAPSETUP3001.EXE; ZAPRO.EXE;
      XPF202EN.EXE; WYVERNWORKSFIREWALL.EXE; WUPDT.EXE; WUPDATER.EXE;
      WSBGATE.EXE; WRCTRL.EXE; WRADMIN.EXE; WNT.EXE; WNAD.EXE; WKUFIND.EXE;
      WINUPDATE.EXE; WINTSK32.EXE; WINSTART001.EXE; WINSTART.EXE;
      WINSSK32.EXE; WINSERVN.EXE; WINRECON.EXE; WINPPR32.EXE; WINNET.EXE;
      WINMAIN.EXE; WINLOGIN.EXE; WININITX.EXE; WININIT.EXE; WININETD.EXE;
      WINDOWS.EXE; WINDOW.EXE; WINACTIVE.EXE; WIN32US.EXE; WIN32.EXE;
      WIN-BUGSFIX.EXE; WIMMUN32.EXE; WHOSWATCHINGME.EXE; WGFE95.EXE;
      WFINDV32.EXE; WEBTRAP.EXE; WEBSCANX.EXE; WEBDAV.EXE; WATCHDOG.EXE;
      W9X.EXE; W32DSM89.EXE; VSWINPERSE.EXE; VSWINNTSE.EXE; VSWIN9XE.EXE;
      VSSTAT.EXE; VSMON.EXE; VSMAIN.EXE; VSISETUP.EXE; VSHWIN32.EXE;
      VSECOMR.EXE; VSCHED.EXE; VSCENU6.02D30.EXE; VSCAN40.EXE; VPTRAY.EXE;
      VPFW30S.EXE; VPC42.EXE; VPC32.EXE; VNPC3000.EXE; VNLAN300.EXE;
      VIRUSMDPERSONALFIREWALL.EXE; VIR-HELP.EXE; VFSETUP.EXE; VETTRAY.EXE;
      VET95.EXE; VET32.EXE; VCSETUP.EXE; VBWINNTW.EXE; VBWIN9X.EXE;
      VBUST.EXE; VBCONS.EXE; VBCMSERV.EXE; UTPOST.EXE; UPGRAD.EXE;
      UPDATE.EXE; UPDAT.EXE; UNDOBOOT.EXE; TVTMD.EXE; TVMD.EXE; TSADBOT.EXE;
      TROJANTRAP3.EXE; TRJSETUP.EXE; TRJSCAN.EXE; TRICKLER.EXE; TRACERT.EXE;
      TITANINXP.EXE; TITANIN.EXE; TGBOB.EXE; TFAK5.EXE; TFAK.EXE;
      TEEKIDS.EXE; TDS2-NT.EXE; TDS2-98.EXE; TDS-3.EXE; TCM.EXE; TCA.EXE;
      TC.EXE; TBSCAN.EXE; TAUMON.EXE; TASKMON.EXE; TASKMO.EXE; TASKMG.EXE;
      SYSUPD.EXE; SYSTEM32.EXE; SYSTEM.EXE; SYSEDIT.EXE; SYMTRAY.EXE;
      SYMPROXYSVC.EXE; SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE; SWEEP95.EXE;
      SVSHOST.EXE; SVCHOSTS.EXE; SVCHOSTC.EXE; SVC.EXE; SUPPORTER5.EXE;
      SUPPORT.EXE; SUPFTRL.EXE; STCLOADER.EXE; START.EXE; ST2.EXE;
      SSG_4104.EXE; SSGRATE.EXE; SS3EDIT.EXE; SRNG.EXE; SREXE.EXE;
      SPYXX.EXE; SPOOLSV32.EXE; SPOOLCV.EXE; SPOLER.EXE; SPHINX.EXE;
      SPF.EXE; SPERM.EXE; SOFI.EXE; SOAP.EXE; SMSS32.EXE; SMS.EXE; SMC.EXE;
      SHOWBEHIND.EXE; SHN.EXE; SHELLSPYINSTALL.EXE; SH.EXE; SGSSFW32.EXE;
      SFC.EXE; SETUP_FLOWPROTECTOR_US.EXE; SETUPVAMEEVAL.EXE; SERVLCES.EXE;
      SERVLCE.EXE; SERVICE.EXE; SERV95.EXE; SD.EXE; SCVHOST.EXE; SCRSVR.EXE;
      SCRSCAN.EXE; SCANPM.EXE; SCAN95.EXE; SCAN32.EXE; SCAM32.EXE; SC.EXE;
      SBSERV.EXE; SAVENOW.EXE; SAVE.EXE; SAHAGENT.EXE; SAFEWEB.EXE;
      RUXDLL32.EXE; RUNDLL16.EXE; RUNDLL.EXE; RUN32DLL.EXE; RULAUNCH.EXE;
      RTVSCN95.EXE; RTVSCAN.EXE; RSHELL.EXE; RRGUARD.EXE; RESCUE32.EXE;
      RESCUE.EXE; REGEDT32.EXE; REGEDIT.EXE; REGED.EXE; REALMON.EXE;
      RCSYNC.EXE; RB32.EXE; RAY.EXE; RAV8WIN32ENG.EXE; RAV7WIN.EXE;
      RAV7.EXE; RAPAPP.EXE; QSERVER.EXE; QCONSOLE.EXE; PVIEW95.EXE;
      PUSSY.EXE; PURGE.EXE; PSPF.EXE; PROTECTX.EXE; PROPORT.EXE;
      PROGRAMAUDITOR.EXE; PROCEXPLORERV1.0.EXE; PROCESSMONITOR.EXE;
      PROCDUMP.EXE; PRMVR.EXE; PRMT.EXE; PRIZESURFER.EXE; PPVSTOP.EXE;
      PPTBC.EXE; PPINUPDT.EXE; POWERSCAN.EXE; PORTMONITOR.EXE;
      PORTDETECTIVE.EXE; POPSCAN.EXE; POPROXY.EXE; POP3TRAP.EXE; PLATIN.EXE;
      PINGSCAN.EXE; PGMONITR.EXE; PFWADMIN.EXE; PF2.EXE; PERSWF.EXE;
      PERSFW.EXE; PERISCOPE.EXE; PENIS.EXE; PDSETUP.EXE; PCSCAN.EXE;
      PCIP10117_0.EXE; PCFWALLICON.EXE; PCDSETUP.EXE; PCCWIN98.EXE;
      PCCWIN97.EXE; PCCNTMON.EXE; PCCIOMON.EXE; PCC2K_76_1436.EXE;
      PCC2002S902.EXE; PAVW.EXE; PAVSCHED.EXE; PAVPROXY.EXE; PAVCL.EXE;
      PATCH.EXE; PANIXK.EXE; PADMIN.EXE; OUTPOSTPROINSTALL.EXE;
      OUTPOSTINSTALL.EXE; OUTPOST.EXE; OTFIX.EXE; OSTRONET.EXE;
      OPTIMIZE.EXE; ONSRVR.EXE; OLLYDBG.EXE; NWTOOL16.EXE; NWSERVICE.EXE;
      NWINST4.EXE; NVSVC32.EXE; NVC95.EXE; NVARCH16.EXE; NUPGRADE.EXE;
      NUI.EXE; NTXconfig.EXE; NTVDM.EXE; NTRTSCAN.EXE; NT.EXE; NSUPDATE.EXE;
      NSTASK32.EXE; NSSYS32.EXE; NSCHED32.EXE; NPSSVC.EXE; NPSCHECK.EXE;
      NPROTECT.EXE; NPFMESSENGER.EXE; NPF40_TW_98_NT_ME_2K.EXE;
      NOTSTART.EXE; NORTON_INTERNET_SECU_3.0_407.EXE; NORMIST.EXE;
      NOD32.EXE; NMAIN.EXE; NISUM.EXE; NISSERV.EXE; NETUTILS.EXE;
      NETSTAT.EXE; NETSPYHUNTER-1.2.EXE; NETSCANPRO.EXE; NETMON.EXE;
      NETINFO.EXE; NETD32.EXE; NETARMOR.EXE; NEOWATCHLOG.EXE;
      NEOMONITOR.EXE; NDD32.EXE; NCINST4.EXE; NC2000.EXE; NAVWNT.EXE;
      NAVW32.EXE; NAVSTUB.EXE; NAVNT.EXE; NAVLU32.EXE;
      NAVENGNAVEX15.NAVLU32.EXE; NAVDX.EXE; NAVAPW32.EXE; NAVAPSVC.EXE;
      NAVAP.NAVAPSVC.EXE; AUTO-PROTECT.NAV80TRY.EXE; NAV.EXE; N32SCANW.EXE;
      MWATCH.EXE; MU0311AD.EXE; MSVXD.EXE; MSSYS.EXE; MSSMMC32.EXE;
      MSMSGRI32.EXE; MSMGT.EXE; MSLAUGH.EXE; MSINFO32.EXE; MSIEXEC16.EXE;
      MSDOS.EXE; MSDM.EXE; MSCONFIG.EXE; MSCMAN.EXE; MSCCN32.EXE;
      MSCACHE.EXE; MSBLAST.EXE; MSBB.EXE; MSAPP.EXE; MRFLUX.EXE;
      MPFTRAY.EXE; MPFSERVICE.EXE; MPFAGENT.EXE; MOSTAT.EXE; MOOLIVE.EXE;
      MONITOR.EXE; MMOD.EXE; MINILOG.EXE; MGUI.EXE; MGHTML.EXE; MGAVRTE.EXE;
      MGAVRTCL.EXE; MFWENG3.02D30.EXE; MFW2EN.EXE; MFIN32.EXE; MD.EXE;
      MCVSSHLD.EXE; MCVSRTE.EXE; MCUPDATE.EXE; MCTOOL.EXE; MCSHIELD.EXE;
      MCMNHDLR.EXE; MCAGENT.EXE; MAPISVC32.EXE; LUSPT.EXE; LUINIT.EXE;
      LUCOMSERVER.EXE; LUAU.EXE; LUALL.EXE; LSETUP.EXE; LORDPE.EXE;
      LOOKOUT.EXE; LOCKDOWN2000.EXE; LOCKDOWN.EXE; LOCALNET.EXE; LOADER.EXE;
      LNETINFO.EXE; LDSCAN.EXE; LDPROMENU.EXE; LDPRO.EXE; LDNETMON.EXE;
      LAUNCHER.EXE; KILLPROCESSSETUP161.EXE; KERNEL32.EXE;
      KERIO-WRP-421-EN-WIN.EXE; KERIO-WRL-421-EN-WIN.EXE;
      KERIO-PF-213-EN-WIN.EXE; KEENVALUE.EXE; KAZZA.EXE; KAVPF.EXE;
      KAVPERS40ENG.EXE; KAVLITE40ENG.EXE; JEDI.EXE; JDBGMRG.EXE; JAMMER.EXE;
      ISTSVC.EXE; ISRV95.EXE; ISASS.EXE; IRIS.EXE; IPARMOR.EXE; IOMON98.EXE;
      INTREN.EXE; INTDEL.EXE; INIT.EXE; INFWIN.EXE; INFUS.EXE; INETLNFO.EXE;
      IFW2000.EXE; IFACE.EXE; IEXPLORER.EXE; IEDRIVER.EXE; IEDLL.EXE;
      IDLE.EXE; ICSUPPNT.EXE; ICSUPP95.EXE; ICMON.EXE; ICLOADNT.EXE;
      ICLOAD95.EXE; IBMAVSP.EXE; IBMASN.EXE; IAMSTATS.EXE; IAMSERV.EXE;
      IAMAPP.EXE; HXIUL.EXE; HXDL.EXE; HWPE.EXE; HTPATCH.EXE; HTLOG.EXE;
      HOTPATCH.EXE; HOTACTIO.EXE; HBSRV.EXE; HBINST.EXE;
      HACKTRACERSETUP.EXE; GUARDDOG.EXE; GUARD.EXE; GMT.EXE; GENERICS.EXE;
      GBPOLL.EXE; GBMENU.EXE; GATOR.EXE; FSMB32.EXE; FSMA32.EXE; FSM32.EXE;
      FSGK32.EXE; FSAV95.EXE; FSAV530WTBYB.EXE; FSAV530STBYB.EXE;
      FSAV32.EXE; FSAV.EXE; FSAA.EXE; FRW.EXE; FPROT.EXE; FP-WIN_TRIAL.EXE;
      FP-WIN.EXE; FNRB32.EXE; FLOWPROTECTOR.EXE; FIREWALL.EXE; FINDVIRU.EXE;
      FIH32.EXE; FCH32.EXE; FAST.EXE; FAMEH32.EXE; F-STOPW.EXE;
      F-PROT95.EXE; F-PROT.EXE; F-AGNT95.EXE; EXPLORE.EXE; EXPERT.EXE;
      EXE.AVXW.EXE; EXANTIVIRUS-CNET.EXE; EVPN.EXE; ETRUSTCIPE.EXE;
      ETHEREAL.EXE; ESPWATCH.EXE; ESCANV95.EXE; ESCANHNT.EXE; ESCANH95.EXE;
      ESAFE.EXE; ENT.EXE; EMSW.EXE; EFPEADM.EXE; ECENGINE.EXE; DVP95_0.EXE;
      DVP95.EXE; DSSAGENT.EXE; DRWEBUPW.EXE; DRWEB32.EXE; DRWATSON.EXE;
      DPPS2.EXE; DPFSETUP.EXE; DPF.EXE; DOORS.EXE; DLLREG.EXE; DLLCACHE.EXE;
      DIVX.EXE; DEPUTY.EXE; DEFWATCH.EXE; DEFSCANGUI.EXE; DEFALERT.EXE;
      DCOMX.EXE; DATEMANAGER.EXE; Claw95.EXE; CWNTDWMO.EXE; CWNB181.EXE;
      CV.EXE; CTRL.EXE; CPFNT206.EXE; CPF9X206.EXE; CPD.EXE;
      CONNECTIONMONITOR.EXE; CMON016.EXE; CMGRDIAN.EXE; CMESYS.EXE;
      CMD32.EXE; CLICK.EXE; CLEANPC.EXE; CLEANER3.EXE; CLEANER.EXE;
      CLEAN.EXE; CLAW95CF.EXE; CFINET32.EXE; CFINET.EXE; CFIAUDIT.EXE;
      CFIADMIN.EXE; CFGWIZ.EXE; CFD.EXE; CDP.EXE; CCPXYSVC.EXE;
      CCEVTMGR.EXE; CCAPP.EXE; BVT.EXE; BUNDLE.EXE; BS120.EXE; BRASIL.EXE;
      BPC.EXE; BORG2.EXE; BOOTWARN.EXE; BOOTCONF.EXE; BLSS.EXE;
      BLACKICE.EXE; BLACKD.EXE; BISP.EXE; BIPCPEVALSETUP.EXE; BIPCP.EXE;
      BIDSERVER.EXE; BIDEF.EXE; BELT.EXE; BEAGLE.EXE; BD_PROFESSIONAL.EXE;
      BARGAINS.EXE; BACKWEB.EXE; AVXQUAR.EXE; AVXMONITORNT.EXE;
      AVXMONITOR9X.EXE; AVWUPSRV.EXE; AVWUPD32.EXE; AVWUPD.EXE; AVWINNT.EXE;
      AVWIN95.EXE; AVSYNMGR.EXE; AVSCHED32.EXE; AVPUPD.EXE; AVPTC32.EXE;
      AVPM.EXE; AVPDOS32.EXE; AVPCC.EXE; AVP32.EXE; AVP.EXE; AVNT.EXE;
      AVLTMAIN.EXE; AVKWCTl9.EXE; AVKSERVICE.EXE; AVKSERV.EXE; AVKPOP.EXE;
      AVGW.EXE; AVGUARD.EXE; AVGSERV9.EXE; AVGSERV.EXE; AVGNT.EXE;
      AVGCTRL.EXE; AVGCC32.EXE; AVE32.EXE; AVCONSOL.EXE; AUTOUPDATE.EXE;
      AUTOTRACE.EXE; AUTODOWN.EXE; AUPDATE.EXE; AU.EXE; ATWATCH.EXE;
      ATUPDATER.EXE; ATRO55EN.EXE; ATGUARD.EXE; ATCON.EXE; ARR.EXE;
      APVXDWIN.EXE; APLICA32.EXE; APIMONITOR.EXE; ANTS.EXE; ANTIVIRUS.EXE;
      ANTI-TROJAN.EXE; AMON9X.EXE; ALOGSERV.EXE; ALEVIR.EXE; ALERTSVC.EXE;
      AGENTW.EXE; AGENTSVR.EXE; ADVXDWIN.EXE; ADAWARE.EXE; ACKWIN32.EXE

Informations divers Mutex:
Il crée le Mutex suivant:
• 1

Détails de fichier Langage de programmation:
Le fichier a été écrit en MS Visual C++.

Logiciel de compression des fichiers exécutables:
Pour entraver la détection et pour réduire la taille du fichier il est compressé avec les logiciels de compression des exécutables suivants:
• PE_Patch
• NSPack

Description insérée par Andrei Gherman le mercredi 28 septembre 2005
Description mise à jour par Andrei Gherman le lundi 3 octobre 2005

Retour . . . .