Besoin d’aide ? Fais appel à la communauté ou embauche un spécialiste.
Aller à Avira Answers
Virus:TR/Injector.tcc
Type:Trojan
In the wild:No
Reported Infections:Low
Distribution Potential:Low to medium
Damage Potential:Medium
File size:936448 Bytes
MD5 checksum:98f74b530d4ebf6850c4bc193c558a98

 General Methods of propagation:
    Autorun feature
   • Local network
    Messenger


Aliases:
   •  Kaspersky: Trojan.Win32.Bublik.iza
   •  Eset: Win32/Dorkbot.B worm
     GData: Trojan.Generic.KDV.750144
     DrWeb: BackDoor.IRC.NgrBot.42


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003
    Windows Vista
    Windows Server 2008
    Windows 7


Side effects:
    Can be used to modify system settings that allow or augment potential malware behaviour.
   • Registry modification

 Files It copies itself to the following location:
   • %appdata%\%six-digit random character string%.exe



The following file is created:

%appdata%\%1 digit random character string%.exe Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too.

 Registry One of the following values is added in order to run the process after reboot:

  [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "Bwzizj"="%appdata%\%six-digit random character string%.exe"

 Miscellaneous Internet connection:
In order to check for its internet connection the following DNS servers are contacted:
   • s177.hot**********.com
   • venus.time**********.pl


Event handler:
It creates the following Event handlers:
   • ReadProcessMemory
   • WriteProcessMemory
   • CreateRemoteThread
   • InternetReadFile
   • URLDownlaodToFile
   • InternetOpenURL
   • InternetOpen
   • CreateFile
   • GetAsyncKeyState


String:
Furthermore it contains the following strings:
   • SYN]: Starting flood on "%s:%d" for %d second(s)
   • UDP]: Starting flood on "%s:%d" for %d second(s)
   • HTTP]: Updated HTTP spread interval to "%s"
   • MSN]: Updated MSN spread message to "%s
   • facebook.*/ajax/chat/send.php*
   • friendster.*/sendmessage.php*
   • secure.logmein.*/*logincheck*
   • google.*/*ServiceLoginAuth*
   • screenname.aol.*/login.psp*
   • sms4file.com/*/signin-do*
   • vip-file.com/*/signin-do*
   • moneybookers.*/*login.pl
   • torrentleech.org/*login*
   • webnames.ru/*user_login*
   • bigstring.*/*index.php*
   • login.live.*/*post.srf*
   • depositfiles.*/*/login*
   • thepiratebay.org/login*
   • MSN-> Message Pwned :)!
   • MSN-> Done, MSG is sent
   • DNS]: Blocked DNS "%s"
   • login.yahoo.*/*login*
   • facebook.*/login.php*
   • runescape*/*weblogin*
   • mediafire.com/*login*
   • vkontakte.ru/api.php
   • friendster.*/rpc.php
   • icon=shell32.dll,7
   • steampowered*/login*
   • twitter.com/sessions
   • megaupload.*/*login*
   • sendspace.com/login*
   • 4shared.com/login*
   • hotfile.com/login*
   • netflix.com/*ogin*
   • godaddy.com/login*

 File details Programming language:
The malware program was written in Borland C++.

Description insérée par Wensin Lee le lundi 8 octobre 2012
Description mise à jour par Wensin Lee le lundi 8 octobre 2012

Retour . . . .
https:// Cet écran est crypté pour votre sécurité.