TR/Dldr.Bagle.NK - Trojan

A voir aussi

Brève description

Description complète

Statistiques

Nom:	TR/Dldr.Bagle.NK
La date de la découverte:	15/04/2008
Type:	Cheval de Troie
Sous type:	Downloader
En circulation:	Oui
Infections signalées	Faible a moyen
Potentiel de distribution:	Faible
Potentiel de destruction:	Moyen
Fichier statique:	Oui
Taille du fichier:	684.032 Octets
Somme de contrôle MD5:	1ad002e1307bc480ee2c111e45fc2498
Version IVDF:	7.00.03.170

Général Méthode de propagation:
   • Il ne possède pas de propre routine de propagation

Les alias:
   • Kaspersky: Trojan-Downloader.Win32.Bagle.nk
   • F-Secure: Trojan-Downloader.Win32.Bagle.nk
   • Grisoft: I-Worm/Bagle.AKB
   • Bitdefender: Trojan.Bagle.DV

Plateformes / Systèmes d'exploitation:
   • Windows 96
   • Windows 99
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Effets secondaires:
   • Arrêt les applications de sécurité
   • Il télécharge des fichiers
   • Il diminue les réglages de sécurité
   • Il modifie des registres

Immédiatement après l'exécution l'information suivante est affichée:

Fichiers Il s'autocopie dans les emplacements suivants:
   • %SYSDIR%\drivers\hldrrr.exe
   • %SYSDIR%\drivers\mdelk.exe

Il écrase un fichier.
– \%inconnu%.exe

Avec le contenu suivant:
   • %le fichier exécuté%

Il essaie de télécharger un ficher:

– Les emplacements sont les suivants:
   • http://62.193.236.47/images/**********
   • http://66.165.182.166/images/**********
   • http://abservices.es/images/**********
   • http://addexo.com/images/**********
   • http://agenciahispanoamericana.net/images/**********
   • http://agmagazine.com.ar/images/**********
   • http://alugil.es/images/**********
   • http://appartamentitropea.com/images/**********
   • http://ar-dna.nazwa.pl/images/**********
   • http://atlas-developpement.com/images/**********
   • http://aultimahora.com.ar/images/**********
   • http://bittersweet.pl/images/**********
   • http://borkowsk.webd.pl/images/**********
   • http://bungalowsdelsol.com/images/**********
   • http://capriiateclube.com.br/images/**********
   • http://carada.it/images/**********
   • http://cestiregalo.altervista.org/images/**********
   • http://coltplus.bremen.tw/images/**********
   • http://delarte.p1718.futuro.pl/images/**********
   • http://delzacc.com.ar/images/**********
   • http://digisave.ch/images/**********
   • http://djstoned.dj.funpic.de/images/**********
   • http://e314.de/images/**********
   • http://elmartinet.cat/images/**********
   • http://empresariosmineros.com/images/**********
   • http://eskandaie.com/images/**********
   • http://evelya.es/images/**********
   • http://faciltecnologias.com.br/images/**********
   • http://foroantiguo.acuariofilia.net/images/**********
   • http://gelezis.lt/images/**********
   • http://habboaccesstaff.altervista.org/images/**********
   • http://hacedoresmendoza.altervista.org/images/**********
   • http://heniek.w.tkb.pl/images/**********
   • http://henryglass.it/images/**********
   • http://hostingpuebla.com/images/**********
   • http://iescanpuig.cat/images/**********
   • http://imaseo.com/images/**********
   • http://indianwintersports.com/images/**********
   • http://ivanrusso.com.ar/images/**********
   • http://jillclicks.info/images/**********
   • http://kaosconcept.net/images/**********
   • http://karlsgarten.de/images/**********
   • http://kinesis-gym.gr/images/**********
   • http://ladeira.com.br/images/**********
   • http://laruedespavots.org/images/**********
   • http://lisac.si/images/**********
   • http://llar-llibre.com/images/**********
   • http://malasommamarco.com/images/**********
   • http://margotmedia.com/images/**********
   • http://mariage-tunisien.com/images/**********
   • http://monilove.credors.pl/images/**********
   • http://motto.com.pl/images/**********
   • http://mwiktor.nazwa.pl/images/**********
   • http://nasko.com.br/images/**********
   • http://nzj.home.pl/images/**********
   • http://oab-niteroi.org/images/**********
   • http://parodiario.tv/images/**********
   • http://pc-hard.com/images/**********
   • http://perfumeria-online.pl/images/**********
   • http://pflanzenoase.pf.funpic.de/images/**********
   • http://projetoecotour.com.br/images/**********
   • http://rainy.ir/images/**********
   • http://realisations.net/images/**********
   • http://recinservices.com/images/**********
   • http://ringingcedarsusa.com/images/**********
   • http://robert.startime.at/images/**********
   • http://roupenboghossian.com/images/**********
   • http://rubios-gay.info/images/**********
   • http://rycsim.fr/images/**********
   • http://s144758003.onlinehome.fr/images/**********
   • http://shop-toyru.125.com1.ru/images/**********
   • http://sminco.nazwa.pl/images/**********
   • http://solar-protec.com/images/**********
   • http://spainontv.com/images/**********
   • http://statosphere.info/images/**********
   • http://strzelectwo.lodz.pl/images/**********
   • http://studiavanti.nl/images/**********
   • http://surlabouche.biz/images/**********
   • http://surtel.com.br/images/**********
   • http://tanja-grimm.eu/images/**********
   • http://taximan.fi/images/**********
   • http://test.olivierdesforges.fr/images/**********
   • http://toshiba-tvru.112.com1.ru/images/**********
   • http://transwalkers.com/images/**********
   • http://tus-fussball.com/images/**********
   • http://von-hiss.com/images/**********
   • http://wallat-knauth.de/images/**********
   • http://web4.vs165183.vserver.de/images/**********
   • http://wischalla.de/images/**********
   • http://www.adiscart.com/images/**********
   • http://www.aguirre-inc.com/images/**********
   • http://www.altmannsports.ch/images/**********
   • http://www.avalonvillarrubia.com/images/**********
   • http://www.azionecattolicamessina.it/images/**********
   • http://www.bagnoz.com/images/**********
   • http://www.bellazura.com/images/**********
   • http://www.cnc-steuerung.de/images/**********
   • http://www.davidbrookins.com/images/**********
   • http://www.deakteerstudio.nl/images/**********
   • http://www.diesel.com/images/**********
   • http://www.ewbbds.ae/images/**********
   • http://www.ffcqatar.com/images/**********
   • http://www.fluoreszcens.sote.hu/images/**********
   • http://www.fourelementsjersey.com/images/**********
   • http://www.hellseherin.li/images/**********
   • http://www.infinito.art.br/images/**********
   • http://www.juniordoctors.eu/images/**********
   • http://www.kovos-dvorak.cz/images/**********
   • http://www.labotest.it/images/**********
   • http://www.magischekringhaaglanden.nl/images/**********
   • http://www.mona-koenig.de/images/**********
   • http://www.qualitycolombia.com/images/**********
   • http://www.rgb-worx.com/images/**********
   • http://www.scharsterrijn.nl/images/**********
   • http://www.silverstoneinn.com/images/**********
   • http://www.speedpicker.com/images/**********
   • http://www.swtsound.com/images/**********
   • http://www.taziocorse.com/images/**********
   • http://www2.seminariodetenerife.org/images/**********
   • http://www7.webdesign-promotion.com/images/**********
   • http://zelenaratolest.cz/images/**********
Au moment de l'écriture, ce fichier n'était pas en ligne pour plus d'investigations.

Registre La clé de registre suivante est ajoutée afin de lancer le processus après le redémarrage:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• %inconnu% = \%inconnu%.exe

Arrêt de processus: La liste des processus qui sont terminés:
   • a2cmd.exe; a2guard.exe; a2HiJackFree.exe; a2scan.exe; a2service.exe;
      a2start.exe; a2upd.exe; a2wizard.exe; aavshield.exe; About.exe;
      AckWin32.exe; ADVCHK.EXE; Agb5.exe; Agb5_.exe; AhnSD.exe;
      airdefense.exe; ALERTSVC.EXE; ALMon.exe; ALOGSERV.EXE; ALsvc.exe;
      ALUNOTIFY.EXE; amon.exe; Anti-Trojan.exe; AntiVirScheduler;
      AntiVirService; AntiVirus.exe; ANTS.EXE; APVXDWIN.EXE; Armor2net.exe;
      ash.exe; ashAvast.exe; ashAvSrv.exe; ashchest.exe; ashDisp.exe;
      ashDug.exe; ashEnhcd.exe; ashLogV.exe; ashMaiSv.exe; ashPopWz.exe;
      ashQuick.exe; ashServ.exe; ashsimp2.exe; ashSimpl.exe; ashSkPcc.exe;
      ashSkPck.exe; ashUpd.exe; ashWebSv.exe; ash_UpdateMediator.exe;
      aswRegSvr.exe; aswUpdSv.exe; ATCON.EXE; ATUPDATER.EXE; ATWATCH.EXE;
      AUPDATE.EXE; AUTODOWN.EXE; AutostartExplorer.exe; AUTOTRACE.EXE;
      AUTOUPDATE.EXE; avadmin.exe; avcenter.exe; avciman.exe; avcmd.exe;
      avconfig.exe; Avconsol.exe; AVENGINE.EXE; avgamsvr.exe; avgcc.exe;
      AVGCC32.EXE; AVGCTRL.EXE; avgdiag.exe; avgemc.exe; avgfwsrv.exe;
      avginet.exe; avgnpdln.exe; avgnpsvc.exe; AVGNT.EXE; avgntdd; avgntmgr;
      avgrssvc.exe; avgscan.exe; AVGSERV.EXE; AVGUARD.EXE; avgupden.exe;
      avgupsvc.exe; avgvv.exe; avgw.exe; avgwizfw.exe; avinitnt.exe;
      AvkServ.exe; AVKService.exe; AVKWCtl.exe; avnotify.exe; AVP.EXE;
      AVP32.EXE; avpcc.exe; avpm.exe; AVPUPD.EXE; avscan.exe; AVSCHED32.EXE;
      avsynmgr.exe; AVWUPD32.EXE; AVWUPSRV.EXE; AVXMONITOR9X.EXE;
      AVXMONITORNT.EXE; AVXQUAR.EXE; BackWeb-4476822.exe; bdagent.exe;
      bdmcon.exe; bdnews.exe; bdoesrv.exe; bdss.exe; bdsubmit.exe;
      bdsubmitwiz.exe; BDSurvey.exe; bdswitch.exe; bdwizreg.exe; blackd.exe;
      blackice.exe; blindman.exe; BTIni.exe; BTIniNT.exe; cafix.exe;
      CavApp.exe; CaVasm.exe; CavAUD.exe; CavEmSrv.exe; Cavmr.exe;
      CavMUD.exe; Cavoar.exe; CavQ.exe; CAVSCons.exe; cavse.exe; CavSn.exe;
      CavSub.exe; CAVSubmit.exe; CavUMAS.exe; CavUserUpd.exe; Cavvl.exe;
      ccApp.exe; ccEvtMgr.exe; ccProxy.exe; ccSetMgr.exe; CEmRep.exe;
      CFIAUDIT.EXE; clamscan.exe; ClamTray.exe; ClamWin.exe; Claw95.exe;
      Claw95cf.exe; cleaner.exe; cleaner3.exe; CliSvc.exe; CMain.exe;
      CMGrdian.exe; copyx64.exe; cpd.exe; cssexc.exe; custinstall.exe;
      custsetup.exe; defensewall.exe; DefWatch.exe; dislite.exe; DOORS.EXE;
      dpatrolq.exe; drvctl.exe; DrVirus.exe; DrvMap.exe; drwadins.exe;
      drweb32w.exe; drweb386.exe; drwebscd.exe; DRWEBUPW.EXE; drwebwcl.exe;
      drwreg.exe; ecmd.exe; egni.exe; ekrn.exe; EMM386.EXE; ESCANH95.EXE;
      ESCANHNT.EXE; ewidoctrl.exe; exit_av.exe;
      EzAntivirusRegistrationCheck.exe; F-AGNT95.EXE; F-PROT95.EXE;
      F-Sched.exe; F-StopW.EXE; FAMEH32.exe; FAST.EXE; FCH32.exe;
      firebird.exe; FireSvc.exe; FireTray.exe; FIREWALL.EXE; FLOPPY.EXE;
      FLOPPY9x.EXE; FLOPPYME.EXE; FPAVServer.exe; fpavupdm.exe;
      FProtTray.exe; fpscan.exe; fptrayproc.exe; FPWin.exe; freshclam.exe;
      FRW.EXE; fsample.exe; fsaua.exe; fsauach.exe; fsav.exe; fsav32.exe;
      fsavaui.exe; fsavgui.exe; fsavstrt.exe; fsavwsch.exe; fsavwscr.exe;
      fsbwsys.exe; fsdbuh.exe; fsdc.exe; fsdfwd.exe; FSDIAG.exe;
      FsDiagUi.exe; fsfwwsch.exe; fsfwwscr.exe; fsgetwab.exe; fsgk32.exe;
      fsgk32st.exe; fsguidll.exe; fsguiexe.exe; FSHDLL32.exe; fshelp.exe;
      FSHOTFIX.exe; fsihcomp.exe; fsihs.exe; FSIMAGE.EXE; FSLAUNCH.exe;
      FSM32.exe; FSMA32.exe; FSMB32.exe; fspc.exe; fspex.exe; fsqh.exe;
      fssf.exe; fssg.exe; fssm32.exe; fsstm.exe; fssw.exe; fstlui.exe;
      fsuninst.exe; fsus.exe; gcasDtServ.exe; gcasServ.exe;
      GIANTAntiSpywareMain.exe; GIANTAntiSpywareUpdater.exe; GUARD.EXE;
      guardgni.exe; GUARDGUI.EXE; GuardNT.exe; helper.exe; hipsdiag.exe;
      HRegMon.exe; Hrres.exe; HSockPE.exe; HUpdate.EXE; iamapp.exe;
      iamserv.exe; ICLOAD95.EXE; ICLOADNT.EXE; ICMON.EXE; ICSSUPPNT.EXE;
      ICSUPP95.EXE; ICSUPPNT.EXE; IERegFix.exe; IFACE.EXE; ih8.exe;
      ih8run.exe; ILAUNCHR.exe; INETUPD.EXE; InocIT.exe; InoRpc.exe;
      InoRT.exe; InoTask.exe; InoUpTNG.exe; InstallCAVS.exe;
      InstallLicense.exe; InstallLSP.exe; InstLsp.exe; INWISE.EXE;
      IOMON98.EXE; isafe.exe; ISATRAY.EXE; ISPNews.exe; isPwdsvc.exe;
      ISRV95.EXE; ISSVC.exe; isUAC.exe; JEDI.EXE; KAV.exe; kavmm.exe;
      KAVPF.exe; KavPFW.exe; KAVStart.exe; KAVSvc.exe; KAVSvcUI.EXE;
      KMailMon.EXE; KPfwSvc.EXE; KWatch.EXE; licmgr.exe; livesrv.exe;
      LiveUpdate.exe; LOCKDOWN2000.EXE; LogWatNT.exe; lpfw.exe; LUALL.EXE;
      LUCallbackProxy.exe; LUCheck.exe; LUCOMSERVER.EXE;
      LuComServer_3_2.EXE; LuConfig.exe; LUInit.exe; Luupdate.exe;
      MalwareRemoval.exe; MCAGENT.EXE; mcmnhdlr.exe; mcregwiz.exe;
      Mcshield.exe; MCUPDATE.EXE; mcvsshld.exe; MemString.exe; MINILOG.EXE;
      MONITOR.EXE; monlite.exe; MonSysNT.exe; MOOLIVE.EXE; MpEng.exe;
      mpssvc.exe; MSMPSVC.exe; msascui.exe; mva.exe; MVC.exe; myAgtSvc.exe;
      myagttry.exe; navapsvc.exe; NAVAPW32.EXE; NavLu32.exe; NAVStub.exe;
      NAVW32.EXE; Navwnt.exe; NDD32.EXE; NeoWatchLog.exe; NeoWatchTray.exe;
      NetstatViewer.exe; nisoptui.exe; NISSERV; NISUM.EXE; NMAIN.EXE;
      nod32.exe; nod32krn.exe; nod32kui.exe; NORMIST.EXE; NotifyHA.exe;
      notstart.exe; npavtray.exe; NPFMNTOR.EXE; npfmsg.exe; NPROTECT.EXE;
      NSCHED32.EXE; NSMdtr.exe; NssServ.exe; NssTray.exe; ntrtscan.exe;
      NTXconfig.exe; NUPGRADE.EXE; NVC95.EXE; Nvcod.exe; Nvcte.exe;
      Nvcut.exe; NWCDEX.EXE; NWService.exe; oasrv.exe; oaui.exe;
      OfcPfwSvc.exe; olAddin.exe; OnAccessInstaller.exe; osCheck.exe;
      OUTPOST.EXE; PartIn.exe; PartIn9x.exe; partinfo.exe; PartInNT.exe;
      PAV.EXE; PavFires.exe; PavFnSvr.exe; Pavkre.exe; PavProt.exe;
      pavProxy.exe; pavprsrv.exe; pavsrv51.exe; PAVSS.EXE; pccguide.exe;
      PCCIOMON.EXE; pccntmon.exe; PCCPFW.exe; PcCtlCom.exe; PCTAV.exe;
      PERSFW.EXE; pertsk.exe; PERVAC.EXE; PM8Flash.exe; PMagic.exe;
      PMagic9x.exe; PMagicBT.exe; PMagicNT.exe; PNMSRV.EXE; POLUTIL.exe;
      POP3TRAP.EXE; POPROXY.EXE; postinstall.exe; ppfw.exe; PQBOOT.EXE;
      Pqboot32.exe; PQBOOTX.EXE; pqbw.exe; PQLAUNCH.EXE; PQMAGIC.EXE;
      PqPe.exe; pqpe9x.exe; pqpent.exe; preconfig.exe; preupd.exe;
      prevsrv.exe; PrevxSetup.exe; ProcessViewer.exe; psctrls.exe;
      pshost.exe; PsImSvc.exe; PTEDIT.EXE; PTEDIT32.EXE; PTEPIT32.EXE;
      PXAgent.exe; PXConsole.exe; PXL.exe; PXL1.exe; PXReset.exe;
      pxsupport.exe; QHM32.EXE; QHONLINE.EXE; QHONSVC.EXE; QHPF.EXE;
      qhwscsvc.exe; qklez.exe; qrtfix.exe; quaranti.exe; RavMon.exe;
      RavTimer.exe; Realmon.exe; REALMON95.EXE; register.exe; removeit.exe;
      Remover.exe; Rescue.exe; rfwmain.exe; Rtvscan.exe; RTVSCN95.EXE;
      RuLaunch.exe; RunSetup.exe; sarcli.exe; sargui.exe; SAV32CLI.EXE;
      SAVAdminService.exe; SAVMain.exe; savprogress.exe; SAVScan.exe;
      SCAN32.EXE; scanner.exe; ScanningProcess.exe; sched.exe; sdhelp.exe;
      sdinvoker.exe; sdloader.exe; SDTrayApp.exe; seccenter.exe;
      SERVIC~1.EXE; SHSTAT.EXE; sigtool.exe; SiteCli.exe; smc.exe;
      SNDSrvc.exe; SNUTIL.EXE; SPBBCSvc.exe; SPHINX.EXE; spiderml.exe;
      spidernt.exe; Spiderui.exe; sporder.exe; SpybotSD.exe; SPYXX.EXE;
      SS3EDIT.EXE; start_diag.exe; stopsignav.exe; SubmitFiles.exe;
      svcntaux.exe; swAgent.exe; swdoctor.exe; swdsvc.exe; SWNETSUP.EXE;
      SymantecRootInstaller.exe; symlcsvc.exe; SymProxySvc.exe;
      SymSPort.exe; SymWSC.exe; SYNMGR.EXE; Sysinfo.exe; TAUMON.EXE;
      TBMon.exe; TC.EXE; tca.exe; TCM.EXE; TDS-3.EXE; TeaTimer.exe;
      TFAK.EXE; tgsvcstp.exe; THAV.EXE; THGnard.exe; THSM.EXE; Tmas.exe;
      tmlisten.exe; Tmntsrv.exe; TmPfw.exe; tmproxy.exe; tnbutil.exe;
      tracelog.exe; TRJSCAN.EXE; TrojanGuarder.exe; TrojanHunter.exe;
      trtddptr.exe; uiscan.exe; UninstallCAVS.exe; Uninstaller.exe;
      UninstallLSP.exe; unp_test.exe; Up2Date.exe; UPDATE.EXE;
      UpdaterUI.exe; updclient.exe; upgrepl.exe; UPSObMaker.exe; UUpd.exe;
      Vba32ECM.exe; Vba32ifs.exe; vba32ldr.exe; Vba32PP3.exe; VBSNTW.exe;
      vchk.exe; vcrmon.exe; VetTray.exe; viritexp.exe; viritsvc.exe;
      VirusKeeper.exe; VirusNews.exe; VistAux.exe; VisthLic.exe;
      VisthUpd.exe; VPTRAY.EXE; vrfwsvc.exe; VRMONNT.EXE; vrmonsvc.exe;
      vrrw32.exe; VSECOMR.EXE; Vshwin32.exe; vsmon.exe; vsserv.exe;
      VsStat.exe; w9xpopen; WATCHDOG.EXE; Wclose.exe; webfiltr.exe;
      WebProxy.exe; Webscanx.exe; WEBTRAP.EXE; WGFE95.EXE; wil.exe;
      Winaw32.exe; WindowList.exe; winroute.exe; winss.exe; winssnotify.exe;
      WRADMIN.EXE; WRCTRL.EXE; writespid.exe; WRPROG.EXE; wsctool.exe;
      xcommsvr.exe; zatutor.exe; ZAUINST.EXE; zauninst.exe; zlclient.exe;
      zonealarm.exe; _AVP32.EXE; _AVPCC.EXE; _AVPM.EXE

La liste des services qui sont désactivés:
   • Aavmker4; ABVPN2K; acssrv; ADBLOCK.DLL; ADFirewall; AFWMCL; Ahnlab
      task Scheduler; alerter; AlertManger; AntiVir Service; AntiyFirewall;
      ARP.DLL; aswMon2; aswRdr; aswTdi; aswUpdSv; Ati HotKey Poller; avast!
      Antivirus; avast! Mail Scanner; avast! Web Scanner; AVEService;
      AVExch32Service; AvFlt; Avg7Alrt; Avg7Core; Avg7RsW; Avg7RsXP;
      Avg7UpdSvc; AvgCore; AvgFsh; AVGFwSrv; AvgFwSvr; AvgServ; AvgTdi;
      AVIRAMailService; AVIRAService; AVKProxy; AVKService; AVKWCtl; avpcc;
      AVUPDService; AVWUpSrv; AvxIni; awhost32; backweb client - 4476822;
      BackWeb Client - 7681197; backweb client-4476822; Bdfndisf; bdftdif;
      bdss; BlackICE; BsFileSpy; BsFirewall; BsMailProxy; CAISafe; ccEvtMgr;
      ccPwdSvc; ccSetMgr; ccSetMgr.exe; CONTENT.DLL; DefWatch; DNSCACHE.DLL;
      drwebnet; dvpapi; dvpinit; ewido security suite control; ewido
      security suite driver; ewido security suite guard; F-Prot Antivirus
      Update Monitor; F-Secure Gatekeeper Handler Starter; firewall; FSAUA;
      fsbwsys; FSDFWD; FSFW; FSMA; FTPFILT.DLL; FwcAgent; fwdrv; Guard NT;
      HSnSFW; HSnSPro; HTMLFILT.DLL; HTTPFILT.DLL; IMAPFILT.DLL; InoRPC;
      InoRT; InoTask; Ip6Fw; Ip6FwHlp; KAVMonitorService; KAVSvc; KLBLMain;
      KPfwSvc; KWatch3; KWatchSvc; MAILFILT.DLL; McAfee Firewall;
      McAfeeFramework; McShield; McTaskManager; mcupdmgr.exe; MCVSRte;
      Microsoft NetWork FireWall Services; MonSvcNT; MpfService; MpsSvc;
      navapsvc; Ndisuio; NDIS_RD; Network Associates Log Service; nipsvc;
      NISSERV; NISUM; NNTPFILT.DLL; NOD32ControlCenter; NOD32krn;
      NOD32Service; Norman NJeeves; Norman Type-R; Norman ZANDA; Norton
      AntiVirus Server; NPDriver; NPFMntor; NProtectService; NSCTOP; nvcoas;
      NVCScheduler; nwclntc; nwclntd; nwclnte; nwclntf; nwclntg; nwclnth;
      NWService; OfcPfwSvc; Outbreak Manager; Outpost Firewall;
      OutpostFirewall; PASSRV; PAVAGENTE; PavAtScheduler; PAVDRV; PAVFIRES;
      PAVFNSVR; Pavkre; PavProc; PavProt; PavPrSrv; PavReport; PAVSRV;
      PCCPFW; PCC_PFW; PersFW; Personal Firewall; POP3FILT.DLL; PREVSRV;
      PSIMSVC; qhwscsvc; Quick Heal Online Protection; ravmon8; RfwService;
      SAVFMSE; SAVScan; SBService; schscnt; SECRET.DLL; SharedAccess;
      SmcService; SNDSrvc; SPBBCSvc; SpiderNT; SweepNet; SWEEPSRV.SYS;
      Symantec AntiVirus Client; Symantec Core LC; The_Hacker_Antivirus;
      Tmntsrv; TmPfw; tmproxy; tmtdi; tm_cfw; T_H_S_M; V3MonNT; V3MonSvc;
      Vba32ECM; Vba32ifs; Vba32Ldr; Vba32PP3; VBCompManService;
      VexiraAntivirus; VFILT; VisNetic AntiVirus Plug-in; vrfwsvc; vsmon;
      VSSERV; WinAntivirus; WinDefend; WinRoute; wscsvc; wuauserv; xcomm

Informations divers Anti debugging
Il vérifie si un des programmes suivants est en exécution:
   • SoftIce
   • FileMon
   • RegMog
   • ProcMon
   • Process Explorer
   • DeepFreeze

S'il réussit, il affiche ce qui suit et il s'arrête immédiatement après:

Détails de fichier Logiciel de compression des fichiers exécutables:
Pour entraver la détection et pour réduire la taille du fichier il est compressé avec le logiciel de compression des exécutables suivant:
• Themida

Voir la description brève ici.

Description inséré par Andrei Gherman sur Thu, 31 Jul 2008 12:03 (GMT+1)
Description mise à jour par Andrei Gherman sur Thu, 31 Jul 2008 13:35 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« Retour