Nume:Worm/IRCBot.68708
Descoperit pe data de:06/12/2005
Tip:Vierme
ITW:Nu
Numar infectii raportate:Scazut
Potential de raspandire:Mediu
Potential de distrugere:Mediu
Fisier static:Da
Marime:68.708 Bytes
MD5:cc24c96767cdc5dc77c4b5ae363f2b56
Versiune VDF:6.32.01.11

 General Metoda de raspandire:
   • Peer to Peer


Alias:
   •  TrendMicro: WORM_RBOT.DGR
   •  VirusBuster: virus Worm.SdBot.BPX


Sistem de operare:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Efecte secundare:
   • Blocheaza accesul la website-uri ale firmelor de securitate
   • Inchide aplicatiile de securitate
   • Creeaza un fisier malware
   • Reduce setarile de securitate
   • Inregistreaza intrarile de la tastatura
   • Modificari in registri
   • Profita de vulnerabilitatile softului
   • Sustrage informatii
   • Posibilitatea accesului neautorizat la computer

 Fisiere Se copiaza in urmatoarea locatie:
   • %SYSDIR%\taskdrv32.exe



Sunt create fisierele:

– %radacina partitiei Windows%\owned.txt Acesta este un fisier text care nu prezinta pericol si are urmatorul continut:
   • SD Bot pwned u!

– %radacina partitiei Windows%\lsass.exe Fisierul este executat dupa ce a fost creat. Analiza ulterioara a relevat ca si acest fisier este malware. Detectat ca: TR/PSW.Agent.UT

 Registrii sistemului Creeaza urmatoarea valoare, pentru a trece de Windows XP firewall:

– [HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
   FIREWALLPOLICY\standardprofile\authorizedapplications\List]
   • "%SYSDIR%\taskdrv32.exe"="%SYSDIR%\taskdrv32.exe:*:Enabled:Windows
      Taskbar Driver (32-bits)"



Urmatoarele chei din registri sunt modificate:

– [HKCR\exefile\shell\open\command]
   Vechea valoare:
   • @=%setarile utilizatorului%
   Noua valoare:
   • @="taskdrv32.exe \"%1\" %*"

Dezactiveaza Windows Firewall:
– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess]
   Vechea valoare:
   • "Start"=%setarile utilizatorului%
   Noua valoare:
   • "Start"=dword:00000004

– [HKLM\SYSTEM\CurrentControlSet\Control\Lsa]
   Vechea valoare:
   • "restrictanonymous"=%setarile utilizatorului%
   Noua valoare:
   • "restrictanonymous"=dword:00000001

– [HKLM\SOFTWARE\Microsoft\Ole]
   Vechea valoare:
   • "EnableDCOM"=%setarile utilizatorului%
   Noua valoare:
   • "EnableDCOM"="Y"

 P2P  Pentru a infecta alte sisteme din retele Peer-to-Peer, efectueaza urmatarele operatii:  


– Cauta urmatoarele directoare:
   • %radacina partitiei Windows%\My Downloads
   • %radacina partitiei Windows%\My Shared Folder
   • %PROGRAM FILES%\eDonkey2000\incoming
   • %PROGRAM FILES%\LimeWire\Shared

   Extrage fisierele partajate, folosind urmatoarele chei de registru:
   • HKCU\SOFTWARE\KAZAA\LocalContent
   • HKCU\SOFTWARE\KAZAA\LocalContent\DonwloadDir
   • HKLM\SOFTWARE\Morpheus
   • HKLM\SOFTWARE\iMesh\Client
   • HKLM\SOFTWARE\iMesh\Client\DownloadsLocation

   Daca reuseste, sunt create urmatoarele fisiere:
   • ZoneAlarm crack (keygen).exe; Yahoo_mail_cracker.exe;
      yahoo_hacker.exe; yahoo_cracker.exe; UniVersal GSM unlocker for
      removing simlock (NOKIA,ERICSSON,SONY,SAMSUNG,OTHERS).exe; psx2 -
      playstation 2 emulator.exe; porn_account_hacker.exe; toon boom.exe;
      porn_account_cracker.exe; porn.exe; Norton antivirus crack.exe; Norton
      AntiVirus 2006 crack.exe; Norton AntiVirus 2005 crack.exe; norton anti
      virus FULL NEWEST VERSION.exe; Microsoft Office Professional Universal
      Crack without serial.exe; Microsoft Office Universal Activator
      v1.0.exe; Microsoft Office Professional Serial.exe; Microsoft Office
      Professional Crack.exe; Microsoft Office Activation Crack.exe; IP
      Changer.exe; Hotmailhacker v1.0.exe; hotmail_account_sniffer.exe;
      Hotmail hacker.exe; Hotmail account hacker in 30 minutes.exe; Google
      hack tutorial for beginners.exe; flash 8.exe; Free SMS Bomber.exe;
      Fifa 2007 FULL with crack.exe; Fifa 2006 FULL with crack.exe; credit
      card generator.exe; Counter strike - cs full version.exe; Counter
      strike keygen WORKING FOR ONLINE STEAM.exe; BEST HACK TOOL FOR REAL
      HACKERS KEYLOGGER WEBCAM SPY! - PRIVATE.exe; Autocad 2006 Crack.exe;
      Autocad 2005 Crack.exe; Autocad 2004 Crack.exe; Autocad 2002
      Crack.exe; Adobe Photoshop CS 2.exe; Adobe InDesign CS 2.exe; Adobe
      keygen for photoshop indesign incopy SERIAL crack.exe; 2pac - tupac
      full album battle before his dead.exe; 2 Find MP3 8.2.0.exe

   Aceste fişiere sunt copii ale malware-ului.

 Reţea Foloseste urmatoarele date de logare, pentru a controla sistemul la distanta:

– Lista de utilizatori si parole:
   • 000000; 007; 123; 1234; 12345; 123456; 1234567; 12345678; 123456789;
      1234567890; 2000; 2001; 2002; 2003; 2004; access; accounting;
      accounts; adm; admin; administrador; administrat; administrateur;
      administrator; admins; asd; backup; bill; bitch; blank; bob; brian;
      changeme; chris; cisco; compaq; control; data; database; databasepass;
      databasepassword; db1; db1234; db2; dbpass; dbpassword; default; dell;
      demo; domain; domainpass; domainpassword; eric; exchange; fred; fuck;
      george; god; guest; hell; hello; home; homeuser; ian; ibm; internet;
      intranet; jen; joe; john; kate; katie; lan; lee; linux; login;
      loginpass; luke; mail; main; mary; mike; neil; nokia; none; null; oem;
      oeminstall; oemuser; office; oracle; orainstall; outlook; pass;
      pass1234; passwd; password; password1; peter; pwd; qaz; qwe; qwerty;
      root; sam; server; sex; siemens; slut; sql; sqlpassoainstall; staff;
      student; sue; susan; system; teacher; technical; test; unix; user;
      web; win2000; win2k; win98; windows; winnt; winpass; winxp; www; zxc



Exploit:
Foloseste urmatoarele vulnerabilitati:
– MS02-061 (Elevation of Privilege in SQL Server Web)
– MS04-007 (ASN.1 Vulnerability)


Procesul de infectare:
Se creeaza un script FTP in sistemul afectat, pentru a descarcaun malware pe alt computer controlat la distanta.


Activare de la distanta:
–Incearca sa activeze de la distanta malware-ul pe sistemul recent infectat. Pentru aceasta, apeleaza functia NetScheduleJobAdd.

 IRC Pentru a trimite informatii si pentru a fi controlat se conecteaza la serverul IRC:

Server: unixirc.bl**********.tc
Port: 6666
Canal: #sd-pwnage
Nick: [F][USA]-%sir de 5 caractere aleatoare%
Parola: owned



– Acest malware poate obtine si trimite infomatii cum ar fi:
    • Viteza procesorului
    • Utilizatorul curent
    • Memorie nealocata
    • Timpul de cand malware-ul a fost lansat in executie
    • Informatii despre retea
    • ID-ul platformei
    • Cantitatea de memorie
    • Utilizator
    • Informatii despre sistemul de operare


– In plus, poate efectua urmatoarele operatii:
    • conectare server IRC
    • Lanseaza atacuri DDoS SYN
    • dezactivare DCOM
    • dezactivarea partajarii de resurse in retea
    • deconectare server IRC
    • descarcare fisier
    • activare DCOM
    • activarea partajarii de resurse in retea
    • executarea unui fisier
    • intrare pe canal IRC
    • parasire canal IRC
    • deschidere consola
    • Porneste keylog
    • Porneste rutina de raspandire
    • Se actualizeaza singur
    • Vizitarea unui website

 Fisiere host Fisierul

– In acest caz, inregistrarile existente sunt sterse.

– Accesul la urmatoarele domenii este redirectionat catre alte destinatii:
   • avp.com; ca.com; customer.symantec.com; dispatch.mcafee.com;
      download.mcafee.com; downloads1.kaspersky-labs.com;
      downloads2.kaspersky-labs.com; downloads3.kaspersky-labs.com;
      downloads4.kaspersky-labs.com; downloads-eu1.kaspersky-labs.com;
      downloads-eu2.kaspersky-labs.com; downloads-eu3.kaspersky-labs.com;
      downloads-eu4.kaspersky-labs.com; downloads-us1.kaspersky-labs.com;
      downloads-us2.kaspersky-labs.com; downloads-us3.kaspersky-labs.com;
      downloads-us4.kaspersky-labs.com; f-secure.com; ftp.avp.com;
      ftp.ca.com; ftp.customer.symantec.com; ftp.dispatch.mcafee.com;
      ftp.download.mcafee.com; ftp.downloads1.kaspersky-labs.com;
      ftp.downloads2.kaspersky-labs.com; ftp.downloads3.kaspersky-labs.com;
      ftp.downloads4.kaspersky-labs.com;
      ftp.downloads-eu1.kaspersky-labs.com;
      ftp.downloads-eu2.kaspersky-labs.com;
      ftp.downloads-eu3.kaspersky-labs.com;
      ftp.downloads-eu4.kaspersky-labs.com;
      ftp.downloads-us1.kaspersky-labs.com;
      ftp.downloads-us2.kaspersky-labs.com;
      ftp.downloads-us3.kaspersky-labs.com;
      ftp.downloads-us4.kaspersky-labs.com; ftp.f-secure.com;
      ftp.grisoft.com; ftp.kaspersky.com; ftp.kaspersky-labs.com;
      ftp.liveupdate.symantec.com; ftp.liveupdate.symantecliveupdate.com;
      ftp.mast.mcafee.com; ftp.mcafee.com; ftp.my-etrust.com; ftp.nai.com;
      ftp.networkassociates.com; ftp.norton.com; ftp.rads.mcafee.com;
      ftp.sandbox.norman.com; ftp.secure.nai.com;
      ftp.securityresponse.symantec.com; ftp.sophos.com; ftp.symantec.com;
      ftp.symantecliveupdate.com; ftp.symatec.com; ftp.trendmicro.com;
      ftp.uk.trendmicro-europe.com; ftp.update.symantec.com;
      ftp.updates.symantec.com; ftp.updates1.kaspersky-labs.com;
      ftp.updates2.kaspersky-labs.com; ftp.updates3.kaspersky-labs.com;
      ftp.updates4.kaspersky-labs.com; ftp.us.mcafee.com;
      ftp.viruslist.comgrisoft.com; kaspersky.com; kaspersky-labs.com;
      liveupdate.symantec.com; liveupdate.symantecliveupdate.com;
      mast.mcafee.com; mcafee.commy-etrust.com; nai.com;
      networkassociates.com; norton.com; pandasoftware.com; rads.mcafee.com;
      sandbox.norman.com; secure.nai.com; securityresponse.symantec.com;
      sophos.com; symantec.com; symantecliveupdate.com; symatec.com2;
      trendmicro.com; uk.trendmicro-europe.com; update.symantec.com;
      updates.symantec.com; updates1.kaspersky-labs.com;
      updates2.kaspersky-labs.com; updates3.kaspersky-labs.com;
      updates4.kaspersky-labs.com; us.mcafee.com; viruslist.com;
      virusscan.jotti.org; virustotal.com; www.avp.com; www.ca.com;
      www.customer.symantec.com; www.dispatch.mcafee.com;
      www.download.mcafee.com; www.downloads1.kaspersky-labs.com;
      www.downloads2.kaspersky-labs.com; www.downloads3.kaspersky-labs.com;
      www.downloads4.kaspersky-labs.com;
      www.downloads-eu1.kaspersky-labs.com;
      www.downloads-eu2.kaspersky-labs.com;
      www.downloads-eu3.kaspersky-labs.com;
      www.downloads-eu4.kaspersky-labs.com;
      www.downloads-us1.kaspersky-labs.com;
      www.downloads-us2.kaspersky-labs.com;
      www.downloads-us3.kaspersky-labs.com;
      www.downloads-us4.kaspersky-labs.com; www.f-secure.com;
      www.grisoft.com; www.kaspersky.com; www.kaspersky-labs.com;
      www.liveupdate.symantec.com; www.liveupdate.symantecliveupdate.com;
      www.mast.mcafee.com; www.mcafee.com; www.my-etrust.com; www.nai.com;
      www.networkassociates.com; www.norton.com; www.pandasoftware.com;
      www.rads.mcafee.com; www.sandbox.norman.com; www.secure.nai.com;
      www.securityresponse.symantec.com; www.sophos.com; www.symantec.com;
      www.symantecliveupdate.com; www.symatec.com; www.trendmicro.com;
      www.uk.trendmicro-europe.com; www.update.symantec.com;
      www.updates.symantec.com; www.updates1.kaspersky-labs.com;
      www.updates2.kaspersky-labs.com; www.updates3.kaspersky-labs.com;
      www.updates4.kaspersky-labs.com; www.us.mcafee.com; www.viruslist.com;
      www.virustotal.com




Fisierul hosts modificat va arata astfel:


 Terminarea proceselor Lista cu procesele oprite:
   • hijackthis.exe; zonalm2601.exe; procdump.exe; regedit32.exe;
      msconfig.exe; zonealarm.exe; zauinst.exe; zatutor.exe; zapro.exe;
      wyvernworksfirewall.exe; wsbgate.exe; wrctrl.exe; wradmin.exe;
      wqkmm3878.exe; wnt.exe; winsfcm.exe; winroute.exe; winrecon.exe;
      wimmun32.exe; whoswatchingme.exe; wgfe95.exe; wfindv32.exe;
      webtrap.exe; webscanx.exe; watchdog.exe; w9x.exe; vswinntse.exe;
      vswin9xe.exe; vsstat.exe; vsmon.exe; vsmain.exe; vshwin32vbcmserv.exe;
      vshwin32.exe; vsecomr.exe; vsched.exe; vscan40.exe; vptray.exe;
      vpfw30s.exe; vpc32.exe; vnpc3000.exe; vnlan300.exe;
      virusmdpersonalfirewall.exe; virus.exe; vettray.exe; vet95.exe;
      vet32.exe; vcontrol.exe; vccmserv.exe; vbwinntw.exe; vbwin9x.exe;
      vbust.exe; vbcons.exe; vbcmserv.exe; update.exe; undoboot.exe;
      truevector.exe; trojantrap3.exe; trjscan.exe; trendmicro.exe;
      titaninxp.exe; titanin.exe; tgbob.exe; tfak5.exe; tfak.exe; tctca.exe;
      tcm.exe; tca.exe; tc.exe; tbscan.exe; tauscan.exe; taumon.exe;
      taskmon.exe; sysedit.exe; symtray.exe; symproxysvc.exe; symlcsvc.exe;
      symantec.exe; swnetsup.exe; sweepsrv.sysvshwin32.exe;
      sweepsrv.sys.exe; sweepnet.exe; sweep95.exe; supporter5.exe;
      supp95.exe; supftrl.exe; st2.exe; ss3edit.exe; srwatch.exe; spyxx.exe;
      spyx.exe; spygate.exe; spy.exe; sphinx.exe; spf.exe; sophosav.exe;
      sophos_av.exe; sophos.exe; sofi.exe; smc.exe; shn.exe;
      sharedaccess.exe; sh.exe; sfc.exe; serv95.exe; sens.exe; sd.exe;
      scrscan.exe; scanpm.exe; scan95.exe; scan32.exe; scan.exe;
      sbservice.exe; sbserv.exe; savscan.exe; safeweb.exe; rulaunch.exe;
      rtvscn95.exe; rshell.exe; rrguard.exe; rescue.exe; regrun2.exe;
      realmon.exe; rav7win.exe; rav7.exe; rav.exe; qconsole.exe; pw32.exe;
      pview95.exe; purge.exe; pspf.exe; protectx.exe; proport.exe;
      programauditor.exe; procexplorerv10; .exe; processmonitor.exe;
      ppvstop.exe; pptbc.exe; ppinupdt.exe; portmonitor.exe;
      portdetective.exe; poproxy.exe; pop3trap.exe; platin.exe;
      pingscan.exe; pfwadmin.exe; pf2.exe; persfw.exe; periscope.exe;
      pcscan.exe; pcfwallicon.exe; pccwin98.exe; pccwin97.exe; pccntmon.exe;
      pcciomon.exe; pccguide.exe; pccclient.exe; pavw.exe; pavsched.exe;
      pavproxy.exe; pavcl.exe; pav.exe; panixk.exe; pandaav.exe; panda.exe;
      padmin.exe; outpost.exe; ostronet.exe; opscan.exe; offguard.exe;
      nwtool16.exe; nwservice.exe; nvsvc32.exe; nvc95.exe; nvarch16.exe;
      nupgrade.exe; nui.exe; ntxconfig.exe; ntvdm.exe; ntrtscan.exe;
      nsplugin.exe; nschednt.exe; nsched32.exe; nresq32.exe; npssvc.exe;
      npscheck.exe; nprotect.exe; npfw32.exe; npfw.exe; npfmessenger.exe;
      notstart.exe; nortonav.exe; norton_av.exe; norton.exe; normist.exe;
      normanav.exe; norman32.exe; norman_av.exe; norman_32.exe; norman.exe;
      nod32.exe; nmain.exe; nisumnisservnisum.exe; nisum.exe; nisserv.exe;
      nimda.exe; netutils].exe; netutils.exe; netstat.exe; netscanpro.exe;
      netprotect.exe; netpro.exe; netmon.exe; netinfo.exe; netcommando.exe;
      netarmor.exe; net2000.exe; neowatchlog.exe; neomonitor.exe; ndd32.exe;
      nc2000.exe; navwnt.exe; navw32.exe; navstub.exe; navrunr.exe;
      navnt.exe; navlu32.exe; navengnavex15.exe; navdx.exe; navapw32.exe;
      navapsvc.exe; navap.exe; navalert.exe; nav32.exe; nav.exe;
      n32scanw.exe; mxtask.exe; mwatch.exe; msinfo32.exe; mrflux.exe;
      mpftray.exe; mpfservice.exe; moolive.exe; monsysnt.exe; monsys32.exe;
      monitor.exe; mon.exe; minilog.exe; mgui.exe; mghtml.exe; mgavrte.exe;
      mgavrtcl.exe; mcvsshld.exe; mcvsrte.exe; mcupdate.exe; mctool.exe;
      mcshieldvvstat.exe; mcshield.exe; mcmnhdlr.exe; mcagent.exe;
      mcafee.exe; luspt.exe; lucomserver.exe; luall.exe; lookout.exe;
      lockdown2000.exe; lockdown.exe; localnet.exe; ldscan.exe;
      ldpromenu.exe; ldnetmon.exe; kavsvc.exe; kav.exe; kavpf.exe; jedi.exe;
      jammer.exe; isrv95.exe; iris.exe; iparmor.exe; iomon98.exe;
      inoculateit.exe; ifw2000.exe; iface.exe; icsuppnt.exe; icsupp95.exe;
      icmon.exe; icloadnt.exe; icload95.exe; ibmavsp.exe; ibmasn.exe;
      iamstats.exe; iamserv.exe; iamapp.exe; hh.exe; hackereliminator.exe;
      guarddog.exe; guard.exe; grief3878.exe; generics.exe; gedit.exe;
      gbpoll.exe; gbmenu.exe; fwenc.exe; fsmb32.exe; fsma32.exe; fsm32.exe;
      fsgk32.exe; fsave32.exe; fsav95.exe; fsav32.exe; fsaa.exe; frw.exe;
      fprot.exe; fnrb32.exe; flowprotector.exe; fix-it.exe; firewall.exe;
      findviru.exe; fih32.exe; fch32.exe; fast.exe; fameh32.exe; expert.exe;
      evpn.exe; etrustcipe.exe; espwatch.exe; escanv95.exe; escanhnt.exe;
      escanh95.exe; esafe.exe; efpeadm.exe; edisk.exe; ecengine.exe;
      dvp95_0.exe; dvp95.exe; drweb32.exe; drwatson.exe; dpf.exe; doors.exe;
      deputy.exe; defwatch.exe; defscangui.exe; defense.exe; defence.exe;
      defalert.exe; ctrl.exe; cpf9x206.exe; cpd.exe; conseal.exe;
      connectionmonitor.exe; codered.exe; cmon016.exe; cmgrdian.exe;
      cleanpc.exe; cleaner3.exe; cleaner.exe; clean.exe; claw95cf.exe;
      claw95.exe; cfinet32.exe; cfinet.exe; cfiaudit.exe; cfiadmin.exe;
      cdp.exe; ccsetmgr.exe; ccpxysvc.exe; ccpwdsrc.exe; ccimscan.exe;
      ccevtmgr.exe; ccapp.exe; bullguard.exe; bs120.exe; borg2.exe;
      bootwarn.exe; blackiceblackd.exe; blackice.exe; blackd.exe; bisp.exe;
      bipcp.exe; bidserver.exe; bidef.exe; bd_professional.exe; backlog.exe;
      avxw.exe; avxsch.exe; avxquar.exe; avxnews.exe; avxmonitornt.exe;
      avxmonitor9x.exe; avxlive.exe; avxinit.exe; avxgui.exe; avwupd32.exe;
      avwinnt.exe; avwin95.exe; avsynmgr.exe; avsched32.exe; avrescue.exe;
      avpupdates.exe; avpupd.exe; avptc32.exe; avptc.exe; avpmonitor.exe;
      avpm.exe; avpinst.exe; avpexec.exe; avpdos32.exe; avpccavpm.exe;
      avpcc.exe; avp32.exe; avp.exe; avnt.exe; avkwctl9.exe; avkwcl9.exe;
      avkservice.exe; avkserv.exe; avkpop.exe; avgw.exe;
      avgserv9schedapp.exe; avgserv9.exe; avgserv.exe; avgctrl.exe;
      avgcc32.exe; ave32.exe; avconsol.exe; autoupdate.exe; autotrace.exe;
      autodown.exe; atwatch.exe; atupdater.exe; atscan.exe; ats.exe;
      atguard.exe; atcon.exe; apvxdwin.exe; aplica32.exe; apimonitor.exe;
      antssircam.exe; ants.exe; antivirus.exe; antivir.exe; amonavp32.exe;
      amon9x.exe; amon.exe; alogserv.exe; alertsvc.exe; ahnsd.exe; agv.exe;
      agentsvr.exe; advxdwin.exe; ackwin32.exe; _avpm.exe; _avpcc.exe;
      _avp32.exe


Lista cu serviciile dezactivate:
   • Automatic Updates
   • Security Center

 Furt de informatii Incearca sa obtina urmatoarele informatii:

– Urmatoarele CD-keys:
   • Battlefield 1942; Battlefield 1942 (Road To Rome); Battlefield 1942
      (Secret Weapons of WWII); Battlefield Vietnam; Black and White;
      Command & Conquer Generals; Command and Conquer: Generals (Zero Hour);
      Command and Conquer: Red Alert 2; Command and Conquer: Tiberian Sun;
      Counter-Strike (Retail); Chrome; FIFA 2002; FIFA 2003; FIFA 2004; FIFA
      2005; FIFA 2006; FIFA 2007; Freedom Force; Global Operations; Gunman
      Chronicles; Half-Life; Hidden & Dangerous 2; IGI 2: Covert Strike;
      Industry Giant 2; James Bond 007: Nightfire; Legends of Might and
      Magic; Medal of Honor: Allied Assault; Medal of Honor: Allied Assault:
      Breakthrough; Medal of Honor: Allied Assault: Spearhead; Nascar Racing
      2002; Nascar Racing 2003; Nascar Racing 2004; Nascar Racing 2005;
      Nascar Racing 2006; Nascar Racing 2007; Need For Speed Hot Pursuit 2;
      Need For Speed: Underground; Neverwinter Nights; Neverwinter Nights
      (Hordes of the Underdark); Neverwinter Nights (Shadows of Undrentide);
      NHL 2003; NHL 2004; NHL 2005; NHL 2006; NHL 2007; NHL 2002; NOX;
      Rainbow Six III RavenShield; Shogun: Total War: Warlord Edition;
      Soldier of Fortune II - Double Helix; Soldiers Of Anarchy; The
      Gladiators; Unreal Tournament 2003; Unreal Tournament 2004

– Parolele din urmatoarele programe:
   • MSN Messenger
   • AIM Messenger
   • Yahoo Messenger

– Este pornita o rutina de logare dupa ce viziteaza un site care contine unul din urmatoarele siruri de caractere in URL:
   • e-gold
   • PayPal
   • StormPay
   • WorldPay

 Alte informatii Mutex:
Creeaza urmatorul mutex:
   • SD-Bot


Sir de caractere:
In plus, mai contine urmatoarele siruri de caractere:
   • #ftp-pwnage
   • #sd-key
   • #sd-msn
   • #creditcards

 Detaliile fisierului Limbaj de programare:
 Limbaj de programare folosit: C (compilat cu Microsoft Visual C++).


Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit un program de compresie runtime.

Descrizione inserita da Daniel Constantin su giovedì 15 dicembre 2005
Descrizione aggiornata da Daniel Constantin su martedì 27 dicembre 2005

Indietro . . . .