Nome del virus:Worm/IrcBot.590336
Scoperto:20/08/2009
Tipo:Worm
In circolazione (ITW):Si
Numero delle infezioni segnalate:Medio-Basso
Potenziale di propagazione:Medio-Basso
Potenziale di danni:Medio
File statico:Si
Dimensione del file:590.336 Byte
Somma di controllo MD5:2b5691b59afcb6382b005752fb0c1021
Versione IVDF:7.01.05.143 - giovedì 20 agosto 2009

 Generale Metodo di propagazione:
• Autorun feature (it)
   • Rete locale


Alias:
   •  Mcafee: W32/IRCBot.worm.gen.ai
   •  Panda: W32/IRCBot.CRP.worm
   •  Eset: Win32/AutoRun.IRCBot.BP
   •  Bitdefender: Trojan.Generic.2307849


Piattaforme / Sistemi operativi:
   • Windows 2000
   • Windows XP
   • Windows 2003


Effetti secondari:
   • Blocca l'accesso a certi siti web
   • Blocca l'accesso a siti web di sicurezza
   • Duplica file “maligni”
   • Abbassa le impostazioni di sicurezza
   • Modifica del registro
   • Accesso e controllo del computer da parte di terzi

 File Si copia alle seguenti posizioni:
   • %SYSDIR%\wbem\wmiclisv.exe
   • %unità disco%\CACHESYS\DATA-345432365\device32.exe



Sovrascrive un file.
– %SYSDIR%\drivers\etc\hosts



Cancella la copia di se stesso eseguita inizialmente.



Viene creato il seguente file:

– %unità disco%\CACHESYS\DATA-345432365\Desktop.ini
– %unità disco%\autorun.inf Questo è un file di testo “non maligno” con il seguente contenuto:
   •

– %SYSDIR%\drivers\drvmon64.sys Ulteriori analisi hanno accertato che questo file è anch'esso un malware. Riconosciuto come: Worm/IrcBot.11656.2

 Registro Le seguenti chiavi di registro vengono aggiunte per eseguire i processi dopo il riavvio:

– [HKLM\SYSTEM\CurrentControlSet\Services\drvmon64]
   • "DisplayName"="System Drive Monitor"
   • "ErrorControl"=dword:0x00000001
   • "Group"="SST miniport drivers"
   • "ImagePath"="\??\%SYSDIR%\drivers\drvmon64.sys"
   • "Start"=dword:0x00000003
   • "Type"=dword:0x00000001

– [HKLM\SYSTEM\CurrentControlSet\Services\WMICLISV]
   • "Description"="Manages WMI data for client applications."
   • "DisplayName"="WMI Client Service"
   • "ErrorControl"=dword:0x00000000
   • "FailureActions"=hex:0A,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,B8,0B,00,00
   • "ImagePath"=""%SYSDIR%\wbem\wmiclisv.exe""
   • "ObjectName"="LocalSystem"
   • "Start"=dword:0x00000002
   • "Type"=dword:0x00000110



Viene aggiunta la seguente chiave di registro:

– [HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
   • "DisableConfig"=dword:0x00000001



Vengono cambiate le seguenti chiavi di registro:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
   Folder\SuperHidden]
   Nuovo valore:
   • "CheckedValue"=dword:0x00000001

– [HKLM\SYSTEM\CurrentControlSet\Control]
   Nuovo valore:
   • "WaitToKillServiceTimeout"="7000"

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile\AuthorizedApplications\List]
   Nuovo valore:
   • "%SYSDIR%\wbem\wmiclisv.exe"="%SYSDIR%\wbem\wmiclisv.exe:*:Microsoft Enabled"

 “Infezione” della rete Per assicurarsi la propria propagazione, il malware tenta di connettersi ad altre macchine come descritto qui sotto:


Exploit:
Sfrutta le seguenti vulnerabilità:
– MS04-007 (ASN.1 Vulnerability)
– MS06-040 (Vulnerability in Server Service)


Generazione dell'indirizzo IP:
Crea degli indirizzi IP casuali mentre mantiene il primo ottetto dal proprio indirizzo. In seguito prova a stabilire una connessione con gli indirizzi creati.


Esecuzione remota:
–Tenta di pianificare una esecuzione remota del malware, sulla macchina “infettata” recentemente. Per fare questo utilizza la funzione NetScheduleJobAdd.

 IRC Per inviare informazioni sul sistema e per fornire il controllo remoto, si connette ai seguenti server IRC:

Server: euro.b-**********.info
Porta: 7231
Canale: #sploit
Nickname: [00|USA|XP|%numero%]
Password: sPLoiT!

Server: mech.c-**********.info
Porta: 32132
Canale: #sploit
Nickname: [00|USA|XP|%numero%]
Password: sPLoiT!

Server: spazm.a-**********.info
Canale: #sploit
Nickname: [00|USA|XP|%numero%]
Password: sPLoiT!

Server: centre.a-**********.info
Canale: #sploit
Nickname: [00|USA|XP|%numero%]
Password: sPLoiT!

Server: coax.a-**********.info
Canale: #sploit
Nickname: [00|USA|XP|%numero%]
Password: sPLoiT!

Server: com0.b-**********.info
Canale: #sploit
Nickname: [00|USA|XP|%numero%]
Password: sPLoiT!

Server: ptr.b-**********.info
Canale: #sploit
Nickname: [00|USA|XP|%numero%]
Password: sPLoiT!

Server: det0x.c-**********.info
Canale: #sploit
Nickname: [00|USA|XP|%numero%]
Password: sPLoiT!

Server: sex.c-**********.info
Canale: #sploit
Nickname: [00|USA|XP|%numero%]
Password: sPLoiT!


– In più ha la capacità di effettuare azioni quali:
    • Disattivare le condivisioni di rete
    • Attivare le condivisioni di rete
    • Eseguire file
    • Effettuare scansione della rete
    • Arrestare il sistema
    • Aggiornarsi

 Host L'host del file viene modificato come spiegato:

– In questo caso i dati immessi già esistenti vengono cancellati.

– L'accesso ai seguenti domini è effettivamente bloccato:
   • 127.0.0.1 msnfix.changelog.fr; 127.0.0.1 www.incodesolutions.com;
      127.0.0.1 virusinfo.prevx.com;
      127.0.0.1 download.bleepingcomputer.com; 127.0.0.1 www.dazhizhu.cn;
      127.0.0.1 foro.noticias3d.com; 127.0.0.1 www.nabble.com;
      127.0.0.1 lurker.clamav.net; 127.0.0.1 lexikon.ikarus.at;
      127.0.0.1 research.sunbelt-software.com; 127.0.0.1 www.virusdoctor.jp;
      127.0.0.1 www.elitepvpers.de; 127.0.0.1 www.superuser.co.kr;
      127.0.0.1 ntfaq.co.kr; 127.0.0.1 v.dreamwiz.com;
      127.0.0.1 cit.kookmin.ac.kr; 127.0.0.1 forums.whatthetech.com;
      127.0.0.1 forum.hijackthis.de; 127.0.0.1 www.huaifai.go.th;
      127.0.0.1 www.mostz.com; 127.0.0.1 www.krupunmai.com;
      127.0.0.1 www.cddchiangmai.net; 127.0.0.1 forum.malekal.com;
      127.0.0.1 tech.pantip.com; 127.0.0.1 sapcupgrades.com;
      127.0.0.1 www.247fixes.com; 127.0.0.1 forum.sysinternals.com;
      127.0.0.1 forum.telecharger.01net.com; 127.0.0.1 sophos.com;
      127.0.0.1 foros.softonic.com; 127.0.0.1 avast-home.uptodown.com;
      127.0.0.1 www.f-secure.com; 127.0.0.1 www.chkrootkit.org;
      127.0.0.1 diamondcs.com.au; 127.0.0.1 www.rootkit.nl;
      127.0.0.1 www.sysinternals.com; 127.0.0.1 z-oleg.com;
      127.0.0.1 espanol.dir.groups.yahoo.com; 127.0.0.1 www.castlecrops.com;
      127.0.0.1 www.misec.net; 127.0.0.1 safecomputing.umn.edu;
      127.0.0.1 www.antirootkit.com; 127.0.0.1 www.greatis.com;
      127.0.0.1 ar.answers.yahoo.com; 127.0.0.1 www.rootkit.com;
      127.0.0.1 www.pctools.com; 127.0.0.1 www.pcsupportadvisor.com;
      127.0.0.1 www.resplendence.com; 127.0.0.1 www.personal.psu.edu;
      127.0.0.1 foro.ethek.com; 127.0.0.1 vil.nail.comm;
      127.0.0.1 search.mcafee.com; 127.0.0.1 wwww.mcafee.com;
      127.0.0.1 download.nai.com; 127.0.0.1 wwww.experts-exchange.com;
      127.0.0.1 www.bakunos.com; 127.0.0.1 www.darkclockers.com;
      127.0.0.1 www.Merijn.org; 127.0.0.1 www.spywareinfo.com;
      127.0.0.1 www.spybot.info; 127.0.0.1 www.viruslist.com;
      127.0.0.1 www.hijackthis.de; 127.0.0.1 www.f-secure.com;
      127.0.0.1 forum.kaspersky.com; 127.0.0.1 majorgeeks.com;
      127.0.0.1 www.avp.com; 127.0.0.1 www.virustotal.com;
      127.0.0.1 www.sophos.com; 127.0.0.1 linhadefensiva.uol.com.br;
      127.0.0.1 cmmings.cn; 127.0.0.1 www.sergiwa.com;
      127.0.0.1 www.avg-antivirus.net; 127.0.0.1 www.kaspersky-labs.com;
      127.0.0.1 www.kaspersky.com; 127.0.0.1 www.bleepingcomputer.com;
      127.0.0.1 www.free.grisoft.com; 127.0.0.1 alerta-antivirus.inteco.es;
      127.0.0.1 securityresponse.symantec.com;
      127.0.0.1 www.analysis.seclab.tuwien.ac.at;
      127.0.0.1 www.symantec.com; 127.0.0.1 www.kztechs.com;
      127.0.0.1 ad-aware-se.uptodown.com;
      127.0.0.1 liveupdate.symantecliveupdate.com;
      127.0.0.1 liveupdate.symantec.com; 127.0.0.1 customer.symantec.com;
      127.0.0.1 update.symantec.com; 127.0.0.1 www.box.net;
      127.0.0.1 www.mcafee.com; 127.0.0.1 www.free.avg.com;
      127.0.0.1 download.mcafee.com; 127.0.0.1 mast.mcafee.com;
      127.0.0.1 www.tecno-soft.com; 127.0.0.1 ladooscuro.es;
      127.0.0.1 ftp.drweb.com; 127.0.0.1 guru0.grisoft.cz;
      127.0.0.1 guru1.grisoft.cz; 127.0.0.1 guru2.grisoft.cz;
      127.0.0.1 guru3.grisoft.cz; 127.0.0.1 download.bleepingcomputer.com;
      127.0.0.1 it.answers.yahoo.com; 127.0.0.1 guru4.grisoft.cz;
      127.0.0.1 guru5.grisoft.cz; 127.0.0.1 www.virusspy.com;
      127.0.0.1 www.download.f-secure.com; 127.0.0.1 www.malwareremoval.com;
      127.0.0.1 forums.cnet.com; 127.0.0.1 hjt-data.trend-braintree.com;
      127.0.0.1 www.pantip.com; 127.0.0.1 secubox.aldria.com;
      127.0.0.1 www.forospyware.com; 127.0.0.1 www.manuelruvalcaba.com;
      127.0.0.1 www.zonavirus.com; 127.0.0.1 www.siteadvisor.com;
      127.0.0.1 blog.threatfire.com; 127.0.0.1 www.threatexpert.com;
      127.0.0.1 blog.hispasec.com; 127.0.0.1 www.configurarequipos.com;
      127.0.0.1 sosvirus.changelog.fr; 127.0.0.1 mailcenter.rising.com.cn;
      127.0.0.1 mailcenter.rising.com; 127.0.0.1 www.rising.com.cn;
      127.0.0.1 www.rising.com; 127.0.0.1 www.babooforum.com.br;
      127.0.0.1 www.runscanner.net; 127.0.0.1 sosvirus.changelog.fr;
      127.0.0.1 upload.changelog.fr; 127.0.0.1 www.raymond.cc;
      127.0.0.1 changelog.fr; 127.0.0.1 www.pcentraide.com;
      127.0.0.1 atazita.blogspot.com; 127.0.0.1 www.thinkpad.cn;
      127.0.0.1 www.final4ever.com; 127.0.0.1 files.filefont.com;
      127.0.0.1 www.infos-du-net.com; 127.0.0.1 www.trendsecure.com;
      127.0.0.1 forum.hardware.fr;
      127.0.0.1 www.utilidades-utiles.comwww.spychecker.com;
      127.0.0.1 www.geekstogo.com; 127.0.0.1 forums.maddoktor2.com;
      127.0.0.1 www.smokey-services.eu; 127.0.0.1 www.clubic.com;
      127.0.0.1 www.linhadefensiva.org; 127.0.0.1 download.sysinternals.com;
      127.0.0.1 www.pcguide.com; 127.0.0.1 www.thetechguide.com;
      127.0.0.1 www.ozzu.com; 127.0.0.1 www.changedetection.com;
      127.0.0.1 espanol.groups.yahoo.com; 127.0.0.1 community.thaiware.com;
      127.0.0.1 www.avpclub.ddns.info; 127.0.0.1 www.offensivecomputing.net;
      127.0.0.1 www.grisoft.com; 127.0.0.1 boardreader.com;
      127.0.0.1 www.guiadohardware.net; 127.0.0.1 www.msnvirusremoval.com;
      127.0.0.1 www.cisrt.org; 127.0.0.1 fixmyim.com;
      127.0.0.1 samroeng.hi5.com; 127.0.0.1 foro.elhacker.net;
      127.0.0.1 www.daboweb.com; 127.0.0.1 service1.symantec.com;
      127.0.0.1 forums.techguy.org; 127.0.0.1 www.incodesolutions.com;
      127.0.0.1 hijackthis.download3000.com;
      127.0.0.1 www.cybertechhelp.com; 127.0.0.1 www.superdicas.com.br;
      127.0.0.1 www.51nb.com; 127.0.0.1 downloads.andymanchesta.com;
      127.0.0.1 andymanchesta.com; 127.0.0.1 info.prevx.com;
      127.0.0.1 aknow.prevx.com; 127.0.0.1 www.zonavirus.com;
      127.0.0.1 securitywonks.net; 127.0.0.1 www.lavasoft.com;
      127.0.0.1 www.virscan.org; 127.0.0.1 www.eeload.com;
      127.0.0.1 down.www.kingsoft.com; 127.0.0.1 www.file.net;
      127.0.0.1 onecare.live.com; 127.0.0.1 mvps.org;
      127.0.0.1 www.laneros.com; 127.0.0.1 www.housecall.trendmicro.com;
      127.0.0.1 www.avast.com; 127.0.0.1 www.free.avg.com;
      127.0.0.1 www.onlinescan.avast.com; 127.0.0.1 www.ewido.net;
      127.0.0.1 www.trucoswindows.net;
      127.0.0.1 www.futurenow.bitdefender.com;
      127.0.0.1 www.bitdefender.com; 127.0.0.1 www.f-prot.com;
      127.0.0.1 www.trendsecure.com; 127.0.0.1 security.symantec.com;
      127.0.0.1 oldtimer.geekstogo.com; 127.0.0.1 www.avira.com;
      127.0.0.1 www.eset.com; 127.0.0.1 www.free.avg.com;
      127.0.0.1 www.free-av.com; 127.0.0.1 kr.ahnlab.com;
      127.0.0.1 www.eset.com; 127.0.0.1 forospyware.com;
      127.0.0.1 thejokerx.blogspot.com; 127.0.0.1 www.2-spyware.com;
      127.0.0.1 www.antivir.es; 127.0.0.1 www.prevx.com;
      127.0.0.1 www.ikarus.net; 127.0.0.1 bbs.s-sos.net;
      127.0.0.1 www.housecall.trendmicro.com;
      127.0.0.1 www.superdicas.com.br; 127.0.0.1 www.forums.majorgeeks.com;
      127.0.0.1 www.castlecops.com; 127.0.0.1 www.virusspy.com;
      127.0.0.1 andymanchesta.com; 127.0.0.1 www.kaspersky.es;
      127.0.0.1 subs.geekstogo.com; 127.0.0.1 www.trendmicro.com;
      127.0.0.1 www.fortinet.com; 127.0.0.1 www.safer-networking.org;
      127.0.0.1 www.fortiguardcenter.com; 127.0.0.1 www.dougknox.com;
      127.0.0.1 www.vsantivirus.com; 127.0.0.1 www.firewallguide.com;
      127.0.0.1 www.auditmypc.com; 127.0.0.1 www.spywaredb.com;
      127.0.0.1 www.mxttchina.com; 127.0.0.1 www.ziggamza.net;
      127.0.0.1 www.forospyware.es; 127.0.0.1 www.antivirus.comodo.com;
      127.0.0.1 www.spywareterminator.com;
      127.0.0.1 www.eradicatespyware.net;
      127.0.0.1 www.freespywareremoval.info;
      127.0.0.1 www.personalfirewall.comodo.com; 127.0.0.1 www.clamav.net;
      127.0.0.1 www.antivirus.about.com; 127.0.0.1 www.pandasecurity.com;
      127.0.0.1 www.webphand.com; 127.0.0.1 mx.answers.yahoo.com;
      127.0.0.1 www.securitywonks.net; 127.0.0.1 www.sandboxie.com;
      127.0.0.1 www.clamwin.com; 127.0.0.1 www.cwsandbox.org;
      127.0.0.1 www.ca.com; 127.0.0.1 www.arswp.com;
      127.0.0.1 es.answers.yahoo.com; 127.0.0.1 www.trucoswindows.es;
      127.0.0.1 www.networkworld.com; 127.0.0.1 www.cddchiangmai.net;
      127.0.0.1 www.threatexpert.com; 127.0.0.1 www.norman.com;
      127.0.0.1 espanol.answers.yahoo.com; 127.0.0.1 www.tallemu.com;
      127.0.0.1 virscan.org; 127.0.0.1 www.viruschief.com;
      127.0.0.1 scanner.virus.org; 127.0.0.1 www.hijackthis.de;
      127.0.0.1 housecall65.trendmicro.com;
      127.0.0.1 www.guiadohardware.net; 127.0.0.1 hjt.networktechs.com;
      127.0.0.1 www.techsupportforum.com; 127.0.0.1 www.whatthetech.com;
      127.0.0.1 www.soccersuck.com; 127.0.0.1 www.pcentraide.com;
      127.0.0.1 comunidad.wilkinsonpc.com.co; 127.0.0.1 forum.piriform.com;
      127.0.0.1 www.tweaksforgeeks.com; 127.0.0.1 www.daniweb.com;
      127.0.0.1 www.geekstogo.com; 127.0.0.1 es.answers.yahoo.com;
      127.0.0.1 www.techsupportforum.com; 127.0.0.1 www.pchell.com;
      127.0.0.1 www.spyany.com; 127.0.0.1 forums.techguy.org;
      127.0.0.1 www.experts-exchange.com; 127.0.0.1 www.wikio.es;
      127.0.0.1 www.pandasecurity.com; 127.0.0.1 forums.devshed.com;
      127.0.0.1 forum.tweaks.com; 127.0.0.1 www.wilderssecurity.com;
      127.0.0.1 www.techspot.com; 127.0.0.1 www.thecomputerpitstop.com;
      127.0.0.1 es.wasalive.com; 127.0.0.1 secunia.com;
      127.0.0.1 es.kioskea.net; 127.0.0.1 www.taringa.net;
      127.0.0.1 www.cyberdefender.com; 127.0.0.1 www.feedage.com;
      127.0.0.1 new.taringa.net; 127.0.0.1 forum.zazana.com;
      127.0.0.1 forum.clubedohardware.com.br; 127.0.0.1 www.computing.net;
      127.0.0.1 discussions.virtualdr.com;
      127.0.0.1 forum.securitycadets.com; 127.0.0.1 www.techimo.com;
      127.0.0.1 13iii.com; 127.0.0.1 www.dicasweb.com.br;
      127.0.0.1 www.infosecpodcast.com; 127.0.0.1 www.usbcleaner.cn;
      127.0.0.1 www.net-security.org; 127.0.0.1 www.bleedingthreats.net;
      127.0.0.1 acs.pandasoftware.com; 127.0.0.1 www.funkytoad.com;
      127.0.0.1 www.360safe.cn; 127.0.0.1 www.360safe.com;
      127.0.0.1 bbs.360safe.cn; 127.0.0.1 bbs.360safe.com;
      127.0.0.1 codehard.wordpress.com;
      127.0.0.1 forum.clubedohardware.com.br; 127.0.0.1 www.360.cn;
      127.0.0.1 www.360.com; 127.0.0.1 bbs.360safe.cn;
      127.0.0.1 bbs.360safe.com; 127.0.0.1 www.forospyware.es;
      127.0.0.1 p3dev.taringa.net; 127.0.0.1 www.precisesecurity.com;
      127.0.0.1 baike.360.cn; 127.0.0.1 baike.360.com;
      127.0.0.1 kaba.360.cn; 127.0.0.1 kaba.360.com;
      127.0.0.1 deckard.geekstogo.com; 127.0.0.1 www.taringa.net;
      127.0.0.1 forums.comodo.com; 127.0.0.1 www.mvps.org;
      127.0.0.1 down.360safe.cn; 127.0.0.1 down.360safe.com;
      127.0.0.1 x.360safe.com; 127.0.0.1 dl.360safe.com;
      127.0.0.1 ftp.drweb.com; 127.0.0.1 www.hotshare.net;
      127.0.0.1 es.wasalive.com; 127.0.0.1 support.cmclab.net;
      127.0.0.1 updatem.360safe.com; 127.0.0.1 updatem.360safe.cn;
      127.0.0.1 update.360safe.cn; 127.0.0.1 update.360safe.com;
      127.0.0.1 www.utilidades-utiles.com; 127.0.0.1 forum.kaspersky.com;
      127.0.0.1 bbs.duba.net; 127.0.0.1 www.duba.net;
      127.0.0.1 zhidao.baidu.com; 127.0.0.1 hi.baidu.com;
      127.0.0.1 www.drweb.com.es; 127.0.0.1 msncleaner.softonic.com;
      127.0.0.1 www.javacoolsoftware.com; 127.0.0.1 file.ikaka.com;
      127.0.0.1 file.ikaka.cn; 127.0.0.1 bbs.ikaka.com;
      127.0.0.1 zhidao.ikaka.com; 127.0.0.1 www.eset-la.com;
      127.0.0.1 www.eset-la.com; 127.0.0.1 software-files.download.com;
      127.0.0.1 www.ikaka.com; 127.0.0.1 www.ikaka.cn;
      127.0.0.1 bbs.cfan.com.cn; 127.0.0.1 www.cfan.com.cn;
      127.0.0.1 www.pandasecurity.com; 127.0.0.1 es.mcafee.com;
      127.0.0.1 downloads.malwarebytes.org; 127.0.0.1 bbs.kafan.cn;
      127.0.0.1 bbs.kafan.com; 127.0.0.1 bbs.kpfans.com;
      127.0.0.1 bbs.taisha.org; 127.0.0.1 www.manuelruvalcaba.com;
      127.0.0.1 support.f-secure.com; 127.0.0.1 bbs.winzheng.com;
      127.0.0.1 alerta-antivirus.inteco.es; 127.0.0.1 foros.zonavirus.com;
      127.0.0.1 alerta-antivirus.red.es; 127.0.0.1 www.zonavirus.com;
      127.0.0.1 www.malwarebytes.org; 127.0.0.1 www.commentcamarche.net;
      127.0.0.1 www.ewido.net; 127.0.0.1 www.infospyware.com;
      127.0.0.1 www.bitdefender.es; 127.0.0.1 housecall.trendmicro.com;
      127.0.0.1 foros.toxico-pc.com; 127.0.0.1 www.d-a-l.com;
      127.0.0.1 www.beartai.com; 127.0.0.1 www.emsisoft.de;
      127.0.0.1 www.securitynewsportal.com


 Backdoor Viene aperta la seguente porta:

– %SYSDIR%\wbem\wmiclisv.exe sulla porta TCP 23860 con lo scopo di procurarsi un server HTTP.

 Varie Anti debugging
Verifica se è presente uno dei seguenti file:
   • \\.\SICE
   • \\.\SIWVID
   • \\.\NTICE


 Tecnologia Rootkit Nasconde il seguente:
– Il proprio processo


Metodo utilizzato:
    • Nascosto dalle Windows API

 Dettagli del file Software di compressione:
Per complicarne l'individuazione e ridurre la dimensione del file, viene compresso con un software di compressione.

Descrizione inserita da Petre Galan su venerdì 12 febbraio 2010
Descrizione aggiornata da Petre Galan su venerdì 12 febbraio 2010

Indietro . . . .