PCの修理が必要ですか?
専門家に頼む
????Worm/Bagle.DM
????13/12/2012
??????
?????????
?????
?????????
??????????????
?????????????
????????21.232 ???
MD5???????43e014ce23862dbc0efcbcccd05d6ac6
VDF???????7.11.53.216

 ???? ????
   • E???
   • P2P(??????)


??
   •  Symantec: w32.bEAGLE.cl@MM
   •  Kaspersky: eMAIL-wORM.wIN32.bAGLE.DX
   •  TrendMicro: worm_bagle.bt
   •  Bitdefender: wIN32.bAGLE.an@MM


????????/OS?
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


???
   • ???????????????
   • ????????????????????
   • ????????????????
   • ?????????

 ???? ??????????????????
   • %SYSDIR%\winhost.exe




???????????????????

???????????
   • http://www.**********goods.com/img/3.exe
?????????????????????? %WINDIR%\test.exe ???????????????????? ????????????????????????????????????????????????????????

???????????
   • http://64.**********.145/ip.txt
?????????????????????? %WINDIR%\ip.txt ????????????????????????????????????????????????????????

 ????? ??????????????????????????????????????????

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "winhost.exe"="%SYSDIR%\winhost.exe"



???????????????????

[HKCU\Software\Timeout]
   • "uid"="%?????%"
   • "port"=dword:0000234b
   • "pid"=dword:%hex ??%

 E??? ???????????SMTP??????????????????????????????????????????????


???
?????????????????(spoof)?


??:
– ??????????????????????


??
??????
   • Changes..; Encrypted document; Fax Message; Forum notify; Incoming
      message; Notification; Protected message; Re:; Re: Document; Re:
      Hello; Re: Hi; Re: Incoming Message; RE: Incoming Msg; RE: Message
      Notify; Re: Msg reply; RE: Protected message; RE: Text message; Re:
      Thank you!; Re: Thanks :); Re: Yahoo!; Site changes; Update



??
???????????????????

   • Attach tells everything.
     Attached file tells everything.
     Check attached file for details.
     Check attached file.
     Here is the file.
     Message is in attach
     More info is in attach
     Pay attention at the attach.
     Please, have a look at the attached file.
     Please, read the document.
     Read the attach.
     See attach.
     See the attached file for details.
     Try this.
     Your document is attached.
     Your file is attached.


???????????

   • Archive password: "%????????????%
     Attached file is protected with the password for security reasons. Password is "%????????????%
     For security purposes the attached file is password protected. Password -- "%????????????%
     For security reasons attached file is password protected. The password is "%????????????%In order to read the attach you have to use the following password: "%????????????%
     Note: Use password "%????????????% to open archive.
     Password - "%????????????%
     Password: "%????????????%


??????
???????????
   • Information.exe
   • Details.exe
   • text_document.exe
   • Updates.exe
   • Readme.exe
   • Document.exe
   • Info.exe
   • Details.exe
   • MoreInfo.exe
   • Message.exe
   • Sources.exe

??????????????????????

 ?? ????????
???????????????????????
   • .adb; .asp; .cfg; .dbx; .dhtm; .eml; .htm; .html; .jsp; .mbx; .mdx;
      .mht; .mmf; .msg; .nch; .ods; .oft; .php; .sht; .shtm; .shtml; .stm;
      .tbb; .txt; .uin; .wab; .wsh; .xls; .xml


???????????
??????????????????????????
   • @avp.; @foo; @hotmail.com; @iana; @messagelab; @microsoft; @msn.com;
      abuse; admin; anyone@; bsd; bugs@; cafee; certific; contract@; feste;
      free-av; f-secur; gold-certs@; google; help@; icrosoft; info@; kasp;
      linux; listserv; local; news; nobody@; noone@; noreply; ntivi; panda;
      pgp; postmaster@; rating@; root@; samples; sopho; spam; support; unix;
      update; winrar; winzip

 P2P P2P(??????)?????????????????????????????????????   ??????????(substring)????????????????
   • shar

   ?????????????????????
   • 12 year old Katia ********** young whore school lolita.avi
       .exe; Adobe Photoshop 9 full.exe; Ahead Nero 7.exe; Doom3_nocd.exe;
      HalfLife2_noCD.exe; Kaspersky Antivirus 5.0; KAV 5.0; Lolita porn.avi
       .exe; Matrix 3 Revolution English
      Subtitles.exe; Microsoft Office 2003 Crack, Working!.exe; Microsoft
      Office XP working Crack, Keygen.exe; Microsoft Windows XP, WinXP
      Crack, working Keygen.exe; Norton Antivirus, working Keygen.exe; nude
      lolita.jpg .exe; Opera 8 New!.exe;
      Porno pics arhive, xxx.exe; Porno Screensaver.scr; Porno, **********cool, awesome!!.exe; Serials.txt.exe; WinAmp 5 Pro
      Keygen Crack Update.exe; WinAmp 6 New!.exe; Windown Longhorn Beta
      Leak.exe; Windows Sourcecode update.doc.exe; XXX hardcore images.exe

   ???????????????????????

 ?????? ???????????????
   • AGENTSVR.EXE; ANTI-TROJAN.EXE; ANTIVIRUS.EXE; ANTS.EXE;
      APIMONITOR.EXE; APLICA32.EXE; APVXDWIN.EXE; ATCON.EXE; ATGUARD.EXE;
      ATRO55EN.EXE; ATUPDATER.EXE; ATWATCH.EXE; AUPDATE.EXE; AUTODOWN.EXE;
      AUTOTRACE.EXE; AUTOUPDATE.EXE; AVCONSOL.EXE; AVGSERV9.EXE;
      AVLTMAIN.EXE; AVprotect9x.exe; AVPUPD.EXE; AVSYNMGR.EXE; AVWUPD32.EXE;
      AVXQUAR.EXE; BD_PROFESSIONAL.EXE; BIDEF.EXE; BIDSERVER.EXE; BIPCP.EXE;
      BIPCPEVALSETUP.EXE; BISP.EXE; BLACKD.EXE; BLACKICE.EXE; BOOTWARN.EXE;
      BORG2.EXE; BS120.EXE; ccApp.exe; ccEvtMgr.exe; CDP.EXE; CFGWIZ.EXE;
      CFIADMIN.EXE; CFIAUDIT.EXE; CFIAUDIT.EXE; CFIAUDIT.EXE; CFINET.EXE;
      CFINET.EXE; CFINET32.EXE; CLEAN.EXE; CLEANER.EXE; CLEANER3.EXE;
      CLEANPC.EXE; CLEANPC.EXE; CMGRDIAN.EXE; CMGRDIAN.EXE; CMON016.EXE;
      CMON016.EXE; CPD.EXE; CPF9X206.EXE; CPFNT206.EXE; CV.EXE; CWNB181.EXE;
      CWNTDWMO.EXE; DEFWATCH.EXE; DEPUTY.EXE; DPF.EXE; DPFSETUP.EXE;
      DRWATSON.EXE; DRWEBUPW.EXE; ENT.EXE; ESCANH95.EXE; ESCANHNT.EXE;
      ESCANV95.EXE; EXANTIVIRUS-CNET.EXE; FAST.EXE; FIREWALL.EXE;
      FLOWPROTECTOR.EXE; FP-WIN_TRIAL.EXE; FRW.EXE; FSAV.EXE;
      FSAV530STBYB.EXE; FSAV530WTBYB.EXE; FSAV95.EXE; GBMENU.EXE;
      GBPOLL.EXE; GUARD.EXE; GUARDDOG.EXE; HACKTRACERSETUP.EXE; HTLOG.EXE;
      HWPE.EXE; IAMAPP.EXE; IAMAPP.EXE; IAMSERV.EXE; ICLOAD95.EXE;
      ICLOADNT.EXE; ICMON.EXE; ICSSUPPNT.EXE; ICSUPP95.EXE; ICSUPPNT.EXE;
      IFW2000.EXE; IPARMOR.EXE; IRIS.EXE; JAMMER.EXE; KAVLITE40ENG.EXE;
      KAVPERS40ENG.EXE; KERIO-PF-213-EN-WIN.EXE; KERIO-WRL-421-EN-WIN.EXE;
      KERIO-WRP-421-EN-WIN.EXE; KILLPROCESSSETUP161.EXE; LDPRO.EXE;
      LOCALNET.EXE; LOCKDOWN.EXE; LOCKDOWN2000.EXE; LSETUP.EXE; LUALL.EXE;
      LUCOMSERVER.EXE; LUINIT.EXE; MCAGENT.EXE; MCUPDATE.EXE; MCUPDATE.EXE;
      MFW2EN.EXE; MFWENG3.02D30.EXE; MGUI.EXE; MINILOG.EXE; MOOLIVE.EXE;
      MRFLUX.EXE; MSCONFIG.EXE; MSINFO32.EXE; MSSMMC32.EXE; MU0311AD.EXE;
      NAV80TRY.EXE; navapsvc.exe; NAVAPW32.EXE; NAVDX.EXE; NavShExt.dll;
      NAVSTUB.EXE; NAVW32.EXE; NC2000.EXE; NCINST4.EXE; NDD32.EXE;
      NEOMONITOR.EXE; NETARMOR.EXE; NETINFO.EXE; NETMON.EXE; NETSCANPRO.EXE;
      NETSPYHUNTER-1.2.EXE; NETSTAT.EXE; NISSERV.EXE; NMAIN.EXE;
      NORTON_INTERNET_SECU_3.0_407.EXE; NPF40_TW_98_NT_ME_2K.EXE;
      NPFMESSENGER.EXE; NPROTECT.EXE; NPROTECT.EXE; NSCHED32.EXE; NTVDM.EXE;
      NUPGRADE.EXE; NVARCH16.EXE; NWINST4.EXE; NWTOOL16.EXE; OSTRONET.EXE;
      OUTPOST.EXE; OUTPOSTINSTALL.EXE; OUTPOSTPROINSTALL.EXE; PADMIN.EXE;
      PANIXK.EXE; PAVPROXY.EXE; PCC2002S902.EXE; PCC2K_76_1436.EXE;
      PCCIOMON.EXE; PCDSETUP.EXE; PCFWALLICON.EXE; PCFWALLICON.EXE;
      PCIP10117_0.EXE; PDSETUP.EXE; PERISCOPE.EXE; PERSFW.EXE; PF2.EXE;
      PFWADMIN.EXE; PINGSCAN.EXE; PLATIN.EXE; POPROXY.EXE; POPSCAN.EXE;
      PORTDETECTIVE.EXE; PPINUPDT.EXE; PPTBC.EXE; PPVSTOP.EXE;
      PROCEXPLORERV1.0.EXE; PROPORT.EXE; PROTECTX.EXE; PSPF.EXE;
      QCONSOLE.EXE; QSERVER.EXE; REGEDIT.EXE; REGEDT32.EXE; RESCUE.EXE;
      RESCUE32.EXE; RRGUARD.EXE; RSHELL.EXE; RULAUNCH.EXE; SAFEWEB.EXE;
      SAVSCAN.EXE; SBSERV.EXE; SD.EXE; SETUP_FLOWPROTECTOR_US.EXE;
      SETUPVAMEEVAL.EXE; SFC.EXE; SGSSFW32.EXE; SH.EXE; SHELLSPYINSTALL.EXE;
      SymWSC.exe; SYSEDIT.EXE; TAUMON.EXE; TAUSCAN.EXE; TRACERT.EXE;
      TRJSCAN.EXE; TRJSETUP.EXE; TROJANTRAP3.EXE; UNDOBOOT.EXE; UPDATE.EXE;
      VBCMSERV.EXE; VBCONS.EXE; VBUST.EXE; VIRUSMDPERSONALFIREWALL.EXE;
      W32DSM89.EXE; WATCHDOG.EXE; WEBSCANX.EXE; WHOSWATCHINGME.EXE;
      WINRECON.EXE; WNT.EXE; WRADMIN.EXE; WRCTRL.EXE; WSBGATE.EXE;
      WYVERNWORKSFIREWALL.EXE; XPF202EN.EXE; ZONALM2601.EXE; ZONEALARM.EXE


 ????? ?????????????

winhost.exe TCP???? 9035


??????????
????????????
   • http://64.12.**********/in.php
   • http://64.246.**********/init.php
   • http://68.24.**********/in.php
   • http://biiig.**********/init.php
   • http://blockism.**********/img/ini.php
   • http://motivethree.**********/img/in.php
   • http://nine-one**********/images/in.php
   • http://paromy.**********/_old_img/in.php
   • http://**********.com/init.php
   • http://**********forum.ru/init.php
   • http://**********2k.com/img/ini.php
   • http://**********phops.com
   • http://**********arisi.net/init.php
   • http://www.card**********.com/img/ini.php
   • http://www.evo**********.com/img/in.php
   • http://www.lady**********.com/in.php
   • http://za**********.net/init.php


 ??????? ??????????
?????????????????????????????????????????????????????
   • FSG 1.33

説明の挿入者 Iulia Diaconescu の 2005年10月10日月曜日
説明の更新者 Iulia Diaconescu の 2005年10月17日月曜日

戻る . . . .
https:// このウィンドウは暗号化されています。