PCの修理が必要ですか?
専門家に頼む
Virus:TR/Drop.Agent.83968
Date discovered:01/12/2009
Type:Trojan
Subtype:Dropper
In the wild:Yes
Reported Infections:Low to medium
Distribution Potential:Low to medium
Damage Potential:Medium
Static file:Yes
File size:83.968 Bytes
MD5 checksum:eb5577ee02bfd94320ddee505f03f25e
IVDF version:7.10.01.126 - Tuesday, December 1, 2009

 General Method of propagation:
   • Autorun feature
   • Local network
   • Messenger


Aliases:
   •  Mcafee: W32/Sdbot.worm
   •  Sophos: Troj/Agent-MNE
   •  Panda: W32/IRCbot.CVC
   •  Eset: Win32/AutoRun.IRCBot.DI
   •  Bitdefender: Backdoor.IRCBot.ACWT


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Drops malicious files
   • Lowers security settings
   • Registry modification
   • Third party control

 Files It copies itself to the following locations:
   • %SYSDIR%\wmisrpd.exe
   • %drive%\.DEBUG-93013\drvf.sys



It deletes the initially executed copy of itself.



It deletes the following file:
   • %SYSDIR%\drivers\etc\hosts



The following files are created:

%drive%\autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

%SYSDIR%\drivers\kernelx86.sys Further investigation pointed out that this file is malware, too. Detected as: TR/Patched.jlw




It tries to executes the following files:

– Filename:
   • "%SYSDIR%\wmisrpd.exe"


– Filename:
   • sc config "avast! Antivirus" start= disabled


– Filename:
   • CMD /C net stop AntiVirService


– Filename:
   • sc delete "avast! Antivirus"


– Filename:
   • CMD /C sc stop AntiVirService


– Filename:
   • net1 stop "avast! Antivirus"


– Filename:
   • net stop AntiVirService


– Filename:
   • CMD /C sc config AntiVirService start= disabled


– Filename:
   • sc stop AntiVirService


– Filename:
   • net1 stop AntiVirService


– Filename:
   • CMD /C sc delete AntiVirService


– Filename:
   • CMD /C del /F /S /Q *.zip


– Filename:
   • sc config AntiVirService start= disabled


– Filename:
   • CMD /C net stop PASRV


– Filename:
   • CMD /C sc stop PASRV


– Filename:
   • sc delete AntiVirService


– Filename:
   • net stop PASRV


– Filename:
   • CMD /C sc config PASRV start= disabled


– Filename:
   • sc stop PASRV


– Filename:
   • net1 stop PASRV


– Filename:
   • CMD /C sc delete PASRV


– Filename:
   • sc config PASRV start= disabled


– Filename:
   • %SYSDIR%\wmisrpd.exe


– Filename:
   • CMD /C net stop VSSERV


– Filename:
   • CMD /C sc stop VSSERV


– Filename:
   • sc delete PASRV


– Filename:
   • net stop VSSERV


– Filename:
   • CMD /C sc config VSSERV start= disabled


– Filename:
   • sc stop VSSERV


– Filename:
   • CMD /C sc delete VSSERV


– Filename:
   • net1 stop VSSERV


– Filename:
   • sc config VSSERV start= disabled


– Filename:
   • CMD /C net stop avg8wd


– Filename:
   • CMD /C net stop "avast! Antivirus"


– Filename:
   • sc delete VSSERV


– Filename:
   • CMD /C sc stop avg8wd


– Filename:
   • CMD /C sc config avg8wd start= disabled


– Filename:
   • net stop avg8wd


– Filename:
   • sc stop avg8wd


– Filename:
   • CMD /C sc delete avg8wd


– Filename:
   • net1 stop avg8wd


– Filename:
   • sc config avg8wd start= disabled


– Filename:
   • CMD /C net stop NOD32krn


– Filename:
   • sc delete avg8wd


– Filename:
   • ipconfig /flushdns


– Filename:
   • CMD /C sc stop NOD32krn


– Filename:
   • CMD /C sc config NOD32krn start= disabled


– Filename:
   • net stop NOD32krn


– Filename:
   • sc stop NOD32krn


– Filename:
   • net1 stop NOD32krn


– Filename:
   • sc config NOD32krn start= disabled


– Filename:
   • CMD /C sc delete NOD32krn


– Filename:
   • CMD /C net stop SbPF.Launcher


– Filename:
   • CMD /C sc stop SbPF.Launcher


– Filename:
   • sc delete NOD32krn


– Filename:
   • CMD /C sc stop "avast! Antivirus"


– Filename:
   • net stop SbPF.Launcher


– Filename:
   • CMD /C sc config SbPF.Launcher start= disabled


– Filename:
   • sc stop SbPF.Launcher


– Filename:
   • net1 stop SbPF.Launcher


– Filename:
   • sc config SbPF.Launcher start= disabled


– Filename:
   • CMD /C sc delete SbPF.Launcher


– Filename:
   • CMD /C net stop SPF4


– Filename:
   • sc delete SbPF.Launcher


– Filename:
   • CMD /C sc stop SPF4


– Filename:
   • CMD /C sc config SPF4 start= disabled


– Filename:
   • CMD /C sc config "avast! Antivirus" start= disabled


– Filename:
   • net stop SPF4


– Filename:
   • sc stop SPF4


– Filename:
   • CMD /C sc delete SPF4


– Filename:
   • net1 stop SPF4


– Filename:
   • sc config SPF4 start= disabled


– Filename:
   • CMD /C net stop acssrv


– Filename:
   • sc delete SPF4


– Filename:
   • CMD /C sc stop acssrv


– Filename:
   • net stop acssrv


– Filename:
   • CMD /C sc config acssrv start= disabled


– Filename:
   • net stop "avast! Antivirus"


– Filename:
   • sc stop acssrv


– Filename:
   • CMD /C sc delete acssrv


– Filename:
   • net1 stop acssrv


– Filename:
   • sc config acssrv start= disabled


– Filename:
   • sc delete acssrv


– Filename:
   • CMD /C sc delete "avast! Antivirus"


– Filename:
   • sc stop "avast! Antivirus"

 Registry The following registry key is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "ctfmon.exe"="ctfmon.exe"



It creates the following entries in order to bypass the Windows XP firewall:

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\DomainProfile\AuthorizedApplications\List]
   • "%SYSDIR%\wmisrpd.exe"="%SYSDIR%\wmisrpd.exe:*:Enabled:Windows Live"



The following registry keys are added:

– [HKLM\SOFTWARE\Policies\Microsoft\MRT]
   • "DontReportInfectionInformation"=dword:0x00000001

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions]
   • "GON"="%executed file%"

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
   Image File Execution Options\ctfmon.exe]
   • "Debugger"="wmisrpd.exe"

– [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal]
   • "ctfmon.exe"="ctfmon.exe"

– [HKLM\SOFTWARE\Microsoft\Security Center]
   • "AntiVirusDisableNotify"=dword:0x00000001
   • "AntiVirusOverride"=dword:0x00000001
   • "FirewallDisableNotify"=dword:0x00000001
   • "FirewallOverride"=dword:0x00000001

– [HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
   • "DisableConfig"=dword:0x00000001

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\
   Layers]
   • "%SYSDIR%\wmisrpd.exe"="DisableNXShowUI"

– [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network]
   • "ctfmon.exe"="ctfmon.exe"

– [HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
   • "DoNotAllowXPSP2"=dword:0x00000001



The following registry keys are changed:

– [HKLM\SYSTEM\CurrentControlSet\Services\wscsvc]
   New value:
   • "Start"=dword:0x00000004

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
   New value:
   • "DisableSR"=dword:0x00000001

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   New value:
   • "Hidden"=dword:0x00000002

Various Explorer settings:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
   Folder\SuperHidden]
   New value:
   • "CheckedValue"=dword:0x00000001

– [HKLM\SYSTEM\CurrentControlSet\Control\Lsa]
   New value:
   • "restrictanonymous"=dword:0x00000001

– [HKLM\SOFTWARE\Microsoft\Ole]
   New value:
   • "EnableDCOM"="N"

 Messenger It is spreading via Messenger. The characteristics are described below:

– AIM Messenger
– MSN Messenger

The URL then refers to a copy of the described malware. If the user downloads and executes this file the infection process will start again.

 Network Infection In order to ensure its propagation the malware attemps to connect to other machines as described below.


Exploit:
It makes use of the following Exploits:
– MS04-007 (ASN.1 Vulnerability)
– MS06-040 (Vulnerability in Server Service)


IP address generation:
It creates random IP addresses while it keeps the first octet from its own address. Afterwards it tries to establish a connection with the created addresses.


Remote execution:
–It attempts to schedule a remote execution of the malware, on the newly infected machine. Therefore it uses the NetScheduleJobAdd function.

 IRC To deliver system information and to provide remote control it connects to the following IRC Servers:

Server: replicate.srv**********.info
Port: 31960
Channel: #w1sd0m
Nickname: [00|USA|XP|%number%]

Server: apophis.dwn**********.info
Port: 36019
Channel: #w1sd0m
Nickname: [00|USA|XP|%number%]

Server: merlin.fla**********.info
Port: 51930
Channel: #w1sd0m
Nickname: [00|USA|XP|%number%]

Server: ancient.srv**********.info
Port: 52740
Channel: #w1sd0m
Nickname: [00|USA|XP|%number%]

Server: jackson.upd**********.info
Port: 35920
Channel: #w1sd0m
Nickname: [00|USA|XP|%number%]

Server: jackson.upd**********.info
Port: 48912
Channel: #w1sd0m
Nickname: [00|USA|XP|%number%]

 Hosts The host file is modified as explained:

– In this case already existing entries remain unmodified.

– Access to the following domains are redirected to other destinations:
   • 209.85.225.99 msnfix.changelog.fr;
      209.85.225.99 www.incodesolutions.com;
      209.85.225.99 virusinfo.prevx.com;
      209.85.225.99 download.bleepingcomputer.com;
      209.85.225.99 www.dazhizhu.cn; 209.85.225.99 foro.noticias3d.com;
      209.85.225.99 www.spybotupdates.com; 209.85.225.99 www.nabble.com;
      209.85.225.99 lurker.clamav.net; 209.85.225.99 lexikon.ikarus.at;
      209.85.225.99 research.sunbelt-software.com;
      209.85.225.99 www.virusdoctor.jp; 209.85.225.99 www.elitepvpers.de;
      209.85.225.99 guru.avg.com; 209.85.225.99 downloads.sophos.com;
      209.85.225.99 www.superuser.co.kr; 209.85.225.99 ntfaq.co.kr;
      209.85.225.99 v.dreamwiz.com; 209.85.225.99 cit.kookmin.ac.kr;
      209.85.225.99 forums.whatthetech.com;
      209.85.225.99 forum.hijackthis.de; 209.85.225.99 avg.vo.llnwd.net;
      209.85.225.99 ftp.drweb.com; 209.85.225.99 www.zonealarm.com;
      209.85.225.99 www.huaifai.go.th; 209.85.225.99 www.mostz.com;
      209.85.225.99 www.krupunmai.com; 209.85.225.99 www.cddchiangmai.net;
      209.85.225.99 forum.malekal.com; 209.85.225.99 tech.pantip.com;
      209.85.225.99 sapcupgrades.com;
      209.85.225.99 www.elguruinformatico.com;
      209.85.225.99 www.247fixes.com; 209.85.225.99 forum.sysinternals.com;
      209.85.225.99 forum.telecharger.01net.com; 209.85.225.99 sophos.com;
      209.85.225.99 foros.softonic.com;
      209.85.225.99 avast-home.uptodown.com;
      209.85.225.99 dr-web-cureit.softonic.com;
      209.85.225.99 www.f-secure.com; 209.85.225.99 www.chkrootkit.org;
      209.85.225.99 diamondcs.com.au; 209.85.225.99 www.rootkit.nl;
      209.85.225.99 www.sysinternals.com; 209.85.225.99 z-oleg.com;
      209.85.225.99 espanol.dir.groups.yahoo.com;
      209.85.225.99 ftp01net.telechargement.fr;
      209.85.225.99 www.castlecrops.com; 209.85.225.99 www.misec.net;
      209.85.225.99 safecomputing.umn.edu;
      209.85.225.99 www.antirootkit.com; 209.85.225.99 www.greatis.com;
      209.85.225.99 ar.answers.yahoo.com; 209.85.225.99 www.elhacker.org;
      209.85.225.99 research.pandasecurity.com;
      209.85.225.99 www.rootkit.com; 209.85.225.99 www.pctools.com;
      209.85.225.99 www.pcsupportadvisor.com;
      209.85.225.99 www.resplendence.com;
      209.85.225.99 www.personal.psu.edu; 209.85.225.99 foro.ethek.com;
      209.85.225.99 foro.elhacker.net; 209.85.225.99 download.zonealarm.com;
      209.85.225.99 vil.nail.com; 209.85.225.99 search.mcafee.com;
      209.85.225.99 wwww.mcafee.com; 209.85.225.99 download.nai.com;
      209.85.225.99 wwww.experts-exchange.com;
      209.85.225.99 www.bakunos.com; 209.85.225.99 www.darkclockers.com;
      209.85.225.99 www2.gmer.net; 209.85.225.99 www.Merijn.org;
      209.85.225.99 www.spywareinfo.com; 209.85.225.99 www.spybot.info;
      209.85.225.99 www.viruslist.com; 209.85.225.99 www.hijackthis.de;
      209.85.225.99 ftp.f-secure.com; 209.85.225.99 forum.kaspersky.com;
      209.85.225.99 es.trendmicro-europe.com; 209.85.225.99 majorgeeks.com;
      209.85.225.99 www.avp.com; 209.85.225.99 www.virustotal.com;
      209.85.225.99 www.sophos.com; 209.85.225.99 linhadefensiva.uol.com.br;
      209.85.225.99 cmmings.cn; 209.85.225.99 www.sergiwa.com;
      209.85.225.99 www.el-hacker.com; 209.85.225.99 dl2.agnitum.com;
      209.85.225.99 www.avg-antivirus.net;
      209.85.225.99 www.kaspersky-labs.com; 209.85.225.99 www.kaspersky.com;
      209.85.225.99 www.bleepingcomputer.com;
      209.85.225.99 www.free.grisoft.com;
      209.85.225.99 alerta-antivirus.inteco.es;
      209.85.225.99 securityresponse.symantec.com;
      209.85.225.99 www.analysis.seclab.tuwien.ac.at;
      209.85.225.99 www.symantec.com; 209.85.225.99 www.kztechs.com;
      209.85.225.99 ad-aware-se.uptodown.com;
      209.85.225.99 stdio-labs.blogspot.com;
      209.85.225.99 liveupdate.symantecliveupdate.com;
      209.85.225.99 liveupdate.symantec.com;
      209.85.225.99 customer.symantec.com;
      209.85.225.99 update.symantec.com; 209.85.225.99 www.box.net;
      209.85.225.99 foro.el-hacker.com; 209.85.225.99 acs.pandasoftware.com;
      209.85.225.99 www.mcafee.com; 209.85.225.99 www.free.avg.com;
      209.85.225.99 download.mcafee.com; 209.85.225.99 mast.mcafee.com;
      209.85.225.99 www.tecno-soft.com; 209.85.225.99 ladooscuro.es;
      209.85.225.99 ftp.drweb.com;
      209.85.225.99 download.microsoft.comguru0.grisoft.cz;
      209.85.225.99 guru1.grisoft.cz; 209.85.225.99 guru2.grisoft.cz;
      209.85.225.99 guru3.grisoft.cz;
      209.85.225.99 download.bleepingcomputer.com;
      209.85.225.99 it.answers.yahoo.com; 209.85.225.99 www.softonic.com;
      209.85.225.99 guru4.grisoft.cz; 209.85.225.99 guru5.grisoft.cz;
      209.85.225.99 www.virusspy.com; 209.85.225.99 download.f-secure.com;
      209.85.225.99 www.malwareremoval.com; 209.85.225.99 forums.cnet.com;
      209.85.225.99 foros.softonic.com;
      209.85.225.99 hjt-data.trend-braintree.com;
      209.85.225.99 www.pantip.com; 209.85.225.99 secubox.aldria.com;
      209.85.225.99 www.forospyware.com;
      209.85.225.99 www.manuelruvalcaba.com;
      209.85.225.99 www.zonavirus.com; 209.85.225.99 www.leforo.com;
      209.85.225.99 www.siteadvisor.com; 209.85.225.99 blog.threatfire.com;
      209.85.225.99 www.threatexpert.com; 209.85.225.99 blog.hispasec.com;
      209.85.225.99 www.configurarequipos.com;
      209.85.225.99 sosvirus.changelog.fr; 209.85.225.99 www.psicofxp.com;
      209.85.225.99 mailcenter.rising.com.cn;
      209.85.225.99 mailcenter.rising.com; 209.85.225.99 www.rising.com.cn;
      209.85.225.99 www.rising.com; 209.85.225.99 www.babooforum.com.br;
      209.85.225.99 www.runscanner.net; 209.85.225.99 www.blogschapines.com;
      209.85.225.99 sosvirus.changelog.fr;
      209.85.225.99 upload.changelog.fr; 209.85.225.99 www.raymond.cc;
      209.85.225.99 changelog.fr; 209.85.225.99 www.pcentraide.com;
      209.85.225.99 atazita.blogspot.com; 209.85.225.99 www.thinkpad.cn;
      209.85.225.99 www.sunbeltsoftware.com;
      209.85.225.99 www.final4ever.com; 209.85.225.99 files.filefont.com;
      209.85.225.99 www.infos-du-net.com; 209.85.225.99 www.trendsecure.com;
      209.85.225.99 forum.hardware.fr;
      209.85.225.99 www.utilidades-utiles.com;
      209.85.225.99 blogs.icerocket.com; 209.85.225.99 www.spychecker.com;
      209.85.225.99 www.geekstogo.com; 209.85.225.99 forums.maddoktor2.com;
      209.85.225.99 www.smokey-services.eu; 209.85.225.99 www.clubic.com;
      209.85.225.99 www.linhadefensiva.org;
      209.85.225.99 www.rolandovera.com;
      209.85.225.99 download.sysinternals.com;
      209.85.225.99 www.pcguide.com; 209.85.225.99 www.thetechguide.com;
      209.85.225.99 www.ozzu.com; 209.85.225.99 www.changedetection.com;
      209.85.225.99 espanol.groups.yahoo.com;
      209.85.225.99 www.sunbeltsecurity.com;
      209.85.225.99 community.thaiware.com;
      209.85.225.99 www.avpclub.ddns.info;
      209.85.225.99 www.offensivecomputing.net;
      209.85.225.99 www.grisoft.com; 209.85.225.99 boardreader.com;
      209.85.225.99 www.guiadohardware.net; 209.85.225.99 www.webroot.com;
      209.85.225.99 www.msnvirusremoval.com; 209.85.225.99 www.cisrt.org;
      209.85.225.99 fixmyim.com; 209.85.225.99 samroeng.hi5.com;
      209.85.225.99 foro.elhacker.net; 209.85.225.99 www.daboweb.com;
      209.85.225.99 service1.symantec.com;
      209.85.225.99 us3.download.comodo.com;
      209.85.225.99 forums.techguy.org;
      209.85.225.99 www.incodesolutions.com;
      209.85.225.99 hijackthis.download3000.com;
      209.85.225.99 www.cybertechhelp.com;
      209.85.225.99 www.superdicas.com.br; 209.85.225.99 www.51nb.com;
      209.85.225.99 us4.download.comodo.com;
      209.85.225.99 downloads.andymanchesta.com;
      209.85.225.99 andymanchesta.com; 209.85.225.99 info.prevx.com;
      209.85.225.99 aknow.prevx.com; 209.85.225.99 www.zonavirus.com;
      209.85.225.99 securitywonks.net; 209.85.225.99 www.yoreparo.com;
      209.85.225.99 www.lavasoft.com; 209.85.225.99 www.virscan.org;
      209.85.225.99 www.eeload.com; 209.85.225.99 down.www.kingsoft.com;
      209.85.225.99 www.file.net; 209.85.225.99 onecare.live.com;
      209.85.225.99 mvps.org; 209.85.225.99 www.laneros.com;
      209.85.225.99 www.housecall.trendmicro.com;
      209.85.225.99 www.avast.com; 209.85.225.99 www.free.avg.com;
      209.85.225.99 www.onlinescan.avast.com; 209.85.225.99 www.ewido.net;
      209.85.225.99 www.trucoswindows.net;
      209.85.225.99 www.mozilla-hispano.org;
      209.85.225.99 www.futurenow.bitdefender.com;
      209.85.225.99 www.bitdefender.com; 209.85.225.99 www.f-prot.com;
      209.85.225.99 www.trendsecure.com;
      209.85.225.99 security.symantec.com;
      209.85.225.99 oldtimer.geekstogo.com; 209.85.225.99 www.avira.com;
      209.85.225.99 www.eset.com; 209.85.225.99 www.free.avg.com;
      209.85.225.99 www.free-av.com; 209.85.225.99 kr.ahnlab.com;
      209.85.225.99 www.eset.com; 209.85.225.99 forospyware.com;
      209.85.225.99 thejokerx.blogspot.com; 209.85.225.99 www.2-spyware.com;
      209.85.225.99 www.antivir.es; 209.85.225.99 www.prevx.com;
      209.85.225.99 www.ikarus.net; 209.85.225.99 bbs.s-sos.net;
      209.85.225.99 www.housecall.trendmicro.com;
      209.85.225.99 www.superdicas.com.br;
      209.85.225.99 www.forums.majorgeeks.com;
      209.85.225.99 www.castlecops.com; 209.85.225.99 www.virusspy.com;
      209.85.225.99 andymanchesta.com; 209.85.225.99 www.kaspersky.es;
      209.85.225.99 subs.geekstogo.com; 209.85.225.99 www.forospanish.com;
      209.85.225.99 www.trendmicro.com; 209.85.225.99 www.fortinet.com;
      209.85.225.99 www.safer-networking.org;
      209.85.225.99 www.fortiguardcenter.com;
      209.85.225.99 www.dougknox.com; 209.85.225.99 www.vsantivirus.com;
      209.85.225.99 static.commentcamarche.net;
      209.85.225.99 www.firewallguide.com; 209.85.225.99 www.auditmypc.com;
      209.85.225.99 www.spywaredb.com; 209.85.225.99 www.mxttchina.com;
      209.85.225.99 www.ziggamza.net; 209.85.225.99 www.forospyware.es;
      209.85.225.99 pogonyuto.forospanish.com;
      209.85.225.99 www.antivirus.comodo.com;
      209.85.225.99 www.spywareterminator.com;
      209.85.225.99 www.eradicatespyware.net;
      209.85.225.99 www.freespywareremoval.info;
      209.85.225.99 www.personalfirewall.comodo.com;
      209.85.225.99 www.clamav.net; 209.85.225.99 www.antivirus.about.com;
      209.85.225.99 www.pandasecurity.com; 209.85.225.99 www.webphand.com;
      209.85.225.99 mx.answers.yahoo.com;
      209.85.225.99 www.securitywonks.net;
      209.85.225.99 www.messengeradictos.com;
      209.85.225.99 www.sandboxie.com; 209.85.225.99 www.clamwin.com;
      209.85.225.99 www.cwsandbox.org; 209.85.225.99 www.ca.com;
      209.85.225.99 www.arswp.com; 209.85.225.99 es.answers.yahoo.com;
      209.85.225.99 www.trucoswindows.es; 209.85.225.99 www.ipaddresser.com;
      209.85.225.99 www.networkworld.com;
      209.85.225.99 www.cddchiangmai.net;
      209.85.225.99 www.threatexpert.com; 209.85.225.99 www.norman.com;
      209.85.225.99 espanol.answers.yahoo.com;
      209.85.225.99 www.tallemu.com; 209.85.225.99 foro.portalhacker.net;
      209.85.225.99 virscan.org; 209.85.225.99 www.viruschief.com;
      209.85.225.99 scanner.virus.org; 209.85.225.99 www.hijackthis.de;
      209.85.225.99 housecall65.trendmicro.com;
      209.85.225.99 www.guiadohardware.net;
      209.85.225.99 forums.whatthetech.com;
      209.85.225.99 hjt.networktechs.com;
      209.85.225.99 www.techsupportforum.com;
      209.85.225.99 www.whatthetech.com; 209.85.225.99 www.soccersuck.com;
      209.85.225.99 www.pcentraide.com;
      209.85.225.99 comunidad.wilkinsonpc.com.co;
      209.85.225.99 forum.piriform.com;
      209.85.225.99 www.tweaksforgeeks.com; 209.85.225.99 www.daniweb.com;
      209.85.225.99 www.geekstogo.com; 209.85.225.99 es.answers.yahoo.com;
      209.85.225.99 www.techsupportforum.com;
      209.85.225.99 dnl-eu8.kaspersky-labs.com;
      209.85.225.99 www.pchell.com; 209.85.225.99 www.spyany.com;
      209.85.225.99 forums.techguy.org;
      209.85.225.99 www.experts-exchange.com; 209.85.225.99 www.wikio.es;
      209.85.225.99 www.pandasecurity.com; 209.85.225.99 forums.devshed.com;
      209.85.225.99 forum.tweaks.com; 209.85.225.99 www.wilderssecurity.com;
      209.85.225.99 www.techspot.com;
      209.85.225.99 www.thecomputerpitstop.com;
      209.85.225.99 es.wasalive.com; 209.85.225.99 secunia.com;
      209.85.225.99 www.killtrojan.net; 209.85.225.99 es.kioskea.net;
      209.85.225.99 www.taringa.net; 209.85.225.99 www.cyberdefender.com;
      209.85.225.99 www.feedage.com; 209.85.225.99 new.taringa.net;
      209.85.225.99 forum.zazana.com;
      209.85.225.99 forum.clubedohardware.com.br;
      209.85.225.99 www.computing.net;
      209.85.225.99 discussions.virtualdr.com;
      209.85.225.99 forum.securitycadets.com; 209.85.225.99 www.techimo.com;
      209.85.225.99 13iii.com; 209.85.225.99 www.dicasweb.com.br;
      209.85.225.99 www.javacoolsoftware.net;
      209.85.225.99 www.infosecpodcast.com; 209.85.225.99 www.usbcleaner.cn;
      209.85.225.99 www.net-security.org;
      209.85.225.99 www.bleedingthreats.net;
      209.85.225.99 acs.pandasoftware.com; 209.85.225.99 www.funkytoad.com;
      209.85.225.99 www.360safe.cn; 209.85.225.99 www.360safe.com;
      209.85.225.99 bbs.360safe.cn; 209.85.225.99 bbs.360safe.com;
      209.85.225.99 codehard.wordpress.com;
      209.85.225.99 forum.clubedohardware.com.br;
      209.85.225.99 antitrick.com; 209.85.225.99 www.360.cn;
      209.85.225.99 www.360.com; 209.85.225.99 bbs.360safe.cn;
      209.85.225.99 bbs.360safe.com; 209.85.225.99 www.forospyware.es;
      209.85.225.99 p3dev.taringa.net;
      209.85.225.99 www.precisesecurity.com; 209.85.225.99 dlpe.antivir.com;
      209.85.225.99 baike.360.cn; 209.85.225.99 baike.360.com;
      209.85.225.99 kaba.360.cn; 209.85.225.99 kaba.360.com;
      209.85.225.99 deckard.geekstogo.com; 209.85.225.99 www.taringa.net;
      209.85.225.99 forums.comodo.com; 209.85.225.99 www.mvps.org;
      209.85.225.99 down.360safe.cn; 209.85.225.99 down.360safe.com;
      209.85.225.99 x.360safe.com; 209.85.225.99 dl.360safe.com;
      209.85.225.99 ftp.drweb.com; 209.85.225.99 www.hotshare.net;
      209.85.225.99 es.wasalive.com; 209.85.225.99 free.antivirus.com;
      209.85.225.99 updatem.360safe.com; 209.85.225.99 updatem.360safe.cn;
      209.85.225.99 update.360safe.cn; 209.85.225.99 update.360safe.com;
      209.85.225.99 www.utilidades-utiles.com;
      209.85.225.99 forum.kaspersky.com; 209.85.225.99 bbs.duba.net;
      209.85.225.99 www.duba.net; 209.85.225.99 zhidao.baidu.com;
      209.85.225.99 hi.baidu.com; 209.85.225.99 www.drweb.com.es;
      209.85.225.99 msncleaner.softonic.com;
      209.85.225.99 www.javacoolsoftware.com; 209.85.225.99 file.ikaka.com;
      209.85.225.99 file.ikaka.cn; 209.85.225.99 bbs.ikaka.com;
      209.85.225.99 zhidao.ikaka.com; 209.85.225.99 www.eset-la.com;
      209.85.225.99 download.eset.com;
      209.85.225.99 software-files.download.com;
      209.85.225.99 www.ikaka.com; 209.85.225.99 www.ikaka.cn;
      209.85.225.99 bbs.cfan.com.cn; 209.85.225.99 www.cfan.com.cn;
      209.85.225.99 www.pandasecurity.com; 209.85.225.99 es.mcafee.com;
      209.85.225.99 downloads.malwarebytes.org; 209.85.225.99 bbs.kafan.cn;
      209.85.225.99 bbs.kafan.com; 209.85.225.99 bbs.kpfans.com;
      209.85.225.99 bbs.taisha.org; 209.85.225.99 www.manuelruvalcaba.com;
      209.85.225.99 support.f-secure.com; 209.85.225.99 bbs.winzheng.com;
      209.85.225.99 alerta-antivirus.inteco.es;
      209.85.225.99 foros.zonavirus.com;
      209.85.225.99 alerta-antivirus.red.es;
      209.85.225.99 www.zonavirus.com; 209.85.225.99 www.malwarebytes.org;
      209.85.225.99 www.commentcamarche.net; 209.85.225.99 www.ewido.net;
      209.85.225.99 www.infospyware.com; 209.85.225.99 www.bitdefender.es;
      209.85.225.99 housecall.trendmicro.com;
      209.85.225.99 foros.toxico-pc.com; 209.85.225.99 www.identi.es;
      209.85.225.99 es.kioskea.net; 209.85.225.99 www.emsisoft.de;
      209.85.225.99 www.securitynewsportal.com;
      209.85.225.99 irc.ekizmedia.com; 209.85.225.99 zone.arminboutique.com;
      209.85.225.99 story.dnsentrymx.com; 209.85.225.99 W32.NyteMare2.RC11


 Process termination List of processes that are terminated:
   • RAVP.EXEMBAM.EXE123.COM; UNIEXTRACT.EXE; SYSANALYZER_SETUP.EXE;
      STARTDRECK.EXE; SPF.EXE; REGX2.EXE; REGSHOT.EXE; REGSCANNER.EXE;
      REGISTRAR_LITE.EXE; REGCOOL.EXE; REGALYZ.EXE;
      PROJECTWHOISINSTALLER.EXE; PROCMON.EXE; CUREIT.EXE; FIXBAGLE.EXE;
      PGSETUP.EXE; OBJMONSETUP.EXE; NETALYZ.EXE; KILLBOX.EXE;
      INSTALLWATCHPRO25.EXE; AVENGER.EXE; IEFIX.EXE; HOSTSFILEREADER.EXE;
      FIXPATH.EXE; FILEFIND.EXE; FILEALYZ.EXE; EULALYZERSETUP.EXE;
      A2HIJACKFREESETUP.EXE; DLLCOMPARE.EXE; CPROCESS.EXE; CPORTS.EXE;
      ASVIEWER.EXE; APT.EXE; APM.EXE; WIRESHARK.EXE; SPYBOTSD.EXE;
      TEATIMER.EXE; SPYBOTSD160.EXE; PROCESSMONITOR.EXE; PROCDUMP.EXE;
      PG2.EXE; LORDPE.EXE; ICESWORD.EXE; REANIMATOR.EXE; ROOTKITNO.EXE;
      RKD.EXE; HACKMON.EXE; UNHACKME.EXE; ROOTKIT_DETECTIVE.EXE;
      AVGARKT.EXE; FSB.EXE; FSBL.EXE; ROOTKITREVEALER.EXE; PSKILL.EXE;
      TASKMON.EXE; TASKLIST.EXE; TASKMAN.EXE; PROCEXP.EXE; MSNFIX.EXE;
      HIJACKTHIS_V2.EXE; HIJACKTHIS.EXE; HIJACKTHIS_SFX.EXE; HJTSETUP.EXE;
      HJTINSTALL.EXE; OLLYDBG.EXE; NETSTAT.EXE; PORTMONITOR.EXE;
      PORTDETECTIVE.EXE; FPORT.EXE; APORTS.EXE; PAVARK.EXE; DARKSPY105.EXE;
      HELIOS.EXE; ROOTKITBUSTER.EXE; ROOTALYZER.EXE; BC5CA6A.EXE; SEEM.EXE;
      DELAYDELFILE.EXE; DUBATOOL_AV_KILLER.EXE; SUPERKILLER.EXE;
      KAKASETUPV6.EXE; BUSCAREG.EXE; MSNCLEANER.EXE; SRESTORE.EXE;
      BOOTSAFE.EXE; SUPERANTISPYWARE.EXE;
      REGUNLOCKER.EXETSNTEVAL.EXEXP_TASKMGRENAB.EXE; CF9409.EXE; GMER.EXE;
      CATCHME.EXE; SDFIX.EXE; COMBOFIX.EXE; SRENGPS.EXE; AUTORUNS.EXE;
      TASKKILL.EXE; REG.EXE; MYPHOTOKILLER.EXE; KILLAUTOPLUS.EXE;
      FOLDERCURE.EXE; REGEDIT.SCR; REGEDIT.COM; TCPVIEW.EXE; LISTO.EXE;
      GUARD.EXE; NTVDM.EXE; COMMAND.COM; COMBOFIX.COM; COMBOFIX.SCR;
      COMBOFIX.BAT; COMBO-FIX.EXE; REGMON.EXE; OTMOVEIT.EXEMBAM-SETUP.EXE;
      JAJA.EXE; AVZ.EXE; MBAM.EXE; MBAM-SETUP.EXE; PENCLEAN.EXE; ELISTA.EXE;
      HJ.EXE; WINDOWS-KB890930-V2.2.EXE; MRTSTUB.EXE; MRT.EXE;
      HIJACK-THIS.EXE; VIRUS.EXE;
      SAFEBOOTKEYREPAIR.EXEOTMOVEIT3.EXEHOSTSXPERT.EXEDAFT.EXE;
      ATF-CLEANER.EXE; COMPAQ_PROPIETARIO.EXE; REGUNLOCKER.EXE;
      UNLOCKERASSISTANT.EXE; UNLOCKER.EXE; VIPRE.EXE; ISSDM_EN_32.EXE;
      P08PROMO.EXE; K7TS_SETUP.EXE; AVINSTALL.EXE; WITSETUP.EXE;
      TrendMicro_TISPro_16.1_1063_x32.EXE;
      VBA32-PERSONAL-LATEST-ENGLISH.EXE; VIRUSUTILITIES.EXE;
      GUARDXSERVICE.EXE; GUARDXKICKOFF.EXE; MSASCUI.EXE; MSMPENG.EXE;
      SRENGLDR.EXE; HOOKANLZ.EXE


 Injection – It injects itself as a remote thread into a process.

    Process name:
   • explorer.exe


 File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

説明の挿入者 Petre Galan の 2010年4月23日金曜日
説明の更新者 Petre Galan の 2010年4月23日金曜日

戻る . . . .
https:// このウィンドウは暗号化されています。