Worm/Mytob.HE - Worm

参照

概要

詳しい説明

統計

ウイルス	Worm/Mytob.HE
発見日：	22/06/2005
タイプ	ワーム
感染報告有り	いいえ
感染報告	低
感染の可能性	中
ダメージ・ポテンシャル	中
スタティック・ファイル	はい
ファイル・サイズ	119.828 バイト
MD5　チェックサム	ff9b652337043bb7e46f94e50284204f
VDFファージョン：	6.31.0.92

一般情報 感染方法
   • Eメール
   • ローカル・ネットワーク

別名
   • Symantec(シマンテック) W32.Gaobot.gen!poly
   • McAfee(マカフィー) W32/Polybot.gen!irc
   • Kaspersky(カスペルスキー) Net-Worm.Win32.Mytob.bi
   • TrendMicro(トレンドマイクロ） WORM_MYTOB.HA
   • F-Secure(エフ・セキュア) W32/Mytob.GW@mm - Packed
   • ウイルスバスター Worm.Agobot.Wonk
   • ビットディフェンダー(Bitdefender)： Win32.Worm.Mytob.BI

プラットフォーム/OS：
   • ウインドウズ 98
   • ウインドウズ 98 SE
   • ウインドウズ NT
   • ウインドウズ ME
   • ウインドウズ 2000
   • ウインドウズ XP

副作用
   • 特定のウェブサイトへのアクセスを無効にします。
   • セキュリティ関係のウェブサイトへのアクセスを無効にします。
   • セキュリティ・アプリケーションを無効にします。
   • それ自身のメール・エンジンを利用します。
   • レジストリの改変。
   • サード・パーティ・コントロール

ファイルそれ自体を以下の場所にコピーします。
• %SYSDIR%\winaup.exe

レジストリ以下のレジストリ・キーは、再起動後にそのプロセスを実行するために追加されたものです：

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • WINDOWS SYSTEM=winaup.exe

以下のレジストリ・キーは、再起動後にそのサービスを読み込むために追加されたものです：

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
   • WINDOWS SYSTEM=winaup.exe

以下のレジストリ・キーは変更されます：

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess]
   前の値
   • "Start"=%ユーザ設定%
   新しい値
   • "Start"=dword:00000004

Eメールそれはメールを送るためSMTPエンジンが搭載されています。送り先のサーバとの直接接続が構築されます。特徴は以下の通りです：

送信者
送信者のアドレスは改変されています(spoof)。
作成されたアドレスです。送信者は送る意図があって送ったわけではありません。送信者は、感染されたことに気づいていないかもしれませんし、まったく感染していないかもしれません。さらに、あなたが感染されたと告げる多数のメールを受け取る可能性があります。これも真実ではないことがあります。

宛先:
– システム内のあるファイルにあるメールアドレス
– ウインドウズ・アドレス帳(WAB)を使って集められたメールアドレス
– 作成されたアドレス

件名
以下のもの：
   • YOUR PASSWORD HAS BEEN UPDATED
   • YOUR PASSWORD HAS BEEN SUCCESSFULLY UPDATED
   • YOU HAVE SUCCESSFULLY UPDATED YOUR PASSWORD
   • YOUR NEW ACCOUNT PASSWORD IS APPROVED
   • YOUR ACCOUNT IS SUSPENDED
   • *DETECTED* ONLINE USER VIOLATION
   • YOUR ACCOUNT IS SUSPENDED FOR SECURITY REASONS
   • WARNING MESSAGE: YOUR SERVICES NEAR TO BE CLOSED.
   • IMPORTANT NOTIFICATION
   • MEMBERS SUPPORT
   • SECURITY MEASURES
   • GMAIL ACCOUNT SUSPENSION
   • NOTICE OF ACCOUNT LIMITATION

件名は空欄になっています。

本文
– HTMLコードを含みます。

メールの本文は以下のうちのどれかです：

   • Dear user %username from receivers email address%,
     You have successfully updated the password of your %receivers domain name from email address% account.
     If you did not authorize this change or if you need assistance with your account, please contact %username from receivers email address% customer service at: %receivers domain name from email address%
     Thank you for using %receivers domain name from email address%!
     The %receivers domain name from email address% Support Team

     +++ Attachment: No Virus (Clean)
     +++ %receivers domain name from email address% Antivirus - www.%receivers domain name and top level domain from email address%

   • Dear user %username from receivers email address%,
     It has come to our attention that your %username from receivers email address% User Profile ( x ) records are out of date. For further details see the attached document.
     Thank you for using %receivers domain name from email address%!
     The %receivers domain name from email address% Support Team

     +++ Attachment: No Virus (Clean)
     +++ %receivers domain name from email address% Antivirus - www.%receivers domain name and top level domain from email address%

   • Dear %receivers domain name from email address% Member,
     We have temporarily suspended your email account %receivers domain name from email address%.
     This might be due to either of the following reasons:
     1. A recent change in your personal information (i.e. change of address).
     2. Submiting invalid information during the initial sign up process.
     3. An innability to accurately verify your selected option of subscription due to an internal error within our processors.
     See the details to reactivate your %username from receivers email address%@%receivers domain name and top level domain from email address% account.
     Sincerely,The %receivers domain name from email address% Support Team

     +++ Attachment: No Virus (Clean)
     +++ %receivers domain name from email address% Antivirus - www.%receivers domain name and top level domain from email address%

   • Dear %receivers domain name from email address% Member,
     Your e-mail account was used to send a huge amount of unsolicited spam messages during the recent week. If you could please take 5-10 minutes out of your online experience and confirm the attached document so you will not run into any future problems with the online service.
     If you choose to ignore our request, you leave us no choice but to cancel your membership.
     Virtually yours,
     The %receivers domain name from email address% Support Team

     +++ Attachment: No Virus found
     +++ %receivers domain name from email address% Antivirus - www.%receivers domain name and top level domain from email address%

   • Dear user %username from receivers email address%,

     You have successfully updated the password of your %receivers domain name from email address% account.
     If you did not authorize this change or if you need assistance with your account, please contact %username from receivers email address% customer service at: %receivers domain name from email address%
     Thank you for using %receivers domain name from email address% !
     The %receivers domain name from email address% Support Team

     +++ Attachment: No Virus (Clean)
     +++ %receivers domain name from email address% Antivirus - www.%receivers domain name and top level domain from email address%

添付ファイル
添付ファイルの名前は：
   • %3桁のランダムな文字列%.zip
   • %4桁のランダムな文字列%.zip
   • %5桁のランダムな文字列%.zip
   • %6桁のランダムな文字列%.zip
   • %7桁のランダムな文字列%.zip
   • ACCEPTED-PASSWORD.zip
   • Account-DETAILS.zip
   • ACCOUNT-PASSWORD.zip
   • Account-Report.zip
   • APPROVED-PASSWORD.zip
   • DOCUMENT.zip
   • EMAIL-DETAILS.zip
   • EMAIL-PASSWORD.zip
   • IMPORTANT-DETAILS.zip
   • NEW-PASSWORD.zip
   • PASSWORD.zip
   • Readme.zip
   • UPDATED-PASSWORD.zip

送信 アドレスの検索：
以下のファイルからメールアドレスを検索します：
   • txt; htm; shtl; js; cgi; xml; php; asp; dbx; tbb; adb; html; wab

FROM欄のためのアドレス作成
アドレスを作成するのに以下の文字列を使用します：
   • support
   • administrator
   • mail
   • service
   • admin
   • info
   • register
   • webmaster

この結果に、先ほどアドレスを検索されたファイルの中に見つかったドメインをつなげます。

TO欄のためのアドレス作成
アドレスを作成するのに以下の文字列を使用します：
   • john; josh; alex; michael; james; mike; kevin; david; george; sam;
      andrew; jose; leo; maria; jim; brian; serg; mary; ray; tom; peter;
      robert; bob; jane; joe; dan; dave; matt; steve; smith; stan; bill;
      bob; jack; fred; ted; paul; brent; sales; anna; brenda; claudia;
      debby; helen; jerry; jimmy; julie; linda; michael; frank; adam; sandra

この結果に、先ほどアドレスを検索されたファイルの中に見つかったドメインをつなげます。

アドレスは無視します：
以下の文字列を含むアドレスにはメールは送られません：
   • .edu; .gov; .mil; abuse; accoun; acketst; admin; anyone; arin.; avp;
      berkeley; borlan; bsd; bsd; bugs; certific; contact; example; fcnz;
      feste; fido; foo.; fsf.; gnu; gold-certs; google; google; gov.; help;
      hotmail; iana; ibm.com; icrosof; icrosoft; ietf; info; inpris; isc.o;
      isi.e; kernel; linux; linux; listserv; math; mit.e; mozilla; msn.;
      mydomai; nobody; nodomai; noone; not; nothing; ntivi; page; panda;
      pgp; postmaster; privacy; rating; rfc-ed; ripe.; root; ruslis;
      samples; secur; secur; sendmail; service; site; soft; somebody;
      someone; sopho; spm; submit; support; syma; tanford.e; the.bat; unix;
      unix; usenet; utgers.ed; webmaster; www; you; your

IRC システム情報を報告し、リモートコントロールを可能にするために以下のIRCサーバに接続します：

サーバ bernoulli.viz**********.bme.hu
ポート： 8080
チャンネル #irc
ニックネーム ~_h_olubgd
パスワード elite

ホスト – 以下のドメインへのアクセスは効果的に無効にされています。
   • www.symantec.com; securityresponse.symantec.com; symantec.com;
      www.sophos.com; sophos.com; www.mcafee.com; mcafee.com;
      liveupdate.symantecliveupdate.com; www.viruslist.com; viruslist.com;
      viruslist.com; f-secure.com; www.f-secure.com; kaspersky.com;
      kaspersky-labs.com; www.avp.com; www.kaspersky.com; avp.com;
      www.networkassociates.com; networkassociates.com; www.ca.com; ca.com;
      mast.mcafee.com; my-etrust.com; www.my-etrust.com;
      download.mcafee.com; dispatch.mcafee.com; secure.nai.com; nai.com;
      www.nai.com; update.symantec.com; updates.symantec.com; us.mcafee.com;
      liveupdate.symantec.com; customer.symantec.com; rads.mcafee.com;
      trendmicro.com; pandasoftware.com; www.pandasoftware.com;
      www.trendmicro.com; www.grisoft.com; www.microsoft.com; microsoft.com;
      www.virustotal.com; virustotal.com; www.amazon.com; www.amazon.co.uk;
      www.amazon.ca; www.amazon.fr; www.paypal.com; paypal.com;
      moneybookers.com; www.moneybookers.com; www.ebay.com; ebay.com

改変されたホストファイルの外見は以下のようになります。

プロセス中断以下のプロセスは終了されます：
   • ACKWIN32.EXE; ADAWARE.EXE; ADVXDWIN.EXE; AGENTSVR.EXE; AGENTW.EXE;
      ALERTSVC.EXE; ALEVIR.EXE; ALOGSERV.EXE; AMON9X.EXE; ANTI-TROJAN.EXE;
      ANTIVIRUS.EXE; ANTS.EXE; APIMONITOR.EXE; APLICA32.EXE; APVXDWIN.EXE;
      ARR.EXE; ATCON.EXE; ATGUARD.EXE; ATRO55EN.EXE; ATUPDATER.EXE;
      ATUPDATER.EXE; ATWATCH.EXE; AU.EXE; AUPDATE.EXE; AUPDATE.EXE;
      AUTODOWN.EXE; AUTODOWN.EXE; AUTO-PROTECT.NAV80TRY.EXE; AUTOTRACE.EXE;
      AUTOTRACE.EXE; AUTOUPDATE.EXE; AUTOUPDATE.EXE; AVCONSOL.EXE;
      AVE32.EXE; AVGCC32.EXE; AVGCTRL.EXE; AVGNT.EXE; AVGSERV.EXE;
      AVGSERV9.EXE; AVGUARD.EXE; AVGW.EXE; AVKPOP.EXE; AVKSERV.EXE;
      AVKSERVICE.EXE; AVKWCTl9.EXE; AVLTMAIN.EXE; AVNT.EXE; AVP.EXE;
      AVP32.EXE; AVPCC.EXE; AVPDOS32.EXE; AVPM.EXE; AVPTC32.EXE; AVPUPD.EXE;
      AVPUPD.EXE; AVSCHED32.EXE; AVSYNMGR.EXE; AVWINNT.EXE; AVWUPD.EXE;
      AVWUPD32.EXE; AVWUPD32.EXE; AVWUPSRV.EXE; AVXMONITOR9X.EXE;
      AVXMONITORNT.EXE; AVXQUAR.EXE; AVXQUAR.EXE; BACKWEB.EXE; BARGAINS.EXE;
      BD_PROFESSIONAL.EXE; BEAGLE.EXE; BELT.EXE; BIDEF.EXE; BIDSERVER.EXE;
      BIPCP.EXE; BIPCPEVALSETUP.EXE; BISP.EXE; BLACKD.EXE; BLACKICE.EXE;
      BLSS.EXE; BOOTCONF.EXE; BOOTWARN.EXE; BORG2.EXE; BPC.EXE; BRASIL.EXE;
      BS120.EXE; BUNDLE.EXE; BVT.EXE; CCAPP.EXE; CCEVTMGR.EXE; CCPXYSVC.EXE;
      CDP.EXE; CFD.EXE; CFGWIZ.EXE; CFIADMIN.EXE; CFIAUDIT.EXE;
      CFIAUDIT.EXE; CFINET.EXE; CFINET32.EXE; CLAW95CF.EXE; CLEAN.EXE;
      CLEANER.EXE; CLEANER3.EXE; CLEANPC.EXE; CLICK.EXE; CMD32.EXE;
      CMESYS.EXE; CMGRDIAN.EXE; CMON016.EXE; CONNECTIONMONITOR.EXE; CPD.EXE;
      CPF9X206.EXE; CPFNT206.EXE; CTRL.EXE; CV.EXE; CWNB181.EXE;
      CWNTDWMO.EXE; DATEMANAGER.EXE; DCOMX.EXE; DEFALERT.EXE;
      DEFSCANGUI.EXE; DEFWATCH.EXE; DEPUTY.EXE; DIVX.EXE; DLLCACHE.EXE;
      DLLREG.EXE; DOORS.EXE; DPF.EXE; DPFSETUP.EXE; DPPS2.EXE; DRWATSON.EXE;
      DRWEB32.EXE; DRWEBUPW.EXE; DSSAGENT.EXE; DVP95.EXE; DVP95_0.EXE;
      ECENGINE.EXE; EFPEADM.EXE; EMSW.EXE; ENT.EXE; ESAFE.EXE; ESCANHNT.EXE;
      ESCANV95.EXE; ESPWATCH.EXE; ETHEREAL.EXE; ETRUSTCIPE.EXE; EVPN.EXE;
      EXANTIVIRUS-CNET.EXE; EXE.AVXW.EXE; EXPERT.EXE; EXPLORE.EXE;
      FAMEH32.EXE; FAST.EXE; FCH32.EXE; FIH32.EXE; FINDVIRU.EXE;
      FIREWALL.EXE; FNRB32.EXE; FPROT.EXE; F-PROT.EXE; F-PROT95.EXE;
      FP-WIN.EXE; FP-WIN_TRIAL.EXE; FRW.EXE; FSAA.EXE; FSAV.EXE; FSAV32.EXE;
      FSAV530STBYB.EXE; FSAV530WTBYB.EXE; FSAV95.EXE; FSGK32.EXE; FSM32.EXE;
      FSMA32.EXE; FSMB32.EXE; F-STOPW.EXE; GATOR.EXE; GBMENU.EXE;
      GBPOLL.EXE; GENERICS.EXE; GMT.EXE; GUARD.EXE; GUARDDOG.EXE;
      HACKTRACERSETUP.EXE; HBINST.EXE; HBSRV.EXE; HOTACTIO.EXE;
      HOTPATCH.EXE; HTLOG.EXE; HTPATCH.EXE; HWPE.EXE; HXDL.EXE; HXIUL.EXE;
      IAMAPP.EXE; IAMSERV.EXE; IAMSTATS.EXE; IBMASN.EXE; IBMAVSP.EXE;
      ICLOADNT.EXE; ICMON.EXE; ICSUPP95.EXE; ICSUPPNT.EXE; IDLE.EXE;
      IEDLL.EXE; IEDRIVER.EXE; IEXPLORER.EXE; IFACE.EXE; IFW2000.EXE;
      INETLNFO.EXE; INFUS.EXE; INFWIN.EXE; INIT.EXE; INTDEL.EXE; INTREN.EXE;
      IOMON98.EXE; ISTSVC.EXE; JAMMER.EXE; JDBGMRG.EXE; JEDI.EXE;
      KAVLITE40ENG.EXE; KAVPERS40ENG.EXE; KAVPF.EXE; KAZZA.EXE;
      KEENVALUE.EXE; KERIO-PF-213-EN-WIN.EXE; KERIO-WRL-421-EN-WIN.EXE;
      KERIO-WRP-421-EN-WIN.EXE; KERNEL32.EXE; KILLPROCESSSETUP161.EXE;
      LAUNCHER.EXE; LDNETMON.EXE; LDPRO.EXE; LDPROMENU.EXE; LDSCAN.EXE;
      LNETINFO.EXE; LOADER.EXE; LOCALNET.EXE; LOCKDOWN.EXE;
      LOCKDOWN2000.EXE; LOOKOUT.EXE; LORDPE.EXE; LSETUP.EXE; LUALL.EXE;
      LUALL.EXE; LUAU.EXE; LUCOMSERVER.EXE; LUINIT.EXE; LUSPT.EXE;
      MAPISVC32.EXE; MCAGENT.EXE; MCMNHDLR.EXE; MCSHIELD.EXE; MCTOOL.EXE;
      MCUPDATE.EXE; MCUPDATE.EXE; MCVSRTE.EXE; MCVSSHLD.EXE; MD.EXE;
      MFIN32.EXE; MFW2EN.EXE; MFWENG3.02D30.EXE; MGAVRTCL.EXE; MGAVRTE.EXE;
      MGHTML.EXE; MGUI.EXE; MINILOG.EXE; MMOD.EXE; MONITOR.EXE; MOOLIVE.EXE;
      MOSTAT.EXE; MPFAGENT.EXE; MPFSERVICE.EXE; MPFTRAY.EXE; MRFLUX.EXE;
      MSAPP.EXE; MSBB.EXE; MSBLAST.EXE; MSCACHE.EXE; MSCCN32.EXE;
      MSCMAN.EXE; MSCONFIG.EXE; MSDM.EXE; MSDOS.EXE; MSIEXEC16.EXE;
      MSINFO32.EXE; MSLAUGH.EXE; MSMGT.EXE; MSMSGRI32.EXE; MSSMMC32.EXE;
      MSSYS.EXE; MSVXD.EXE; MU0311AD.EXE; MWATCH.EXE; N32SCANW.EXE; NAV.EXE;
      NAVAP.NAVAPSVC.EXE; NAVAPSVC.EXE; NAVAPW32.EXE; NAVDX.EXE;
      NAVLU32.EXE; NAVNT.EXE; NAVSTUB.EXE; NAVW32.EXE; NAVWNT.EXE;
      NC2000.EXE; NCINST4.EXE; NDD32.EXE; NEOMONITOR.EXE; NEOWATCHLOG.EXE;
      NETARMOR.EXE; NETD32.EXE; NETINFO.EXE; NETMON.EXE; NETSCANPRO.EXE;
      NETSPYHUNTER-1.2.EXE; NETSTAT.EXE; NETUTILS.EXE; NISSERV.EXE;
      NISUM.EXE; NMAIN.EXE; NOD32.EXE; NORMIST.EXE;
      NORTON_INTERNET_SECU_3.0_407.EXE; NOTSTART.EXE;
      NPF40_TW_98_NT_ME_2K.EXE; NPFMESSENGER.EXE; NPROTECT.EXE;
      NPSCHECK.EXE; NPSSVC.EXE; NSCHED32.EXE; NSSYS32.EXE; NSTASK32.EXE;
      NSUPDATE.EXE; NT.EXE; NTRTSCAN.EXE; NTVDM.EXE; NTXconfig.EXE; NUI.EXE;
      NUPGRADE.EXE; NUPGRADE.EXE; NVARCH16.EXE; NVC95.EXE; NVSVC32.EXE;
      NWINST4.EXE; NWSERVICE.EXE; NWTOOL16.EXE; OLLYDBG.EXE; ONSRVR.EXE;
      OPTIMIZE.EXE; OSTRONET.EXE; OTFIX.EXE; OUTPOST.EXE; OUTPOST.EXE;
      OUTPOSTINSTALL.EXE; OUTPOSTPROINSTALL.EXE; PADMIN.EXE; PANIXK.EXE;
      PATCH.EXE; PAVCL.EXE; PAVPROXY.EXE; PAVSCHED.EXE; PAVW.EXE;
      PCFWALLICON.EXE; PCIP10117_0.EXE; PCSCAN.EXE; PDSETUP.EXE;
      PERISCOPE.EXE; PERSFW.EXE; PERSWF.EXE; PF2.EXE; PFWADMIN.EXE;
      PGMONITR.EXE; PINGSCAN.EXE; PLATIN.EXE; POP3TRAP.EXE; POPROXY.EXE;
      POPSCAN.EXE; PORTDETECTIVE.EXE; PORTMONITOR.EXE; POWERSCAN.EXE;
      PPINUPDT.EXE; PPTBC.EXE; PPVSTOP.EXE; PRIZESURFER.EXE; PRMT.EXE;
      PRMVR.EXE; PROCDUMP.EXE; PROCESSMONITOR.EXE; PROCEXPLORERV1.0.EXE;
      PROGRAMAUDITOR.EXE; PROPORT.EXE; PROTECTX.EXE; PSPF.EXE; PURGE.EXE;
      QCONSOLE.EXE; QSERVER.EXE; RAPAPP.EXE; RAV7.EXE; RAV7WIN.EXE;
      RAV8WIN32ENG.EXE; RAY.EXE; RB32.EXE; RCSYNC.EXE; REALMON.EXE;
      REGED.EXE; REGEDIT.EXE; REGEDT32.EXE; RESCUE.EXE; RESCUE32.EXE;
      RRGUARD.EXE; RSHELL.EXE; RTVSCAN.EXE; RTVSCN95.EXE; RULAUNCH.EXE;
      RUN32DLL.EXE; RUNDLL.EXE; RUNDLL16.EXE; RUXDLL32.EXE; SAFEWEB.EXE;
      SAHAGENT.EXE; SAVE.EXE; SAVENOW.EXE; SBSERV.EXE; SC.EXE; SCAM32.EXE;
      SCAN32.EXE; SCAN95.EXE; SCANPM.EXE; SCRSCAN.EXE;
      SETUP_FLOWPROTECTOR_US.EXE; SETUPVAMEEVAL.EXE; SFC.EXE; SGSSFW32.EXE;
      SH.EXE; SHELLSPYINSTALL.EXE; SHN.EXE; SHOWBEHIND.EXE; SMC.EXE;
      SMS.EXE; SMSS32.EXE; SOAP.EXE; SOFI.EXE; SPERM.EXE; SPF.EXE;
      SPHINX.EXE; SPOLER.EXE; SPOOLCV.EXE; SPOOLSV32.EXE; SPYXX.EXE;
      SREXE.EXE; SRNG.EXE; SS3EDIT.EXE; SSG_4104.EXE; SSGRATE.EXE; ST2.EXE;
      START.EXE; STCLOADER.EXE; SUPFTRL.EXE; SUPPORT.EXE; SUPPORTER5.EXE;
      SVC.EXE; SVCHOSTC.EXE; SVCHOSTS.EXE; SVSHOST.EXE; SWEEP95.EXE;
      SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE; SYMPROXYSVC.EXE; SYMTRAY.EXE;
      SYSEDIT.EXE; SYSTEM.EXE; SYSTEM32.EXE; SYSUPD.EXE; TASKMG.EXE;
      TASKMO.EXE; TASKMON.EXE; TAUMON.EXE; TBSCAN.EXE; TC.EXE; TCA.EXE;
      TCM.EXE; TDS2-NT.EXE; TDS-3.EXE; TEEKIDS.EXE; TFAK.EXE; TFAK5.EXE;
      TGBOB.EXE; TITANIN.EXE; TITANINXP.EXE; TRACERT.EXE; TRICKLER.EXE;
      TRJSCAN.EXE; TRJSETUP.EXE; TROJANTRAP3.EXE; TSADBOT.EXE; TVMD.EXE;
      TVTMD.EXE; UNDOBOOT.EXE; UPDAT.EXE; UPDATE.EXE; UPDATE.EXE;
      UPGRAD.EXE; UTPOST.EXE; VBCMSERV.EXE; VBCONS.EXE; VBUST.EXE;
      VBWIN9X.EXE; VBWINNTW.EXE; VCSETUP.EXE; VET32.EXE; VET95.EXE;
      VETTRAY.EXE; VFSETUP.EXE; VIR-HELP.EXE; VIRUSMDPERSONALFIREWALL.EXE;
      VNLAN300.EXE; VNPC3000.EXE; VPC32.EXE; VPC42.EXE; VPFW30S.EXE;
      VPTRAY.EXE; VSCAN40.EXE; VSCENU6.02D30.EXE; VSCHED.EXE; VSECOMR.EXE;
      VSHWIN32.EXE; VSISETUP.EXE; VSMAIN.EXE; VSMON.EXE; VSSTAT.EXE;
      VSWIN9XE.EXE; VSWINNTSE.EXE; VSWINPERSE.EXE; W32DSM89.EXE; W9X.EXE;
      WATCHDOG.EXE; WEBDAV.EXE; WEBSCANX.EXE; WEBTRAP.EXE; WFINDV32.EXE;
      WHOSWATCHINGME.EXE; WIMMUN32.EXE; WIN32.EXE; WIN32US.EXE;
      WINACTIVE.EXE; WIN-BUGSFIX.EXE; WINDOW.EXE; WINDOWS.EXE; WININETD.EXE;
      WININIT.EXE; WININITX.EXE; WINLOGIN.EXE; WINMAIN.EXE; WINNET.EXE;
      WINPPR32.EXE; WINRECON.EXE; WINSERVN.EXE; WINSSK32.EXE; WINSTART.EXE;
      WINSTART001.EXE; WINTSK32.EXE; WINUPDATE.EXE; WKUFIND.EXE; WNAD.EXE;
      WNT.EXE; WRADMIN.EXE; WRCTRL.EXE; WSBGATE.EXE; WUPDATER.EXE;
      WUPDT.EXE; WYVERNWORKSFIREWALL.EXE; XPF202EN.EXE; ZAPRO.EXE;
      ZAPSETUP3001.EXE; ZATUTOR.EXE; ZONALM2601.EXE; ZONEALARM.EXE

ファイルの詳細 プログラム言語:
このマルウェアプログラムはMS Visual C++で書かれています。

ランタイム・パッカー
検出されにくくするため、またファイルのサイズを縮小するため、以下のランタイム・パッカーで圧縮してあります。
• PENinja

簡単な説明はココにあります。.

この説明は Victor Tone によって Sun, 21 Aug 2005 00:32 (GMT+1) 書き込まれました。
この説明は Victor Tone によって Sat, 27 Aug 2005 19:16 (GMT+1) 更新されました。

» About Malware
» About Phishing
» Viruses In the Wild

« back