Need help? Ask the community or hire an expert.
Go to Avira Answers
??:Worm/Sohanad.bm
????:13/12/2012
??:??
????:?
????????????????
??/?????????????
?? / ????????????
????:?
????:501.017 ??
MD5 ???:eb4215326d739ef7393270fb48f6dbcb
VDF ??:7.11.53.216 - 2012년 12월 13일 목요일
IVDF ??:7.11.53.216 - 2012년 12월 13일 목요일

 ???? ????:
   • ????
    Messenger


??:
   •  Kaspersky: IM-Worm.Win32.Sohanad.bm
   •  F-Secure: IM-Worm.Win32.Sohanad.bm
   •  Sophos: W32/SillyFDC-G
   •  Panda: W32/Hakaglan.A.worm
   •  Grisoft: I-Worm/Sohanad.J
   •  Eset: Win32/Hakaglan.AH
   •  Bitdefender: Trojan.AutoIt.TD


??/????:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


???:
   • ????
   • ????
   • ????????
   • ?????

 ?? ???????????:
   • %SYSDIR%\RVHOST.exe
   • %WINDIR%\RVHOST.exe



??????:

%WINDIR%\Tasks\At1.job ??????????????????????



????????:

???????:
   • http://nhatquanglan2.0catch.com/**********
???????????????: %SYSDIR%\setting.ini

 ??? ????????????????????????:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • Yahoo Messengger="%SYSDIR%\RVHOST.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   • Shell="Explorer.exe RVHOST.exe"



?????????????:

[HKLM\SYSTEM\ControlSet001\Services\Schedule]
   • AtTaskMaxHours=dword:00000000

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\
   WorkgroupCrawler\Shares]
   • shared="%???????%\New Folder.exe"



?????????:

?? Explorer ??:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   ??:
   • NofolderOptions=%???????%
   ??:
   • NofolderOptions=dword:00000001

?? Regedit ??????:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
   ??:
   • DisableTaskMgr=%???????%
   • DisableRegistryTools=%???????%
   ??:
   • DisableTaskMgr=dword:00000001
   • DisableRegistryTools=dword:00000001

 Messenger ???? Messenger ???? ?????????:

 Yahoo Messenger


???:
??????????


??
????????:

   • E may, vao day coi co con nho nay ngon lam http://nhattruongquang.**********.com

   • Vao day nghe bai nay di ban http://nhattruongquang.**********.com

   • Biet tin gi chua, vao day coi di http://nhattruongquang.**********.com

   • Trang Web nay coi cung hay, vao coi thu di http://nhattruongquang.**********.com

   • Toi di lang thang lan trong bong toi buot gia, ve dau khi da mat em roi? Ve dau khi bao nhieu mo mong gio da vo tan... Ve dau toi biet di ve dau? http://nhattruongquang.**********.com

   • Khoc cho nho thuong voi trong long, khoc cho noi sau nhe nhu khong. Bao nhieu yeu thuong nhung ngay qua da tan theo khoi may bay that xa... http://nhattruongquang.**********.com

   • Tha nguoi dung noi se yeu minh toi mai thoi thi gio day toi se vui hon. Gio nguoi lac loi buoc chan ve noi xa xoi, cay dang chi rieng minh toi... http://nhattruongquang.**********.com

   • Loi em noi cho tinh chung ta, nhu doan cuoi trong cuon phim buon. Nguoi da den nhu la giac mo roi ra di cho anh bat ngo... http://nhattruongquang.**********.com

   • Tra lai em niem vui khi duoc gan ben em, tra lai em loi yeu thuong em dem, tra lai em niem tin thang nam qua ta dap xay. Gio day chi la nhung ky niem buon...http://nhattruongquang.**********.com


???????????:


 ???? ?????????????????????????????

??????????????????:
   • %???????%\New Folder.exe

설명 삽입자 Adriana Popa   2009년 2월 10일 화요일
설명 업데이트 Adriana Popa   2009년 2월 11일 수요일

뒤로 . . . .
https:// 이 창은 보안을 위해 암호화되었습니다.