Need help? Ask the community or hire an expert.
Go to Avira Answers
??:TR/Spy.ZBot.PU
????:13/12/2012
??:?????
????:?
????????????????
??/????????
?? / ????????????
????:?
????:64.008 ??
MD5 ???:5f720c94795483a61e92acd4ccf74b44
VDF ??:7.11.53.216 - 2012년 12월 13일 목요일
IVDF ??:7.11.53.216 - 2012년 12월 13일 목요일

 ???? ??:
   •  Kaspersky: Worm.Win32.AutoRun.hsj
   •  F-Secure: Worm.Win32.AutoRun.hsj
   •  Bitdefender: Trojan.Generic.KD.170515
     GData: Trojan.Generic.KD.170515
     DrWeb: Win32.HLLW.Podol.1


??/????:
   • Windows 2000
   • Windows XP
   • Windows 2003


???:
   • ??????
   • ????????
   • ?????

 ?? ???????????:
   • %TEMPDIR%\srv%?????%.tmp

 ??? ?????????????????????????:

[HKLM\SYSTEM\CurrentControlSet\Services\
   srv%?????%]
   • "DisplayName"="srv%?????%"
   • "ErrorControl"=dword:0x00000001
   • "ImagePath"="%systemroot%\system32\svchost.exe -k netsvcs"
   • "ObjectName"="LocalSystem"
   • "Start"=dword:0x00000002
   • "Type"=dword:0x00000020



?????????????:

[HKLM\SYSTEM\CurrentControlSet\Services\srv%?????%\
   parameters]
   • "servicedll"="\\?\globalroot\Device\HarddiskVolume1\%TEMPDIR%\srv%?????%.tmp"

[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\
   srv%?????%]
   • "@"="service"



?????????:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
   ??:
   • "netsvcs"=hex:36,74,6F,34,00,41,70,70,4D,67,6D,74,00,41,75,64,69,6F,53,72,76,00,42,72,6F,77,73,65,72,00,43,72,79,70,74,53,76,63,00,44,4D,53,65,72,76,65,72,00,44,48,43,50,00,45,76,65,6E,74,53,79,73,74,65,6D,00,46,61,73,74,55,73,65,72,53,77,69,74,63,68,69,6E,67,43,6F,6D,70,61,74,69,62,69,6C,69,74,79,00,48,69,64,53,65,72,76,00,49,61,73,00,49,70,72,69,70,00,49,72,6D,6F,6E,00,4C,61,6E,6D,61,6E,53,65,72,76,65,72,00,4C,61,6E,6D,61,6E,57,6F,72,6B,73,74,61,74,69,6F,6E,00,4E,65,74,6D,61,6E,00,4E,6C,61,00,4E,57,43,57,6F,72,6B,73,74,61,74,69,6F,6E,00,4E,77,73,61,70,61,67,65,6E,74,00,52,61,73,61,75,74,6F,00,52,61,73,6D,61,6E,00,52,65,6D,6F,74,65,61,63,63,65,73,73,00,53,63,68,65,64,75,6C,65,00,53,65,63,6C,6F,67,6F,6E,00,53,45,4E,53,00,53,68,61,72,65,64,61,63,63,65,73,73,00,53,52,53,65,72,76,69,63,65,00,54,61,70,69,73,72,76,00,54,68,65,6D,65,73,00,54,72,6B,57,6B,73,00,57,33,32,54,69,6D,65,00,57,5A,43,53,56,43,00,57,6D,69,00,57,6D,64,6D,50,6D,53,70,00,77,69,6E,6D,67,6D,74,00,78,6D,6C,70,72,6F,76,00,6E,61,70,61,67,65,6E,74,00,68,6B,6D,73,76,63,00,42,49,54,53,00,77,75,61,75,73,65,72,76,00,53,68,65,6C,6C,48,57,44,65,74,65,63,74,69,6F,6E,00,00

 ?? ?? Internet ???
   • http://94.75.193.21/service/**********?affid=%??%
   • http://82.192.88.10//**********
   • http://82.192.88.10//**********
   • http://94.75.193.21/service/scripts/files/**********

 ?????? ????:
????????? MS Visual C++ ????


???????:
???????????????????????????????

설명 삽입자 Petre Galan   2011년 6월 16일 목요일
설명 업데이트 Petre Galan   2011년 6월 16일 목요일

뒤로 . . . .
https:// 이 창은 보안을 위해 암호화되었습니다.