Need help? Ask the community or hire an expert.
Go to Avira Answers
??:DR/Autoit.I.2
????:13/12/2012
??:?????
????:?
????????????????
??/????????????
?? / ?????????
????:?
????:215.456 ??
MD5 ???:3b5cf70876ef2e58a30dfa85c16b49bd
VDF ??:7.11.53.216 - 2012년 12월 13일 목요일
IVDF ??:7.11.53.216 - 2012년 12월 13일 목요일

 ???? ????:
    ??????Autorun??


??:
   •  Mcafee: W32/Autorun.worm.h virus
   •  Sophos: W32/SillyFDC-AP
   •  Panda: W32/Autorun.SF
   •  Eset: Win32/Autoit.AC
   •  Bitdefender: Worm.Generic.77741


??/????:
   • Windows 2000
   • Windows XP
   • Windows 2003


???:
   • ??????
   • ??????
   • ????????
   • ?????

 ?? ???????????:
   • %SYSDIR%\msmsgs.exe
   • %???%\system.exe
   • %???%\%random directories%.exe



?????????
%PROGRAM FILES%\ESET\nod32.exe

??????:
   • %?????%




??????:
   • %PROGRAM FILES%\ESET\nod32.exe
   • %PROGRAM FILES%\ESET\nod32kui.exe
   • %PROGRAM FILES%\ESET\nod32krn.exe



??????:

%WINDIR%\autorun.inf ???????????????????:
   • %????????%

%???%\autorun.inf ???????????????????:
   • %????????%




??????????:

???????:
   • http://ppt.th.gs/web-p/pt/file/**********
???????????????????

???????:
   • http://ppt.th.gs/web-p/pt/file/**********
???????????????????

???????:
   • http://ppt.th.gs/web-p/pt/file/**********
???????????????????

 ??? ???????????????????????:

  [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "Msmsgs"="%SYSDIR%\Msmsgs.exe"
   • "SYS1"="%SYSDIR%\system.exe"
   • "SYS2"="%SYSDIR%\bad1.exe"
   • "SYS3"="%SYSDIR%\bad2.exe"
   • "SYS4"="%SYSDIR%\bad3.exe"



?????????????:

–  [HKCU\Software\Microsoft\Internet Explorer\Main]
   • "Window Title"

–  [HKLM\SYSTEM\ControlSet001\Services\NOD32krn]
   • "ImagePath"

–  [HKLM\SYSTEM\ControlSet001\Services\nod32drv]
   • "ImagePath"



???????????????????????:
   • [HKCR\lnkfile\isShortcut]



?????????????:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system]
   • "DisableRegistryTools"=dword:0x00000001
   • "DisableTaskMgr"=dword:0x00000001



?????????:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
   ??:
   • "GlobalUserOffline"=dword:0x00000000

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\TaskManager]
   ??:
   • "Preferences"=hex:9C,02,00,00,E8,03,00,00,02,00,00,00,01,00,00,00,01,00,00,00,5A,02,00,00,02,00,00,00,FA,04,00,00,18,03,00,00,01,00,00,00,00,00,00,00,02,00,00,00,03,00,00,00,04,00,00,00,FF,FF,FF,FF,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,00,00,00,00,00,00,01,00,00,00,02,00,00,00,03,00,00,00,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,01,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,02,00,00,00,04,00,00,00,06,00,00,00,0B,00,00,00,0E,00,00,00,FF,FF,FF,FF,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,6B,00,00,00,32,00,00,00,6B,00,00,00,23,00,00,00,46,00,00,00,46,00,00,00,3C,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,00,00,00,00,01,00,00,00,02,00,00,00,03,00,00,00,04,00,00,00,05,00,00,00,06,00,00,00,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,6F,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   ??:
   • "Hidden"=dword:0x00000002
   • "HideFileExt"=dword:0x00000001
   • "ShowSuperHidden"=dword:0x00000000
   • "SuperHidden"=dword:0x00000000

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   ??:
   • "NoDriveTypeAutoRun"=dword:0x0000005b
   • "NoFind"=dword:0x00000001
   • "NoFolderOptions"=dword:0x00000001

 ???? ???????:
   • winsystem.exe
   • handydriver.exe
   • kerneldrive.exe
   • Wscript.exe
   • cmd.exe
   • nod32krn.exe
   • nod32kui.exe


 ?????? ???????:
???????????????????????????????

설명 삽입자 Petre Galan   2009년 12월 14일 월요일
설명 업데이트 Petre Galan   2009년 12월 14일 월요일

뒤로 . . . .
https:// 이 창은 보안을 위해 암호화되었습니다.