Full description

病毒:	TR/FakeAV.oke
发现日期:	13/12/2012
类型:	特洛伊木马
广泛传播:	是
病毒传播个案呈报：	低程度
感染/传播能力：	低程度
破坏 / 损害程度：	中等程度
静态文件:	是
文件大小:	445.576 字节
MD5 校检和:	7a14060028698e2a2c5c64eb262c6868
VDF 版本:	7.11.53.216 - donderdag 13 december 2012
IVDF 版本:	7.11.53.216 - donderdag 13 december 2012

况概描述 传播方法:
   • 无内置传播例程

别名:
   • Kaspersky: Trojan.Win32.Jorik.Fraud.jor
   • Eset: Win32/Kryptik.WTQ

平台/操作系统:
   • Windows XP
   • Windows 2003
   • Windows Vista
   • Windows Server 2008
   • Windows 7

副作用:
   • 下载文件
   • 下载恶意文件
   • 存心误报恶意软件感染或系统问题，并向用户提呈购买修复程序的建议。
   • 注册表修改

执行完毕之后会显示以下信息:

文件它将本身复制到以下位置:
• %APPDATA%\gPtgkqBGrot.exe
成功创建后，它会被执行。进一步的调查表明，此文件是恶意软件。

它会尝试下载文件:

– 该位置如下所示:
• http://danelubinnalas.com/?ylO**********
它会保存在硬盘驱动器以下的位置: %TEMPDIR%\%随机字符串%.exe 进一步的调查表明，此文件是恶意软件。检测为: TR/Crypt.XPACK.Gen

注册表会添加以下注册表项目注册值:

– [HKCU\Control Panel]
   • "nsreg"="dword:0x4ee4fbe1"

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   • "Start_ShowControlPanel"="dword:0x00000000"
   • "Start_ShowHelp"="dword:0x00000000"
   • "Start_ShowMyComputer"="dword:0x00000000"
   • "Start_ShowMyDocs"="dword:0x00000000"
   • "Start_ShowMyGames"="dword:0x00000000"
   • "Start_ShowMyMusic"="dword:0x00000000"
   • "Start_ShowMyPics"="dword:0x00000000"
   • "Start_ShowNetConn"="dword:0x00000000"
   • "Start_ShowNetPlaces"="dword:0x00000000"
   • "Start_ShowPrinters"="dword:0x00000000"
   • "Start_ShowRecentDocs"="dword:0x00000000"
   • "Start_ShowRun"="dword:0x00000000"
   • "Start_ShowSearch"="dword:0x00000000"
   • "Start_ShowSetProgramAccessAndDefaults"="dword:0x00000000"
   • "Start_ShowUser"="dword:0x00000000"
   • "TaskbarGlomLevel"="dword:0x00000002"
   • "TaskbarGlomming"="dword:0x00000000"

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer]
   • "EnableAutoTray"="dword:0x00000000"

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]
   • ""=""
   • "_Favorites"=""

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\
   ActiveDesktop]
   • ""=""
   • "HidNoChangingWallPaperden"="dword:0x00000001"

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\
   Associations]
   • ""=""
   • "LowRiskFileTypess"=".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.scr;"

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\
   Attachments]
   • ""=""
   • "SaveZoneInformation"="dword:0x00000001"

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   • "NoDesktop"="dword:0x00000001"

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
   • ""=""
   • "DisableTaskMgr"="dword:0x00000001"

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
   • "DisableTaskMgr"="dword:0x00000001"

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "gPtgkqBGrot.exe"="C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\gPtgkqBGrot.exe"

– [HKEY_USERS\S-1-5-21-606747145-1647877149-1801674531-500\
   Control Panel]
   • "5761b2dc-ce77-4bfa-b965-6f33b1867cf2"=""
   • "7f6b3266-31c5-43a8-9547-e7911ad6fb33"=""
   • "nsreg"="dword:0x4ee4fbe1"

– [HKEY_USERS\S-1-5-21-606747145-1647877149-1801674531-500\Software\
   Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   • "Start_ShowControlPanel"="dword:0x00000000"
   • "Start_ShowHelp"="dword:0x00000000"
   • "Start_ShowMyComputer"="dword:0x00000000"
   • "Start_ShowMyDocs"="dword:0x00000000"
   • "Start_ShowMyGames"="dword:0x00000000"
   • "Start_ShowMyMusic"="dword:0x00000000"
   • "Start_ShowMyPics"="dword:0x00000000"
   • "Start_ShowNetConn"="dword:0x00000000"
   • "Start_ShowNetPlaces"="dword:0x00000000"
   • "Start_ShowPrinters"="dword:0x00000000"
   • "Start_ShowRecentDocs"="dword:0x00000000"
   • "Start_ShowRun"="dword:0x00000000"
   • "Start_ShowSearch"="dword:0x00000000"
   • "Start_ShowSetProgramAccessAndDefaults"="dword:0x00000000"
   • "Start_ShowUser"="dword:0x00000000"
   • "TaskbarGlomLevel"="dword:0x00000002"
   • "TaskbarGlomming"="dword:0x00000000"

– [HKEY_USERS\S-1-5-21-606747145-1647877149-1801674531-500\Software\
   Microsoft\Windows\CurrentVersion\Explorer]
   • "EnableAutoTray"="dword:0x00000000"

– [HKEY_USERS\S-1-5-21-606747145-1647877149-1801674531-500\Software\
   Microsoft\Windows\CurrentVersion\Explorer\Taskband]
   • ""=""
   • "_Favorites"=""

– [HKEY_USERS\S-1-5-21-606747145-1647877149-1801674531-500\Software\
   Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
   • ""=""
   • "HidNoChangingWallPaperden"="dword:0x00000001"

– [HKEY_USERS\S-1-5-21-606747145-1647877149-1801674531-500\Software\
   Microsoft\Windows\CurrentVersion\Policies\Associations]
   • ""=""
   • "LowRiskFileTypess"=".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.scr;"

– [HKEY_USERS\S-1-5-21-606747145-1647877149-1801674531-500\Software\
   Microsoft\Windows\CurrentVersion\Policies\Attachments]
   • ""=""
   • "SaveZoneInformation"="dword:0x00000001"
   •

– [HKEY_USERS\S-1-5-21-606747145-1647877149-1801674531-500\Software\
   Microsoft\Windows\CurrentVersion\Policies\Explorer]
   • "NoDesktop"="dword:0x00000001"

– [HKEY_USERS\S-1-5-21-606747145-1647877149-1801674531-500\Software\
   Microsoft\Windows\CurrentVersion\Policies\System]
   • ""=""
   • "DisableTaskMgr"="dword:0x00000001"

会更改以下注册表项:

– [HKCU\Software\Microsoft\Internet Explorer\Download]
   旧值:
   • "CheckExeSignatures"="yes"
   新值:
   • "CheckExeSignatures"="no"

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   旧值:
   • "Hidden"="dword:0x00000001"
   新值:
   • "Hidden"="dword:0x00000000"

– [HKEY_USERS\S-1-5-21-606747145-1647877149-1801674531-500\Software\
   Microsoft\Internet Explorer\Download]
   旧值:
   • "CheckExeSignatures"="yes"
   新值:
   • "CheckExeSignatures"="no"

– [HKEY_USERS\S-1-5-21-606747145-1647877149-1801674531-500\Software\
   Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   旧值:
   • "Hidden"="dword:0x00000001"
   新值:
   • "Hidden"="dword:0x00000000"
   新值:
   • "Order"="hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00"
   旧值:
   • "Favorites"="hex:00,16,00,00,00,14,00,1f,80,f4,a1,59,25,d7,21,d4,11,bd,af,00,c0,\
   • ,4f,60,b9,f0,00,00,00,16,00,00,00,14,00,1f,80,f5,a1,59,25,d7,\
   • ,21,d4,11,bd,af,00,c0,4f,60,b9,f0,00,00,ff"

– [HKEY_USERS\S-1-5-21-606747145-1647877149-1801674531-500\Software\
   Microsoft\Windows\CurrentVersion\Explorer\StartPage]
   旧值:
   • "StartMenu_Balloon_Time"="hex:3a,3c,36,65,63,bd,cb,01"
   新值:
   • "StartMenu_Balloon_Time"="hex:68,b1,42,69,36,b8,cc,01"

进程终止以下进程被终止:
• %正在运行的所有进程%

其他访问 Internet 资源：
• http://stepinstoneuse.com/**********.php?0Q9**********
• http://danelubinnalas.com/?ylO**********

文件详细信息 编程语言:
该恶意软件程序是用 MS Visual C++ 编写的。

Description inserted by Martin Muench on vrijdag 9 december 2011
Description updated by Martin Muench on dinsdag 20 december 2011

Terug . . . .

Mijn Account