Need help? Ask the community or hire an expert.
Go to Avira Answers
??:Worm/Palevo.zlt
????:13/12/2012
??:??
????:?
????????????????
??/?????????
?? / ????????????
????:?
????:109.056 ??
MD5 ???:8a2fc1c7c7bda12e344e4f652cc7d091
VDF ??:7.11.53.216 - donderdag 13 december 2012
IVDF ??:7.11.53.216 - donderdag 13 december 2012

 ???? ????:
    ??????Autorun??
    Messenger
   • ????


??:
   •  Mcafee: W32/Palevo.gen.a virus
   •  Sophos: Mal/Palevo-A
   •  Bitdefender: Win32.Worm.Palevo.AV
   •  Panda: W32/P2Pworm.FW
   •  Eset: Win32/Peerfrag.GL


??/????:
   • Windows 2000
   • Windows XP
   • Windows 2003


???:
   • ??????
   • ??????
   • ?????

 ?? ???????????:
   • %HOME%\csrss.exe
   • %???%\CAROBNJAK\jellena.exe



???????????????



??????:

%???%:\RECYCLER\%CLSID%\Desktop.ini
%???%\autorun.inf ???????????????????:
   • %????????%

%temporary internet files%\kristijan[1].exe ?????????????????? ???: Worm/Palevo.104960

%TEMPDIR%\890.exe ?????????????????? ???: Worm/Palevo.104960

%TEMPDIR%\127.exe
%temporary internet files%\24[1].exe
%temporary internet files%\icq600[1].exe ?????????????????? ???: Worm/Palevo.auvi

%HOME%\Application Data\lbisov.exe
%???%:\RECYCLER\%CLSID%\yv8g67.exe ?????????????????? ???: Worm/Palevo.auvi

%TEMPDIR%\8975119.exe ?????????????????? ???: Worm/Palevo.auvi

%HOME%\Application Data\ozzfhv.exe ?????????????????? ???: Worm/Palevo.104960




??????????:

????????:
   • http://rapidshare.com/files/415338241/**********
   • http://rs816tl3.rapidshare.com/files/415338241/**********


???????:
   • http://94.228.214.202/**********


???????:
   • http://193.104.186.88:38716/**********


???????:
   • http://94.228.214.202/chivas/**********


???????:
   • http://178.162.182.141:31045/**********


???????:
   • http://178.162.182.141:31045/**********




??????????:

???:
   • %TEMPDIR%\127.exe


???:
   • %TEMPDIR%\890.exe


???:
   • %TEMPDIR%\8975119.exe

 ??? ????????????????????????:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   • "Taskman"="%HOME%\Application Data\ozzfhv.exe"

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
   • "Shell"="%???%\%CLSID%\yv8g67.exe,%HOME%\Application Data\ozzfhv.exe,explorer.exe,%HOME%\Application Data\lbisov.exe"

 P2P ????????????????????????:   ????????????????????:
   • Software\BearShare\General
   • Software\iMesh\General
   • Software\Shareaza\Shareaza\Downloads
   • Software\Kazaa\LocalContent
   • Software\DC++
   • Software\eMule
   • Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule Plus_is1

   ???????????????:
   • \Local Settings\Application Data\Ares\My Shared Folder


 Messenger ???? Messenger ???? ?????????:

Windows Live Messenger

? URL ??????????????? ????????????????????????

 ???? ???????:

sandra.pri**********.com ? UDP ??? 44000
gut**********.com ? UDP ??? 8111
77.91.22**********.248 ? UDP ??? 15000
91.211.11**********.127 ? UDP ??? 8111
f5v**********.com ? UDP ??? 443
95.211.**********.148 ? UDP ??? 5190

 ???? ???????????????????

    ???:
   • explorer.exe


 ?????? ???????:
???????????????????????????????

Beschrijving ingevoegd door Petre Galan op maandag 6 september 2010
Beschrijving bijgewerkt door Petre Galan op woensdag 8 september 2010

Terug . . . .
https:// Dit venster is voor uw veiligheid gecodeerd.