Worm/AutoIt.B - Worm

In alte limbi

Scurta descriere

Descriere completa

Statistici

Nume:	Worm/AutoIt.B
Descoperit pe data de:	20/09/2006
Tip:	Vierme
ITW:	Da
Numar infectii raportate:	Scazut
Potential de raspandire:	Scazut spre mediu
Potential de distrugere:	Scazut spre mediu
Fisier static:	Da
Marime:	181.472 Bytes
MD5:	2c978e0144ec56646a527473b87ebb6b
Versiune VDF:	6.36.00.36
Versiune IVDF:	6.36.00.46

General Metoda de raspandire:
   • Messenger

Sistem de operare:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Efecte secundare:
   • Modificari in registri

Fisiere Se copiaza in urmatoarele locatii:
• %WINDIR%\svchost32.exe
• %temporary internet files%\Content.IE5\C5MBSP2B\host[1].jpg

Registrii sistemului Urmatoarele chei sunt adaugate in registrii sistemului:

– [HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel]
   • "Homepage"=dword:00000001

– [HKCU\Software\Microsoft\Internet Explorer\Main]
   • "Start Page"="http://www.geocities.co.jp/**********"
   • "Window Title"="Viva TermeX !"

– [HKCU\Software\Yahoo\pager\View\YMSGR_buzz]
   • "content url"="http://www.geocities.co.jp/**********"

– [HKCU\Software\Yahoo\pager\View\YMSGR_Launchcast]
   • "content url"="http://www.geocities.co.jp/**********"

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "Task Manager"="c:\windows\\svchost32.exe"

Urmatoarea cheie din registri este modificata:

Dezactivarea programelor Regedit si Task Manager:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
   Vechea valoare:
   • "DisableTaskMgr"=dword:00000001
   • "DisableRegistryTools"=dword:00000001
   Noua valoare:
   • "DisableTaskMgr"=%setarile utilizatorului%
   • "DisableRegistryTools"=%setarile utilizatorului%

Messenger Se raspandeste prin messenger. Caracteristicile sunt:

– Yahoo Messenger

Catre:
Toate intrarile din lista de contacte.

Mesaj
Mesajul transmis arata ca unul din urmatoarele:

   • the only way to clean some online viruses that may lead you into troubles : %link% <<

   • A new dangerous computer virus that can destroys all your data has just been released . Click here to know how to avoid it : %link% <<

   • have you ever seen such a silly man like this ? %link% =))

   • Just check out my new personal website : %link% C00l !!!

   • Now you can avoid some critical online viruses by updating Windows . Click here to know how to Update your Windows : %link%

   • wtf is this ? Wanna give me a shit ? %link% x-( <<

   • Let's vote for Miss Vietnam - Mai Phuong Thuy - for the upcoming Miss World championship : %link% !!

   • cool girls : %link% :x:x:x:x:x

   • Cac ban co the tranh bi nhiem cac loai virus online gan day bang cach update Windows . Vao day de biet cach Update Win ma ko can ban quyen Windows xin: %link%

   • making money online never be easier : %link%

   • di'nh virus ru`i =)) du`ng cai nay ma diet na`y : %link%

   • Download free MP3s : %link% <<

   • ha`i dek chiu dc =)) %link% =)) =))

%link%
In timp ce wildcard-ul poate fi:
   • http://www.geocities.co.jp/**********
   • http://www.geocities.co.jp/**********

Mesajele primite pot arata astfel:

Detaliile fisierului Limbaj de programare:
Limbaj de programare folosit: C (compilat cu Microsoft Visual C++).

Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit urmatorul program de arhivare:
• UPX

Pentru o descriere scurta click aici.

Descriere introdusa de Victor Tone la Mon, 18 Sep 2006 10:26 (GMT+1)
Descriere actualizata de Victor Tone la Wed, 20 Sep 2006 14:40 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back