ADSPY/IEHlpr.F.2 - Adware / Spyware

In alte limbi

Scurta descriere

Descriere completa

Statistici

Nume:	ADSPY/IEHlpr.F.2
Descoperit pe data de:	05/10/2006
Tip:	Troian
ITW:	Nu
Numar infectii raportate:	Scazut
Potential de raspandire:	Scazut
Potential de distrugere:	Scazut spre mediu
Fisier static:	Da
Marime:	30.208 Bytes
MD5:	4242246b3403cfc7809fd4604967953d
Versiune VDF:	6.35.01.196
Versiune IVDF:	6.35.01.200

General Metoda de raspandire:
   • Nu are rutina proprie de raspandire

Alias:
   • Kaspersky: Trojan-Dropper.Win32.Agent.atg

Sistem de operare:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Efecte secundare:
   • Creeaza fisiere
   • Modificari in registri

Fisiere Se copiaza in urmatoarea locatie:
• %WINDIR%\fonts\msshapi.dll

Sunt create fisierele:

– %WINDIR%\Fonts\winhelp.ini Informatii obtinute despre sistem.
– %WINDIR%\Fonts\mms.exe Fisierul este executat dupa ce a fost creat.

Registrii sistemului Inregistreaza un browser helper object (BHO) prin adaugarea urmatoarei chei in registri:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
   Browser Helper Objects\{02C9B9AB-6372-46C5-B356-773FAF3B6B1E}]

Urmatoarele chei sunt adaugate in registrii sistemului:

– [HKCR\IEHelper.WinHelper]
   • @="internet explorer helper"

– [HKCR\IEHelper.WinHelper\CLSID]
   • @="{02C9B9AB-6372-46C5-B356-773FAF3B6B1E}"

– [HKCR\IEHelper.WinHelper\CurVer]
   • @="IEHelper.WinHelper.1"

– [HKCR\IEHelper.WinHelper.1]
   • @="internet explorer helper"

– [HKCR\IEHelper.WinHelper.1\CLSID]
   • @="{02C9B9AB-6372-46C5-B356-773FAF3B6B1E}"

– [HKCR\CLSID\{02C9B9AB-6372-46C5-B356-773FAF3B6B1E}]
   • @="internet explorer helper"

– [HKCR\CLSID\{02C9B9AB-6372-46C5-B356-773FAF3B6B1E}\InprocServer32]
   • @="%directorul de activare malware%\%fisier executat%"
   • "ThreadingModel"="Apartment"

– [HKCR\CLSID\{02C9B9AB-6372-46C5-B356-773FAF3B6B1E}\ProgID]
   • @="IEHelper.WinHelper.1"

– [HKCR\CLSID\{02C9B9AB-6372-46C5-B356-773FAF3B6B1E}\Programmable]
– [HKCR\CLSID\{02C9B9AB-6372-46C5-B356-773FAF3B6B1E}\TypeLib]
   • @="{964DDEFF-B16C-4113-8FF7-8E83B53C8ED8}"

– [HKCR\CLSID\{02C9B9AB-6372-46C5-B356-773FAF3B6B1E}\
   VersionIndependentProgID]
   • @="IEHelper.WinHelper"

– [HKCR\TypeLib\{964DDEFF-B16C-4113-8FF7-8E83B53C8ED8}\1.0]
   • @="IEHelper 1.0 Type Library"

– [HKCR\TypeLib\{964DDEFF-B16C-4113-8FF7-8E83B53C8ED8}\1.0\0\win32]
   • @="%directorul de activare malware%\%fisier executat%"

– [HKCR\TypeLib\{964DDEFF-B16C-4113-8FF7-8E83B53C8ED8}\1.0\FLAGS]
   • @="0"

– [HKCR\TypeLib\{964DDEFF-B16C-4113-8FF7-8E83B53C8ED8}\1.0\HELPDIR]
   • @="%directorul de activare malware%"

– [HKCR\Interface\{D922591D-7893-412B-B801-C3B2F31BE4C9}]
   • @="IWinHelper"

– [HKCR\Interface\{D922591D-7893-412B-B801-C3B2F31BE4C9}\
   ProxyStubClsid]
   • @="{00020424-0000-0000-C000-000000000046}"

– [HKCR\Interface\{D922591D-7893-412B-B801-C3B2F31BE4C9}\
   ProxyStubClsid32]
   • @="{00020424-0000-0000-C000-000000000046}"

– [HKCR\Interface\{D922591D-7893-412B-B801-C3B2F31BE4C9}\TypeLib]
   • @="{964DDEFF-B16C-4113-8FF7-8E83B53C8ED8}"
   • "Version"="1.0"

Backdoor Servere contactate:
Urmatoarele:
   • http://www.update.coolv.cn/advertise/**********
   • http://www.update.coolv.cn/files/**********
   • http://www.update.coolv.cn/**********

Odata conectat, descarca o alta lista de servere.

Trimte informatii despre:
    • Numele sistemului
    • Viteza procesorului
    • Utilizatorul curent
    • Spatiu liber pe disc
    • Memorie nealocata
    • Cantitatea de memorie
    • Ora sistemului
    • Informatii despre sistemul de operare

Posibilitati de control la distanta:
    • Vizitarea unui website

Detaliile fisierului Limbaj de programare:
Limbaj de programare folosit: C (compilat cu Microsoft Visual C++).

Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit un program de compresie runtime.

Pentru o descriere scurta click aici.

Descriere introdusa de Monica Ghitun la Thu, 05 Oct 2006 16:18 (GMT+1)
Descriere actualizata de Andrei Ivanes la Fri, 27 Oct 2006 08:12 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back