TR/VB.BG - Trojan

In alte limbi

Scurta descriere

Descriere completa

Statistici

Nume:	TR/VB.BG
Descoperit pe data de:	03/03/2004
Tip:	Troian
ITW:	Nu
Numar infectii raportate:	Scazut
Potential de raspandire:	Scazut
Potential de distrugere:	Scazut spre mediu
Fisier static:	Da
Marime:	131.116 Bytes
MD5:	e4a6af3171e95e337527bbffc1201382
Versiune VDF:	6.24.00.39

General Metoda de raspandire:
   • Nu are rutina proprie de raspandire

Alias:
   • Kaspersky: Virus.Win32.VB.bg
   • F-Secure: Virus.Win32.VB.bg
   • Grisoft: Worm/VB.ZU
   • Eset: Win32/VB.DA

Sistem de operare:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Efecte secundare:
   • Creeaza fisiere
   • Reduce setarile de securitate
   • Modificari in registri

Fisiere Se copiaza in urmatoarele locatii:
   • C:\mig2.exe
   • %WINDIR%\mig2.exe
   • %SYSDIR%\shell.exe
   • %SYSDIR%\MrHelloween.scr
   • %SYSDIR%\IExplorer.exe
   • %ALLUSERSPROFILE%\Start Menu\Programs\Startup\Empty.pif
   • %home%\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
   • %home%\Local Settings\Application Data\WINDOWS\CSRSS.EXE
   • %home%\Local Settings\Application Data\WINDOWS\SERVICES.EXE
   • %home%\Local Settings\Application Data\WINDOWS\LSASS.EXE
   • %home%\Local Settings\Application Data\WINDOWS\SMSS.EXE
   • %unitate disc%\Data %numele utilizatorului curent%.exe
   • %directorul curent%\%numele directorului curent%.exe
   • %unitate disc%\mig2\New Folder.exe

Creeaza urmatorul director:
   • %unitate disc%\mig2

Sunt create fisierele:

– C:\Untukmu.txt Acesta este un fisier text care nu prezinta pericol si are urmatorul continut:
   • Untukmu

     Apa yang aku lakukan tak akan kau rasakan
     Apa yang kau lakukan tak akan aku rasakan
     Benar-benar jauh, jarak kita
     Aku terpaksa,lakukan ini krana kau yang mengawali..

     Senyummu adalah sedihku
     Sedihmu adalah tawaku

     Tangisku bukan milikmu
     Tangismu adalah milikku

     masih ada lagi yang ku kejar saat ini
     saat,ini aku akan mulai mengejar yang lain
     Lepaskan Dendam dan tawaku saat ini
     JUST, 4u MIG - MIG

– %WINDIR%\msvbvm60.dll
– %SYSDIR%\msvbvm60.dll
– %unitate disc%\mig2\Folder.htt
– %unitate disc%\desktop.ini

Registrii sistemului Urmatoarele chei sunt adaugate in registri pentru a rula procesul la repornirea sistemului:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "Logon%numele utilizatorului curent%"="%home%\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
   • "System Monitoring"="%home%\Local Settings\Application Data\WINDOWS\LSASS.EXE"

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "mig2"="%WINDIR%\mig2.exe"
   • "Service%numele utilizatorului curent%"="%home%\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
   • "MSMSGS"="%home%\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"

Urmatoarele chei din registri sunt modificate:

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   Vechea valoare:
   • "Shell"="Explorer.exe"
   • "Userinit"="%SYSDIR%\userinit.exe"
   Noua valoare:
   • "Shell"="Explorer.exe "%SYSDIR%\IExplorer.exe""
   • "Userinit"="%SYSDIR%\userinit.exe,%SYSDIR%\IExplorer.exe"

– [HKCR\exefile]
   Vechea valoare:
   • @="Application"
   Noua valoare:
   • @="File Folder"

– [HKCR\exefile\shell\open\command]
   Vechea valoare:
   • @=""%1" %*"
   Noua valoare:
   • @="%SYSDIR%\shell.exe" "%1" %*"

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug]
   Vechea valoare:
   • "Auto"="1"
   • "Debugger"="drwtsn32 -p %ld -e %ld -g"
   Noua valoare:
   • "Auto"="1"
   • "Debugger"="%SYSDIR%\Shell.exe"

Diverse setari in Explorer:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   Vechea valoare:
   • "Hidden"=%setarile utilizatorului%
   • "HideFileExt"=%setarile utilizatorului%
   • "ShowSuperHidden"=%setarile utilizatorului%
   Noua valoare:
   • "Hidden"=dword:00000000
   • "HideFileExt"=dword:00000001
   • "ShowSuperHidden"=dword:00000000

– [HKCU\Control Panel\Desktop]
   Vechea valoare:
   • "ScreenSaverIsSecure"="1"
   • "SCRNSAVE.EXE"=%setarile utilizatorului%
   Noua valoare:
   • "ScreenSaverIsSecure"="0"
   • "SCRNSAVE.EXE"="%SYSDIR%\MRHELL~1.SCR"

– [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot]
   Vechea valoare:
   • "AlternateShell"="cmd.exe"
   Noua valoare:
   • "AlternateShell"="%WINDIR%\mig2.exe"

– [HKCR\lnkfile\shell\open\command]
   Vechea valoare:
   • @=" "%1" %*"
   Noua valoare:
   • @=" "%SYSDIR%\shell.exe" "%1" %*"

– [HKCR\piffile\shell\open\command]
   Vechea valoare:
   • @=""%1" %*"
   Noua valoare:
   • @="%SYSDIR%\shell.exe" "%1" %*"

– [HKCR\batfile\shell\open\command]
   Vechea valoare:
   • @=""%1" %*"
   Noua valoare:
   • @="%SYSDIR%\shell.exe" "%1" %*"

– [HKCR\comfile\shell\open\command]
   Vechea valoare:
   • @=""%1" %*"
   Noua valoare:
   • @="%SYSDIR%\shell.exe" "%1" %*"

Dezactivarea programelor Regedit si Task Manager:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
   Vechea valoare:
   • "DisableCMD"=%setarile utilizatorului%
   • "DisableTaskMgr"=%setarile utilizatorului%
   • "DisableRegistryTools"=%setarile utilizatorului%
   Noua valoare:
   • "DisableCMD"=dword:00000001
   • "DisableTaskMgr"=dword:00000001
   • "DisableRegistryTools"=dword:00000001

Diverse setari in Explorer:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   Vechea valoare:
   • "NoFolderOptions"=%setarile utilizatorului%
   Noua valoare:
   • "NoFolderOptions"=dword:00000001

– [HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
   Vechea valoare:
   • "DisableConfig"=%setarile utilizatorului%
   • "DisableSR"=%setarile utilizatorului%
   Noua valoare:
   • "DisableConfig"=dword:00000001
   • "DisableSR"=dword:00000001

– [HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer]
   Noua valoare:
   • "LimitSystemRestoreCheckpointing"=dword:00000001
   • "DisableMSI"=dword:00000001

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\
   CabinetState]
   Noua valoare:
   • "FullPathAddress"=dword:00000001

Terminarea proceselor Lista cu procesele oprite:
   • regedit.exe; AVP.exe; rtvscan.exe; NAV.exe; VSHWIN32.exe;
      ProcessManager.exe; RegistryEditor.exe; Msiexec.exe; avgemc.exe;
      nvcoas.exe; mcvsescn.exe; firefox.exe; TASKMGR.EXE; setup.exe;
      Opera.exe; avguad.exe.; avgnt.exe; killvb.exe; Msi.exe

Procesele care contin urmatoarele siruri de caractere sunt oprite:
   • ANT; BRO; VIR; TASK; REG; ASM; DBG; W32; BUG; HEX; DETEC; PROC; WALK;
      REST; AVS; OPTIONS; AVG; SYMANTEC; PANDA; MCAFEE; PC-CILLIN; F-PROT;
      KASPERSKY; VAKSIN; ANTI; VIRUS

Processes containing the following window title (ro)
   • RegEdit_RegEdit
   • Registry Editor
   • Folder Options
   • Local Settings

Urmatorul serviciu este dezactivat:
   • System Restore

Detaliile fisierului Limbaj de programare:
Limbaj de programare folosit: Visual Basic.

Pentru o descriere scurta click aici.

Descriere introdusa de Adriana Popa la Tue, 21 Nov 2006 14:15 (GMT+1)
Descriere actualizata de Adriana Popa la Thu, 23 Nov 2006 13:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back