Нужен совет? Обратитесь за помощью к сообществу или специалистам.
Перейти к Avira Answers
???:BDS/Mirc-based.K.5
?????????:23/12/2008
???:Backdoor ??????
? ???????? ????????:??
?????????? ????? ?????????:?? ??????? ?? ????????
????????? ???????????????:?? ???????? ?? ????????
????????? ???????????:?? ???????? ?? ????????
???? ??????????:??
?????? ?????:782.336 ????.
??????????? ????? MD5:375306f0f224df1542b0343d5756b8a5
?????? IVDF:7.01.01.27 - вторник, 23 декабря 2008 г.

 ????? ????? ???????????????:
    Infects files (ru)


?????????? (?liases):
   •  Mcafee: W32/Virut.gen
   •  Sophos: W32/Vetor-A
   •  Panda: W32/Virutas.gen
   •  Eset: Win32/Virut.Q
   •  Bitdefender: IRC-Worm.Generic.4269


???????????? ???????:
   • Windows 2000
   • Windows XP
   • Windows 2003


???????????:
   • ??????? ??????????? ?????
Infects files (ru)
   • ??????? ??????? ???????? ????????????
   • ????????? ???????
   • ????????? ?????????????????? ???????????? ? ??????????

 ????? ????????? ????????? ?????:

%PROGRAM FILES%\mIRC\IRC Bot\control.ini
%PROGRAM FILES%\mIRC\IRC Bot\remote.ini
%PROGRAM FILES%\mIRC\IRC Bot\svchost.exe
%PROGRAM FILES%\mIRC\IRC Bot\Anjing_Malingsia.sys
%PROGRAM FILES%\mIRC\IRC Bot\Stupid.sys
%PROGRAM FILES%\Microsoft Office
%PROGRAM FILES%\mIRC\IRC Bot\fuck.sys
%PROGRAM FILES%\mIRC\IRC Bot\kontol.mrc
%PROGRAM FILES%\mIRC\IRC Bot\perampok_budaya.sys
%PROGRAM FILES%\mIRC\IRC Bot\Nama_Anjing.sys
%PROGRAM FILES%\mIRC\IRC Bot\Channel_Babi.sys
%PROGRAM FILES%\mIRC\IRC Bot\Nama_Babi.sys
%PROGRAM FILES%\mIRC\IRC Bot\Asshole.sys

 ?????? ??? ?????????? ??????? ???????? ????? ???????????? ??????? ???? ?? ????????? ???????? ??????????? ? ????? ???????.

  [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
   • "Shell"="Explorer.exe, %PROGRAM FILES%\Microsoft Office\WINWORD.EXE"



??????????? ????????? ????? ???????:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
   Image File Execution Options\Acha.exe]
   • "Debugger"="cmd.exe /c del"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
   Image File Execution Options\wscript.exe]
   • "Debugger"="rundll32.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
   Image File Execution Options\AmyMastura.exe]
   • "Debugger"="cmd.exe /c del"

[HKLM\SOFTWARE\Microsoft\Security Center]
   • "AntiVirusDisableNotify"=dword:0x00000001
   • "AntiVirusOverride"=dword:0x00000001
   • "FirewallDisableNotify"=dword:0x00000001
   • "FirewallOverride"=dword:0x00000001
   • "FirstRunDisabled"=dword:0x00000001
   • "UpdatesDisableNotify"=dword:0x00000001

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
   Image File Execution Options\registry.exe]
   • "Debugger"="cmd.exe /c del"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
   Image File Execution Options\csrsz.exe]
   • "Debugger"="cmd.exe /c del"



?????????? ????????? ????? ???????:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
   ????? ????????:
   • "EnableLUA"=dword:0x00000000

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   ????? ????????:
   • "ShowSuperHidden"=dword:0x00000000
   • "SuperHidden"=dword:0x00000000

[HKLM\SOFTWARE\Classes\exefile]
   ????? ????????:
   • "NeverShowExt"=""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
   Folder\SuperHidden]
   ????? ????????:
   • "CheckedValue"=dword:0x00000000
   • "DefaultValue"=dword:0x00000000
   • "UncheckedValue"=dword:0x00000000

[HKLM\SYSTEM\CurrentControlSet\Services\wuauserv]
   ????? ????????:
   • "Start"=dword:0x00000004
   • "Type"=dword:0x00000004

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess]
   ????? ????????:
   • "Start"=dword:0x00000004
   • "Type"=dword:0x00000004

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows]
   ????? ????????:
   • "load"=""

[HKLM\SYSTEM\CurrentControlSet\Services\wscsvc]
   ????? ????????:
   • "Start"=dword:0x00000004
   • "Type"=dword:0x00000004

[HKLM\SYSTEM\CurrentControlSet\Services\WinDefend]
   ????? ????????:
   • "Start"=dword:0x00000004
   • "Type"=dword:0x00000004

 ????????????? ?????? Infector type: (ru)

Appender (ru)
 Infector modifies last section (ru)


Self Modification (ru)

Infector polymorphic (ru)


?????:

???? ????? ????? ???????? ??????? ??????.

?????? ??????????? ????? ???????? ???????? ? ??????.


Infection Length (ru)

- 11.264 ????.


The following file is infected (S) (ru)

By file type (ru)
   • .exe

 IRC ??? ???????? ?????????? ? ??????? ? ??????????? ?????????? ?????????? ??????????????? ?????????? ?? ?????????? IRC ?????????:

??????: proxim.irc**********.pl
????: 80
?????: &virtu
???: %????????? ????????? ??????????%

??????: srv201.cy**********.name
????: 80
?????: &virtu
???: %????????? ????????? ??????????%

??????: 60.190.2**********.1**********
????: 80
?????: &virtu
???: %????????? ????????? ??????????%

 ????????????? – ??????????? ? ??????? ? ???????? ???????????? ??????.

    ??? ????????:
   • winlogon.exe



– Backdoor-????????? ??????????? ? ???????.

    ??? ????????:
   • %??? ???????? ????????%


 ?????????? Rootkit  ?????????? ? ????????? API-???????:
   • NtCreateFile
   • NtOpenFile
   • NtCreateProcess
   • NtCreateProcessEx

Описание добавил Petre Galan в(о) понедельник, 22 марта 2010 г.
Описание обновил Petre Galan в(о) среда, 24 марта 2010 г.

Назад . . . .
https:// Это окно зашифровано для вашей безопасности.