Need help? Ask the community or hire an expert.
Go to Avira Answers
??:Worm/Brontok.C
????:13/12/2012
??:??
????:?
?????????????
??/?????????????
?? / ?????????
????:?
VDF ??:7.11.53.216 - 13 Aralık 2012 Perşembe
IVDF ??:7.11.53.216 - 13 Aralık 2012 Perşembe

 ???? ????:
   • ????
   • ????


??:
   •  Symantec: W32.Rontokbro.K@mm
   •  TrendMicro: WORM_RONTOKBRO.J
   •  Bitdefender: Win32.Brontok.C@mm


??/????:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


???:
   • ??????????
   • ????
   • ???????????
   • ?????


????????????? Windows ???????????:


 ?? ???????????:
   • %WINDIR%\ShellNew\sempalong.exe
   • %WINDIR%\eksplorasi.exe
   • %HOME%\Local Settings\Application Data\smss.exe
   • %HOME%\Local Settings\Application Data\services.exe
   • %HOME%\Local Settings\Application Data\lsass.exe
   • %HOME%\Local Settings\Application Data\inetinfo.exe
   • %HOME%\Local Settings\Application Data\csrss.exe
   • %HOME%\Start Menu\Programs\Startup\Empty.pif
   • %HOME%\Templates\brengkolang.exe
   • %SYSDIR%\%?????%'s setting.scr



?????????
%????????%\autoexec.bat

??????:
   • pause




??????:

%HOME%\Local Settings\Application Data\Kosong.Bron.Tok.txt ???????????????????:
   • Brontok.A
     By: HVM31
     -- JowoBot
     VM Community --

 ??? ????????????????????????:

[HKLM\software\microsoft\windows\currentversion\run]
   • "Bron-Spizaetus" = ""c:\winows\ShellNew\sempalong.exe""

[HKCU\software\microsoft\windows\currentversion\run]
   • "Tok-Cirrhatus" = "c:\Documents and Settings\UserLocal Settings\Application Data\smss.exe"



?????????????:

[HKCU\software\microsoft\windows\currentversion\Policies\System]
   • "DisableCMD" = dword:00000000
   • "DisableRegistryTools" = dword:00000001

[HKCU\software\microsoft\windows\currentversion\Policies\Explorer]
   • "NoFolderOptions" = dword:00000001



?????????:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   ??:
   • "Shell" = "Explorer.exe"
   ??:
   • "Shell" = "Explorer.exe "c:\winows\eksplorasi.exe""

[HKCU\software\microsoft\windows\currentversion\explorer\advanced]
   ??:
   • "ShowSuperHidden" = %???????%
   • "HideFileExt" = %???????%
   • "Hidden" = %???????%
   ??:
   • "ShowSuperHidden" = dword:00000000
   • "HideFileExt" = dword:00000001
   • "Hidden" = dword:00000000

 ?? ????:
????????????????:
   • .HTML; .TXT; .EML; .WAB; .ASP; .PHP; .CFM; .CSV; .DOC; .XLS; .PDF;
      .PPT; .HTT


????:
??????????????????????:
   • .VBS; DOMAIN; HIDDEN; DEMO; DEVELOP; FOO@; KOMPUTER; SENIOR; DARK;
      BLACK; BLEEP; FEEDBACK; IBM.; INTEL.; MACRO; ADOBE; FUCK; RECIPIENT;
      SERVER; PROXY; ZEND; ZDNET; CNET; DOWNLOAD; HP.; XEROX; CANON;
      SERVICE; ARCHIEVE; NETSCAPE; MOZILLA; OPERA; NOVELL; NEWS; UPDATE;
      RESPONSE; OVERTURE; GROUP; GATEWAY; RELAY; ALERT; SEKUR; CISCO; LOTUS;
      MICRO; TREND; SIEMENS; FUJITSU; NOKIA; W3.; NVIDIA; APACHE; MYSQL;
      POSTGRE; SUN.; GOOGLE; SPERSKY; ZOMBIE; ADMIN; AVIRA; AVAST; TRUST;
      ESAVE; ESAFE; PROTECT; ALADDIN; ALERT; BUILDER; DATABASE; AHNLAB;
      PROLAND; ESCAN; HAURI; NOD32; SYBARI; ANTIGEN; ROBOT; ALWIL; YAHOO;
      COMPUSE; COMPUTE; SECUN; SPYW; REGIST; FREE; BUG; MATH; LAB; IEEE;
      KDE; TRACK; INFORMA; FUJI; @MAC; SLACK; REDHA; SUSE; BUNTU; XANDROS;
      @ABC; @123; LOOKSMART; SYNDICAT; ELEKTRO; ELECTRO; NASA; LUCENT;
      TELECOM; STUDIO; SIERRA; USERNAME; IPTEK; CLICK; SALES; PROMO

 ?? ???????????????:

???????????????

?????????:
   • mcafee.com
   • www.mcafee.com
   • mcafeesecurity.com
   • www.mcafeesecurity.com
   • mcafeeb2b.com
   • www.mcafeeb2b.com
   • nai.com
   • www.nai.com
   • vil.nai.com
   • grisoft.com
   • www.grisoft.com
   • kaspersky-labs.com
   • www.kaspersky-labs.com
   • kaspersky.com
   • www.kaspersky.com
   • downloads1.kaspersky-labs.com
   • downloads2.kaspersky-labs.com
   • downloads3.kaspersky-labs.com
   • downloads4.kaspersky-labs.com
   • download.mcafee.com
   • grisoft.cz
   • www.grisoft.cz
   • norton.com
   • www.norton.com
   • symantec.com
   • www.symantec.com
   • liveupdate.symantecliveupdate.com
   • liveupdate.symantec.com
   • update.symantec.com
   • securityresponse.symantec.com
   • sarc.com
   • www.sarc.com
   • vaksin.com
   • www.vaksin.com
   • norman.com
   • www.norman.com
   • trendmicro.com
   • www.trendmicro.com
   • trendmicro.co.jp
   • www.trendmicro.co.jp
   • trendmicro-europe.com
   • www.trendmicro-europe.com
   • ae.trendmicro-europe.com
   • it.trendmicro-europe.com
   • secunia.com
   • www.secunia.com
   • winantivirus.com
   • www.winantivirus.com
   • pandasoftware.com
   • www.pandasoftware.com
   • esafe.com
   • www.esafe.com
   • f-secure.com
   • www.f-secure.com
   • europe.f-secure.com
   • bhs.com
   • www.bhs.com
   • datafellows.com
   • www.datafellows.com
   • cheyenne.com
   • www.cheyenne.com
   • ontrack.com
   • www.ontrack.com
   • sands.com
   • www.sands.com
   • sophos.com
   • www.sophos.com
   • icubed.com
   • www.icubed.com
   • perantivirus.com
   • www.perantivirus.com
   • virusalert.nl
   • www.virusalert.nl
   • pagina.nl
   • www.pagina.nl
   • antivirus.pagina.nl
   • castlecops.com
   • www.castlecops.com
   • virustotal.com
   • www.virustotal.com




????hosts ???????:


 DoS ????????????????? DoS ??:
   • http://kaskus.com
   • http://17tahun.com

 ?? ???
?????????????????????:
   • REGISTRY
   • SYSTEM CONFIGURATION
   • COMMAND PROMPT
   • .EXE
   • SHUT DOWN
   • SCRIPT HOST
   • LOG OFF WINDOWS
   • KILLBOX
   • TASKKILL
   • TASK KILL
   • HIJACK
   • BLEEPING


 ?????? ???????:
???????????????????????????????

Açıklamayı yerleştiren Andrei Gherman tarihinde 28 Ekim 2005 Cuma
Açıklamayı güncelleyen: Andrei Gherman tarihinde 20 Haziran 2008 Cuma

Geri . . . .
https:// Bu pencere güvenlik amacıyla şifrelenmiştir.