Need help? Ask the community or hire an expert.
Go to Avira Answers
病毒:TR/Buzus.gzap
发现日期:13/12/2012
类型:特洛伊木马
广泛传播:
病毒传播个案呈报:低程度
感染/传播能力:低程度
破坏 / 损害程度:低程度至中程度
文件大小:36.864 字节
MD5 校检和:2B64C4E3C66C1D852CC1A5893F18E0B3
VDF 版本:7.11.53.216 - 13 Aralık 2012 Perşembe
IVDF 版本:7.11.53.216 - 13 Aralık 2012 Perşembe

 况概描述 传播方法:
   • 无内置传播例程


别名:
   •  Kaspersky: Trojan.Win32.Buzus.gzap
   •  TrendMicro: WORM_VOBFUS.SMIE
   •  Sophos: W32/Kolab-U
   •  Microsoft: Trojan:Win32/Ircbrute


平台/操作系统:
   • Windows 2000
   • Windows XP
   • Windows 2003
   • Windows Vista
   • Windows 7


副作用:
   • 植入文件
   • 注册表修改

 文件 它将本身复制到以下位置:
   • C:\diGni\MaMiCuTiTvoJu\StaKakoDiMolim.exe



创建以下文件:

– C:\diGni\MaMiCuTiTvoJu\Desktop.ini

 注册表 会添加以下注册表项目注册值:

– [HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\
   {J49SJ5NS-3KANX-50XJA-2MDCGK-7J43NKDL3J}]
   • "StubPath"="c:\diGni\MaMiCuTiTvoJu\StaKakoDiMolim.exe"

 后门程序 访问服务器:
以下内容:
   • 67.215.77.**********:%数字%


 注入进程 – 它会将其本身作为远程线程注入到进程中。

    进程名:
   • explorer.exe


 其他 访问 Internet 资源:
   • haso.dukatlgg.com; jmkkl.translate-google-cache.com;
      wegs.zavoddebila.com; milkyway.3utilities.com; dghfg.dukatlgg.com;
      haso.dukatlgg.com; jmkkl.translate-google-cache.com;
      wegs.zavoddebila.com; dghfg.dukatlgg.com

Açıklamayı yerleştiren Andrei Ilie tarihinde 14 Temmuz 2011 Perşembe
Açıklamayı güncelleyen: Andrei Ivanes tarihinde 29 Temmuz 2011 Cuma

Geri . . . .
https:// Bu pencere güvenlik amacıyla şifrelenmiştir.