Full description

病毒:	TR/Fake.Rean.2005
发现日期:	13/12/2012
类型:	特洛伊木马
广泛传播:	是
病毒传播个案呈报：	低程度
感染/传播能力：	低程度
破坏 / 损害程度：	低程度至中程度
静态文件:	是
文件大小:	331.776 字节
MD5 校检和:	6C8F4A2E79196801A44E3A3FE0A82EB3
VDF 版本:	7.11.53.216 - 13 Aralık 2012 Perşembe
IVDF 版本:	7.11.53.216 - 13 Aralık 2012 Perşembe

况概描述 传播方法:
   • 无内置传播例程

别名:
   • TrendMicro: TROJ_FAKEAV.SMIN
   • Sophos: Mal/Behav-321
   • Microsoft: Rogue:Win32/FakeRean

平台/操作系统:
   • Windows 2000
   • Windows XP
   • Windows 2003
   • Windows Vista
   • Windows 7

副作用:
   • 阻止对安全网站的访问
   • 植入文件
   • 降低系统安全设置
   • 注册表修改

执行完毕之后会显示以下信息:

文件它将本身复制到以下位置:
• %HOME%\Local Settings\Application Data\%随机字符串%.exe

它会删除其本身最初执行的副本。

创建以下文件:

– %TEMPDIR%\en122h3o5146q55we582o122u34a10gj5076v5w33es4i2
– %ALLUSERSPROFILE%\Application Data\en122h3o5146q55we582o122u34a10gj5076v5w33es4i2
– %HOME%\Local Settings\Application Data\en122h3o5146q55we582o122u34a10gj5076v5w33es4i2
– %TEMPDIR%\en122h3o5146q55we582o122u34a10gj5076v5w33es4i2
– %HOME%\Templates\en122h3o5146q55we582o122u34a10gj5076v5w33es4i2

注册表会添加以下注册表项目注册值:

– [HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile]
   • "DoNotAllowExceptions"=dword:00000000
   • "EnableFirewall"=dword:00000000
   • "DisableNotifications"=dword:00000001

– [HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
   FirewallPolicy\DomainProfile]
   • "EnableFirewall"=dword:00000000
   • "DoNotAllowExceptions"=dword:00000000
   • "DisableNotifications"=dword:00000001

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "ctfmon.exe"="%SYSDIR%\ctfmon.exe"

– [HKCR\.exe\shell\open\command]
   • "(Default)"="\"%HOME%\Local Settings\Application Data\\%随机字符串%.exe\" -a \"%1\" %*"
   • "IsolatedCommand"="\"%1\" %*"

– [HKCR\exefile\shell\open\command]
   • "(Default)"="\"%HOME%\Local Settings\Application Data\\%随机字符串%.exe\" -a \"%1\" %*"
   • "IsolatedCommand"="\"%1\" %*"

– [HKCR\exefile\shell\runas\command]
   • "(Default)"="\"%1\" %*"
   • "IsolatedCommand"="\"%1\" %*"

– [HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\
   command]
   • "(Default)"="\"%HOME%\Local Settings\Application Data\\%随机字符串%.exe\" -a \"%PROGRAM FILES%\Intern"

会更改以下注册表项:

– [HKLM\SOFTWARE\Microsoft\Security Center]
   新值:
   • "AntiVirusDisableNotify"=dword:00000001
   • "FirewallDisableNotify"=dword:00000001
   • "FirewallOverride"=dword:00000001
   • "UpdatesDisableNotify"=dword:00000001
   • "AntiVirusOverride"=dword:00000001

注入进程 – 它会将其本身作为远程线程注入到进程中。

进程名:
• iexplore.exe

其他访问 Internet 资源：
   • **********oripuqoxyl.com/1017000412;
      **********igomyqeg.com/1017000412;
      **********ipabamefuw.com/1017000412;
      **********yziriryvi.com/1017000412;
      **********ipemura.com/1017000412;
      **********awekugygil.com/1017000412;
      **********ifyzadiby.com/1017000412;
      **********olalat.com/1017000412;
      **********ylocimemyja.com/1017000412;
      **********epelihyzex.com/1017000412;
      **********ijinymut.com/1017000412;
      **********uwemixonav.com/1017000412;
      **********exynogemi.com/1017000412;
      **********elaticik.com/1017000412;
      **********inolecowary.com/1017000412;
      **********ofociv.com/1017000412;
      **********ucerybaqecy.com/1017000412;
      **********upowibi.com/1017000412;
      **********ujykolenuja.com/1017000412;
      **********exyhun.com/1017000412;
      **********oralipijago.com/1017000412;
      **********idehecyty.com/1017000412;
      **********evepapucof.com/1017000412;
      **********ykacagatet.com/1017000412;
      **********ulipum.com/1017000412;
      **********isesyf.com/1017000412;
      **********ityvik.com/1017000412;
      **********ejutyhyfu.com/1017000412;
      **********usaseda.com/1017000412;
      **********ehiqino.com/1017000412;
      **********ynufyk.com/1017000412;
      **********udizoni.com/1017000412;
      **********evanyxora.com/1017000412;
      **********idicawisos.com/1017000412;
      **********ibipaj.com/1017000412;
      **********ixydyf.com/1017000412;
      **********unemymyko.com/1017000412;
      **********upinycom.com/1017000412;
      **********ygizeq.com/1017000412;
      **********emolezala.com/1017000412;
      **********eriwihat.com/1017000412;
      **********ecolun.com/1017000412;
      **********onabubi.com/1017000412

Description inserted by Andrei Ilie on 16 Ağustos 2011 Salı
Description updated by Andrei Ilie on 16 Ağustos 2011 Salı

Geri . . . .

Hesabım