病毒:TR/Spy.Agent.abd
发现日期:13/12/2012
类型:特洛伊木马
广泛传播:是
病毒传播个案呈报：低程度至中程度
感染/传播能力：中等程度
破坏 / 损害程度：中等程度
静态文件:是
文件大小:81.920 字节
MD5 校检和:1695b91b4a13345b9f97527d2d7ca370
VDF 版本:7.11.53.216 - 2012年12月13日星期四
IVDF 版本:7.11.53.216 - 2012年12月13日星期四

 况概描述 传播方法:
   • 局域网络
   • 对等网络


别名:
   •  Bitdefender: Trojan.Generic.4661937
   •  Panda: W32/P2Pworm.OJ
   •  Eset: Win32/AutoRun.IRCBot.FC


平台/操作系统:
   • Windows 2000
   • Windows XP
   • Windows 2003


副作用:
   • 第三方控件
   • 植入恶意文件
   • 注册表修改

 文件 它将本身复制到以下位置:
   • %HOME%\Application Data\jusched.exe
   • %TEMPDIR%\windump.exe



它会覆盖一个文件。
– %恶意软件执行目录%\%every *.exe file%

具有以下内容:
   • %执行的文件%





它会尝试执行以下文件:

– 文件名:
   • %HOME%\Application Data\jusched.exe

 注册表 会添加以下注册表项，以便在系统重新引导后运行进程:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "SunJavaUpdateSched"="%HOME%\Application Data\jusched.exe"

 P2P 为了感染对等网络社区中的其他系统，会执行以下操作:   它会搜索包含以下某个子字符串的目录:
   • my music\imesh\; frostwire\saved\; frostwire\shared\; limewire\saved\;
      my music\bearshare\; shareaza downloads\; winmx\shared\; tesla\files\;
      limewire\shared\; morpheus\my shared folder\; emule\incoming\;
      edonkey2000\incoming\; bearshare\shared\; grokster\my grokster\;
      icq\shared folder\; kazaa lite k++\my shared folder\; kazaa lite\my
      shared folder\; kazaa\my shared folder\

   它会搜索以下标准共享:
   • E$
   • D$
   • C$
   • ADMIN$

   如果成功，会创建以下文件:
   • RuneScape 2010 - Newest Exploits.exe; Yamicsoft Windows 7 Manager v1 1
      8 x64.exe; Microsoft Windows Home Server 2010 Build 7360.exe; 3delite
      MP3 Stream Editor v3 4 4 1980 WinALL.exe; Error Repair Professional 4
      1 3 AT4RE DM999.exe; cute dogs screensaver.exe; Babylon 8 - Instant
      translation tool.exe; Recover Keys v3 0 3 7-MAZE.exe; Uniture Memory
      Booster v6 1 0 5158-MESMERiZE.exe; redsn0w-win 0 8.exe; WinRAR-3 91
      Full + Keymaker.exe; Sony Vegas Pro 9.0 Full.exe; LimeWire Pro.exe;
      Adobe Photoshop CS4 Extended + Keygen + Activation.exe; Setup OneCare
      for Windows 7.exe; YouTube Downloader all Access.exe; MS Office 2007
      Activation KeyGen.exe;
      LimeWire.Pro.v5.4.6.1.Multilingual.Retail-ZWT.exe; DiceRoller2 0.exe;
      Adobe Dreamweaver CS4 Keygen.exe; Xilisoft 3GP Video Converter v5 1 26
      1231 Key.exe; Xilisoft Apple TV Video Converter v5 1 26 1030 Inc.exe;
      Xilisoft AVI MPEG Converter v5 1 26 1030 Keyg.exe; Xilisoft AVI MPEG
      Joiner v1 0 34 1012 Keygen.exe; Xilisoft Blackberry Ringtone Maker v1
      0 12 1204.exe; Xilisoft Blu Ray Ripper v5 2 4 0108 Keygen.exe;
      Xilisoft Burn Pro v1 0 64 0112 Keygen.exe; Xilisoft CD Ripper v1 0 47
      0904 Keygen.exe; Atomix Virtual DJ v6.0.2 FINAL Professional.exe;
      WinZip PRO v12.1 + Serials.exe; Driver Genius Professional 2009 9.0.0
      Build 186.exe; Microsoft Office 2010 Enterprise Corporate Edition.exe;
      Diskeeper 2010 Pro Premier v14 0 900t Final.exe; Dr Web AntiVirus v5 0
      10 11260 R-EAT.exe; Autorun Virus Remover v2 3 1022-Lz0.exe; CleanMyPC
      Registry Cleaner v4 02-TE.exe; Diskeeper 2010 Pro Premier v14 0
      900.exe; Website X5 Designer v7.7 WYSIWYG Website Creator.exe; Windows
      7 Toolkit v1.8 activations+full suite.exe; Microsoft Office
      Professional Plus x32 x64 2010.exe; Adobe Photoshop CS4 KeyGen.exe;
      ScreenCapture; DesktopCalendar.exe; Web Dumper 3.1.1 Keygen.exe; Adobe
      Photoshop CS3 patch.exe; Loaris Trojan Remover 1.2.0 Patch.exe; Trojan
      Killer 2.0.6.4 Patch.exe; WinRAR 3.92 Final.exe; RAR Password Recovery
      Magic v6 1 1 172-BEAN.exe; Borderlands Proper-Razor1911.exe; Microsoft
      AutoCollage 2008.exe; Microsoft Office Accounting Professional
      2009.exe; Miscrosoft Office Ultimate 2007.exe; facebook for
      dummies.exe; kaspersky license key 2010.exe; office 2007
      activation.exe; paypal hack 2010.exe; Garmin mobile xt keygen.exe;
      Windows 2008 Server KeyGen.exe


 网络感染 该恶意软件会尝试以下方式连接其他计算机来作广泛传播／感染。


它使用以下登录信息来访问远程计算机:

– 以下密码列表:
   • www; start; testing; abcde; 911; 111; 777; apple; apollo13; 123abc;
      abcd; aaa; 2000; 2004; 2005; 2006; system; hacker; boss; intranet;
      hell; sam; siemens; nokia; mysql; oracle; sexy; sex; qwe; qw; pwd;
      test; user; web; winpass; winnt; win95; win98; win2k; win2000;
      pass1234; pass; linux; loginpass; login; server; home; database; data;
      bitch; winxp; internet; ibm; billy; bob; command; access; 1234567890;
      123456789; 12345678; 1234567; 123456; 12345; 1234; 123; 007; awerty;
      qwerty; default; wwwadmin; computer; owner; root; guest;
      amministratore; administrator; admins; admin; andy; nepenthes;
      currentuser


 IRC 为了提供系统信息和远程控制，它会连接到以下 IRC 服务器:

服务器: ybtva.vcjubvf.**********.hx
端口: 47221
通道: #uobg-ohl
昵称: USA|XP|USER-289AF73617|%数字%

 后门程序 访问服务器:
以下内容:
   • 204.60.13**********.18:4444 (TCP)


 其他 Mutex:
它会创建以下 Mutex:
   • aNoThErPeZeZeZergqde

 文件详细信息 编程语言:
 该恶意软件程序是用 MS Visual C++ 编写的。


运行时压缩程序:
为了提高检测难度以及减小文件，它已使用运行时压缩程序进行压缩。

Description inserted by Petre Galan on 17 Aralık 2010 Cuma
Description updated by Petre Galan on 17 Aralık 2010 Cuma

Geri . . . .

© 2013 Avira Operations GmbH & Co. KG. Her hakkı saklıdır.

Hesabım

https:// Bu pencere güvenlik amacıyla şifrelenmiştir.