Full description

Nume:	DR/Autoit.I.2
Descoperit pe data de:	16/10/2007
Tip:	Troian
ITW:	Da
Numar infectii raportate:	Scazut spre mediu
Potential de raspandire:	Scazut spre mediu
Potential de distrugere:	Mediu
Fisier static:	Da
Marime:	215.456 Bytes
MD5:	3b5cf70876ef2e58a30dfa85c16b49bd
Versiune IVDF:	7.00.00.94 - 2007年10月16日星期二

General Metoda de raspandire:
• Functia autorun

Alias:
   • Mcafee: W32/Autorun.worm.h virus
   • Sophos: W32/SillyFDC-AP
   • Panda: W32/Autorun.SF
   • Eset: Win32/Autoit.AC
   • Bitdefender: Worm.Generic.77741

Sistem de operare:
   • Windows 2000
   • Windows XP
   • Windows 2003

Efecte secundare:
   • Descarca fisiere malware
   • Creeaza fisiere malware
   • Reduce setarile de securitate
   • Modificari in registri

Fisiere Se copiaza in urmatoarele locatii:
   • %SYSDIR%\msmsgs.exe
   • %unitate disc%\system.exe
   • %unitate disc%\%random directories%.exe

Suprascrie un fisier.
– %PROGRAM FILES%\ESET\nod32.exe

Cu urmatorul continut:
   • %fisier executat%

Sterge urmatoarele fisiere:
   • %PROGRAM FILES%\ESET\nod32.exe
   • %PROGRAM FILES%\ESET\nod32kui.exe
   • %PROGRAM FILES%\ESET\nod32krn.exe

Sunt create fisierele:

– %WINDIR%\autorun.inf Acesta este un fisier text care nu prezinta pericol si are urmatorul continut:
   • %cod care ruleaza fisierul malitios%

– %unitate disc%\autorun.inf Acesta este un fisier text care nu prezinta pericol si are urmatorul continut:
   • %cod care ruleaza fisierul malitios%

Incearca sa descarce cateva fisiere:

– Adresa este urmatoarea:
   • http://ppt.th.gs/web-p/pt/file/**********
La momentul realizarii descrierii, acest fisier nu era disponibil pentru o analiza ulterioara.

– Adresa este urmatoarea:
   • http://ppt.th.gs/web-p/pt/file/**********
La momentul realizarii descrierii, acest fisier nu era disponibil pentru o analiza ulterioara.

– Adresa este urmatoarea:
   • http://ppt.th.gs/web-p/pt/file/**********
La momentul realizarii descrierii, acest fisier nu era disponibil pentru o analiza ulterioara.

Registrii sistemului Una din urmatoarele valori este adaugata in registri pentru pornirea automata a procesului dupa reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "Msmsgs"="%SYSDIR%\Msmsgs.exe"
   • "SYS1"="%SYSDIR%\system.exe"
   • "SYS2"="%SYSDIR%\bad1.exe"
   • "SYS3"="%SYSDIR%\bad2.exe"
   • "SYS4"="%SYSDIR%\bad3.exe"

Valorile urmatoarelor chei sunt sterse din registrii sistemului:

– [HKCU\Software\Microsoft\Internet Explorer\Main]
   • "Window Title"

– [HKLM\SYSTEM\ControlSet001\Services\NOD32krn]
   • "ImagePath"

– [HKLM\SYSTEM\ControlSet001\Services\nod32drv]
   • "ImagePath"

Se sterge urmatoarea cheie din registri, inclusiv toate valorile si cheile subordnate:
   • [HKCR\lnkfile\isShortcut]

Se adauga in registrii sistemului:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system]
   • "DisableRegistryTools"=dword:0x00000001
   • "DisableTaskMgr"=dword:0x00000001

Urmatoarele chei din registri sunt modificate:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
   Noua valoare:
   • "GlobalUserOffline"=dword:0x00000000

– [HKCU\Software\Microsoft\Windows NT\CurrentVersion\TaskManager]
   Noua valoare:
   • "Preferences"=hex:9C,02,00,00,E8,03,00,00,02,00,00,00,01,00,00,00,01,00,00,00,5A,02,00,00,02,00,00,00,FA,04,00,00,18,03,00,00,01,00,00,00,00,00,00,00,02,00,00,00,03,00,00,00,04,00,00,00,FF,FF,FF,FF,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,00,00,00,00,00,00,01,00,00,00,02,00,00,00,03,00,00,00,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,01,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,02,00,00,00,04,00,00,00,06,00,00,00,0B,00,00,00,0E,00,00,00,FF,FF,FF,FF,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,6B,00,00,00,32,00,00,00,6B,00,00,00,23,00,00,00,46,00,00,00,46,00,00,00,3C,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,6B,00,00,00,00,00,00,00,01,00,00,00,02,00,00,00,03,00,00,00,04,00,00,00,05,00,00,00,06,00,00,00,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,6F,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   Noua valoare:
   • "Hidden"=dword:0x00000002
   • "HideFileExt"=dword:0x00000001
   • "ShowSuperHidden"=dword:0x00000000
   • "SuperHidden"=dword:0x00000000

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   Noua valoare:
   • "NoDriveTypeAutoRun"=dword:0x0000005b
   • "NoFind"=dword:0x00000001
   • "NoFolderOptions"=dword:0x00000001

Terminarea proceselor Lista cu procesele oprite:
   • winsystem.exe
   • handydriver.exe
   • kerneldrive.exe
   • Wscript.exe
   • cmd.exe
   • nod32krn.exe
   • nod32kui.exe

Detaliile fisierului Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit un program de compresie runtime.

說明撰寫者 Petre Galan 開啟 2009年12月14日星期一
說明更新者 Petre Galan 開啟 2009年12月14日星期一

返回 . . . .

我的帳戶