Full description

Virus:	TR/Buzus.EY.2
Date discovered:	17/08/2011
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Medium to high
Damage Potential:	Medium
Static file:	Yes
File size:	126.976 Bytes
MD5 checksum:	7BE4701F62ED2330290DA1063481BFDF
VDF version:	7.11.13.117 - Wednesday, August 17, 2011
IVDF version:	7.11.13.117 - Wednesday, August 17, 2011

General Methods of propagation:
   • Autorun feature
   • Messenger

Aliases:
   • Sophos: Troj/DorkBot-I
   • DrWeb: Trojan.Packed.21754

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003
   • Windows Vista
   • Windows 7

Side effects:
   • Drops files
   • Registry modification
   • Steals information

Files It copies itself to the following location:
• %APPDATA%\Microsoft\jqs.exe

Registry One of the following values is added in order to run the process after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
• "Startup"="%APPDATA%\Microsoft\jqs.exe"

The following registry key is added:

– [HKCU\Software\tfswfs]
• "FileNameActual"="%executed file%"

Messenger It is spreading via Messenger. The characteristics are described below:

– Windows Live Messenger

IRC To deliver system information and to provide remote control it connects to the following IRC Server:

Server: **********gle.sytes.net
Port: 3086
Nickname: %random caracters%

– This malware has the ability to collect and send information such as:
    • Current user
    • Information about the Windows operating system

– Furthermore it has the ability to perform actions such as:
    • connect to IRC server
    • disconnect from IRC server
    • Join IRC channel
    • Leave IRC channel
    • Visit a website

Injection – It injects itself as a remote thread into processes.

Process name:
• explorer.exe

說明撰寫者 Andrei Ilie 開啟 2011年9月26日星期一
說明更新者 Andrei Ilie 開啟 2011年9月27日星期二

返回 . . . .

需要修復電腦？

我的帳戶