Avira 病毒搜尋

Worm/Brontok.Q.153

  • 名稱
    Worm/Brontok.Q.153
  • 发现日期
    2015年12月8日
  • 類型
    Malware
  • 影響
     
  • 報告的感染
     
  • 作業系統
    Windows
  • VDF 版本
    7.01.05.117 (2009-08-14 17:01)

'WORM' 一詞表示能夠透過網際網路 (使用電子郵件、對等網路、IRC 網路等方式) 來散佈自己的蠕蟲。

  • VDF
    7.01.05.117 (2009-08-14 17:01)
  • 別名
    Avast: Win32:Brontok-CE
    AVG: I-Worm/Brontok.X
    ClamAV: Worm.Brontok-16
    Dr. Web: Win32.HLLM.Brontok.15
    F-PROT: W32/Brontok.C.gen!Eldorado (generic, not disinfectable)
    Trend Micro: WORM_RONTKBR.AD
    Microsoft: Worm:Win32/Brontok@mm
    G Data: Trojan.Generic.1934606
    Kaspersky Lab: Email-Worm.Win32.Brontok.q
    Bitdefender: Trojan.Generic.1934606
    ESET: Win32/Brontok.DJ worm
  • 檔案
    建立下列自身複本:
    • %WINDIR%\ShellNew\RakyatKelaparan.exe
    • %SYSDIR%\cmd-brontok.exe
    • %WINDIR%\KesenjanganSosial.exe
    • %WINDIR%\ShellNew\RakyatKelaparan.exe
    • %SYSDIR%\cmd-brontok.exe
    • %WINDIR%\KesenjanganSosial.exe
    • %WINDIR%\ShellNew\RakyatKelaparan.exe
    • %SYSDIR%\cmd-brontok.exe
    • %WINDIR%\KesenjanganSosial.exe
    • %USERPROFILE%\Templates\Brengkolang.com
    • %SYSDIR%\%USERNAME%'s Setting.scr
    • %WINDIR%\ShellNew\RakyatKelaparan.exe
    • %SYSDIR%\cmd-brontok.exe
    • %WINDIR%\KesenjanganSosial.exe
    • %WINDIR%\ShellNew\RakyatKelaparan.exe
    • %SYSDIR%\cmd-brontok.exe
    • %WINDIR%\KesenjanganSosial.exe
    • %WINDIR%\ShellNew\RakyatKelaparan.exe
    • %SYSDIR%\cmd-brontok.exe
    • %WINDIR%\KesenjanganSosial.exe
    • %USERPROFILE%\Local Settings\Application Data\csrss.exe
    • %SYSDIR%\drivers\etc\hosts-Denied By-%USERNAME%.com
  • 登錄
    新增下列登錄授權碼:
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System ("DisableRegistryTools": dword:00000001; "DisableCMD": dword:00000000)
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ("Bron-Spizaetus": ""%WINDIR%\ShellNew\RakyatKelaparan.exe"")
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot ("AlternateShell": "cmd-brontok.exe")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer ("NoFolderOptions": dword:00000001)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ("Tok-Cirrhatus-2454": ""%USERPROFILE%\Local Settings\Application Data\smss.exe""; "Tok-Cirrhatus": "")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System ("DisableRegistryTools": dword:00000001; "DisableCMD": dword:00000000)
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ("Bron-Spizaetus": ""%WINDIR%\ShellNew\RakyatKelaparan.exe"")
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot ("AlternateShell": "cmd-brontok.exe")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer ("NoFolderOptions": dword:00000001)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ("Tok-Cirrhatus-2454": ""%USERPROFILE%\Local Settings\Application Data\smss.exe""; "Tok-Cirrhatus": "")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System ("DisableRegistryTools": dword:00000001; "DisableCMD": dword:00000000)
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ("Bron-Spizaetus": ""%WINDIR%\ShellNew\RakyatKelaparan.exe"")
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot ("AlternateShell": "cmd-brontok.exe")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer ("NoFolderOptions": dword:00000001)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ("Tok-Cirrhatus-2454": ""%USERPROFILE%\Local Settings\Application Data\smss.exe""; "Tok-Cirrhatus": "")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System ("DisableRegistryTools": dword:00000001; "DisableCMD": dword:00000000)
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ("Bron-Spizaetus": ""%WINDIR%\ShellNew\RakyatKelaparan.exe"")
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot ("AlternateShell": "cmd-brontok.exe")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer ("NoFolderOptions": dword:00000001)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ("Tok-Cirrhatus-2454": ""%USERPROFILE%\Local Settings\Application Data\smss.exe""; "Tok-Cirrhatus": "")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System ("DisableRegistryTools": dword:00000001; "DisableCMD": dword:00000000)
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ("Bron-Spizaetus": ""%WINDIR%\ShellNew\RakyatKelaparan.exe"")
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot ("AlternateShell": "cmd-brontok.exe")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer ("NoFolderOptions": dword:00000001)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ("Tok-Cirrhatus-2454": ""%USERPROFILE%\Local Settings\Application Data\smss.exe""; "Tok-Cirrhatus": "")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System ("DisableRegistryTools": dword:00000001; "DisableCMD": dword:00000000)
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ("Bron-Spizaetus": ""%WINDIR%\ShellNew\RakyatKelaparan.exe"")
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot ("AlternateShell": "cmd-brontok.exe")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer ("NoFolderOptions": dword:00000001)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ("Tok-Cirrhatus-2454": ""%USERPROFILE%\Local Settings\Application Data\smss.exe""; "Tok-Cirrhatus": "")
  • HTTP 請求
    • www.*****ties.com/sblppt4/IN15OLPDQGRO.txt
    • www.*****ties.com/sblppt4/Host15.txt

將可疑的檔案/URL 送予我們分析,助力構建更安全的網站。

送出您的檔案/URL 或者 請前往 Avira 問答區

為何送出可疑的檔案?

如果您遇到不在我們資料庫中的可疑檔案或網站,我們會對其進行分析,確定其是否有害。我們的分析結果將向數百萬名用戶公開,並納入下一次病毒資料庫更新。如果您擁有 Avira,您也將取得此更新。尚未擁有 Avira?請前往 我們的首頁獲取。

何為 Avira 問答區?

Avira 問答區是我們大力發展的社區,由專業技術人員和兼職專家並肩合作,幫助解決技術問題。這一 Avira 用戶社區是您提出問題的絕佳場所。