Íå ñòàâüòå äðàéâåðà ñ ïåðâîé ñòðàíèöû òàì ÷åðâÿê Win32/Brontok.T
Âîò
Êîä:
:
• Symantec: W32.Rontokbro@mm
• Kaspersky: Email-Worm.Win32.Brontok.q
• TrendMicro: WORM_RONTKBR.B
• Grisoft: I-Worm/VB.GG
• VirusBuster: I-Worm.Brontok.CU
• Eset: Win32/Brontok.T
• Bitdefender: Win32.Brontok.AO@mm
Îïåðàöèîííûå ñèñòåìû:
• Windows 95
• Windows 98
• Windows 98 SE
• Windows NT
• Windows ME
• Windows 2000
• Windows XP
• Windows 2003
Ïîñëåäñòâèÿ:
• Èñïîëüçóåò ñîáñòâåííûé ïî÷òîâûé äâèæîê
• Ñíèæàåò óðîâåíü íàñòðîåê áåçîïàñíîñòè
• Èçìåíåíèå ðååñòðà
Ôàéëû Ñîçäàþòñÿ ñîáñòâåííûå êîïèè:
• %WINDIR%\ShellNew\RakyatKelaparan.exe
• %SYSDIR%\cmd-brontok.exe
• %SYSDIR%\%àêòóàëüíîå èìÿ ïîëüçîâàòåëÿ%'s Setting.scr
• %WINDIR%\KesenjanganSosial.exe
• %home%\Local Settings\Application Data\smss.exe
• %home%\Local Settings\Application Data\br%ñëó÷àéíàÿ êîìáèíàöèÿ èç ÷åòûðåõ áóêâ%on.exe
• %home%\Local Settings\Application Data\services.exe
• %home%\Local Settings\Application Data\inetinfo.exe
• %home%\Local Settings\Application Data\csrss.exe
• %home%\Local Settings\Application Data\lsass.exe
• %home%\Local Settings\Application Data\IDTemplate.exe
• %home%\Templates\%ñëó÷àéíàÿ êîìáèíàöèÿ èç ïÿòè áóêâ%-NendangBro.com
• %SYSDIR%\drivers\etc\hosts-Denied By-%àêòóàëüíîå èìÿ ïîëüçîâàòåëÿ%.com
Óäàëÿåòñÿ ñëåäóþùèé ôàéë:
• %SYSDIR%\drivers\etc\hosts-Denied By-%àêòóàëüíîå èìÿ ïîëüçîâàòåëÿ%.com
Ñîçäàþòñÿ ñëåäóþùèå ôàéëû:
– %home%\Local Settings\Application Data\Loc.Mail.Bron.Tok\%ñîáðàííûå ýëåêòðîííûå àäðåñà%.ini Ôàéë ÿâëÿåòñÿ áåçâðåäíûì òåêñòîâûì ôàéëîì ñî ñëåäóþùèì ñîäåðæèìûì:
• Brontok.A
By: HVM31
-- JowoBot
VM Community --
– %WINDIR%\Tasks\At1.job Çàïëàíèðîâàííàÿ çàäà÷à â âèäå äàííîãî ôàéëà çàïóñêàåòñÿ â çàðàíåå îïðåäåëåííîå âðåìÿ.
Ïîïûòêà çàãðóçêè ñëåäóþùåãî ôàéëà:
– Ñëåäóþùèé URL:
• www.geocities.com/stabro7ok/**********
Íà ìîìåíò ïðîâåðêè äàííûé ôàéë íå áûë äîñòóïåí.
Ðååñòð Äîáàâëÿåòñÿ êëþ÷ ðååñòðà äëÿ ïîâòîðíîãî çàïóñêà ïðîöåññà ïîñëå ïåðåçàãðóçêè ñèñòåìû.
– HKLM\software\microsoft\windows\currentversion\run
• "Bron-Spizaetus" = ""%WINDIR%\ShellNew\RakyatKelaparan.exe""
– HKCU\software\microsoft\windows\currentversion\run
• "Tok-Cirrhatus" = ""
• "Tok-Cirrhatus-%ñëó÷àéíàÿ êîìáèíàöèÿ èç ÷åòûðåõ áóêâ%" = ""%home%\Local Settings\Application Data\bron%ñëó÷àéíàÿ êîìáèíàöèÿ èç ÷åòûðåõ áóêâ%on.exe""
Äîáàâëÿåòñÿ ñëåäóþùèé êëþ÷ ðååñòðà:
– HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
• "AlternateShell" = "cmd-brontok.exe"
Èçìåíÿþòñÿ ñëåäóþùèå êëþ÷è ðååñòðà:
Îòêëþ÷åíèå ðåäàêòîðà ðååñòðà è ìåíåäæåðà çàäà÷:
– HKCU\software\microsoft\windows\currentversion\Policies\System
Ïðåæíåå çíà÷åíèå:
• "DisableCMD" = %Íàñòðîéêè ïîëüçîâàòåëÿ%
• "DisableRegistryTools" = %Íàñòðîéêè ïîëüçîâàòåëÿ%
Íîâîå çíà÷åíèå:
• "DisableCMD" = dword:00000000
• "DisableRegistryTools" = dword:00000000
Ðàçëè÷íûå íàñòðîéêè Explorer:
– HKCU\software\microsoft\windows\currentversion\Policies\Explorer
Ïðåæíåå çíà÷åíèå:
• "NoFolderOptions" = %Íàñòðîéêè ïîëüçîâàòåëÿ%
Íîâîå çíà÷åíèå:
• "NoFolderOptions" = dword:00000001
Ðàçëè÷íûå íàñòðîéêè Explorer:
– HKCU\software\microsoft\windows\currentversion\explorer\advanced
Ïðåæíåå çíà÷åíèå:
• "ShowSuperHidden" =%Íàñòðîéêè ïîëüçîâàòåëÿ%
• "HideFileExt" = %Íàñòðîéêè ïîëüçîâàòåëÿ%
• "Hidden" = %Íàñòðîéêè ïîëüçîâàòåëÿ%
Íîâîå çíà÷åíèå:
• "ShowSuperHidden" = dword:00000000
• "HideFileExt" = dword:00000001
• "Hidden" = dword:00000000
Email Ïðîãðàììà ðàñïîëàãàåò ñîáñòâåííûì SMTP ÿäðîì äëÿ ðàññûëêè ýëåêòðîííûõ ïèñåì. Óñòàíàâëèâàåòñÿ ïðÿìîå ñîåäèíåíèå ñ óäàëåííûì ñåðâåðîì. Ïîäðîáíîñòè ïðèâîäÿòñÿ çäåñü:
Îò:
Àäðåñ îòïðàâèòåëÿ áûë ôàëüñèôèöèðîâàí.
Êîìó:
– Â îïðåäåëåííûõ ôàéëàõ ñèñòåìû áûëè îáíàðóæåíû ýëåêòðîííûå àäðåñà.
– Ïîëó÷åííûå èç WAB (àäðåñíàÿ êíèãà Windows) àäðåñà ýëåêòðîííîé ïî÷òû
Òåìà:
Íå óêàçàíà òåìà ïèñüìà.
Òåëî:
Òåëî ïèñüìà èìååò ñëåäóþùèé âèä:
• BRONTOK.A[49] [ By: HVM64 -- JowoBot &VM Community ]
-- Hentikanlah kebobrokan di negeri ini --
4. Penjarakan Koruptor/ Penyelundup/ Tukang Suap/ ) Bandar NARKOBA
+ Send to %NUSAKAMBANGAN%,
5. Stop Free Sex/ Aborsi/ ) Prostitusi
+ Go To HELL ,
6. Stop pencemaran lingkungan/ pembakaran hutan ) perburuan liar.
7. Stop Pornografi ) Pornoaksi
8. SAY NO TO DRUGS $$$
-- KIAMAT SUDAH DEKAT --
Terinspirasi oleh:
Elang Brontok +Spi}aetus Cirrhatus, yang hampir punah
[ By: HVM64 ]
-- JowoBot &VM Community --
$$$ Akan Kubuat Mereka +VM lokal yg cengeng ) bodoh, Terkapar $$$
Ïðèêðåïëåííûé ôàéë:
Èìÿ ïðèêðåïëåííîãî ôàéëà îáðàçóåòñÿ ñëåäóþùèì îáðàçîì:
– Íà÷èíàåòñÿ îäíèì èç ñëåäóþùèõ:
• PATAH
• HATI
• CINTA
• UNTUKMU
• DATA-TEMEN
• RIYANI
• JANGKARU
• KANGEN
• JROX
Èìååò îäíî èç ñëåäóþùèõ ôàëüøèâûõ ðàñøèðåíèé ôàéëîâ:
• .doc
• .xls
Îäíî èç ñëåäóþùèõ ðàñøèðåíèé ôàéëà:
• .exe
Ïðèêðåïëåííûé ôàéë ÿâëÿåòñÿ êîïèåé âðåäîíîñíîé ïðîãðàììû:
Îòïðàâêà Ïîèñê àäðåñîâ:
Ïðîâåðêà ñëåäóþùèõ ôàéëîâ íà íàëè÷èå â íèõ ýëåêòðîííûõ àäðåñîâ:
• .txt; .eml; .wab; .asp; .php; .cfm; .csv; .doc; .xls; .pdf; .ppt; .htt
Èçáåãàåò îáðàùåíèå ïî àäðåñó:
Íå îòïðàâëÿþòñÿ ïèñüìà íà àäðåñà ñ îäíîé èç ñëåäóþùèõ ïîñëåäîâàòåëüíîñòåé ñèìâîëîâ:
• DOMAIN; HIDDEN; DEMO; DEVELOP; FOOZ; KOMPUTER; SENIOR; DARK; BLACK;
BLEEP; FEEDBACK; IBM.; INTEL.; MACRO; ADOBE; FUCK; RECIPIENT; SERVER;
PROXY; ZEND; ZDNET; CNET; DOWNLOAD; HP.; XEROX; CANON; SERVICE;
ARCHIEVE; NETSCAPE; MOZILLA; OPERA; NOVELL; NEWS; UPDATE; RESPONSE;
OVERTURE; GROUP; GATEWAY; RELAY; ALERT; SEKUR; CISCO; LOTUS; MICRO;
TREND; SIEMENS; FUJITSU; NOKIA; W6.; NVIDIA; APACHE; MYSQL; POSTGRE;
SUN.; GOOGLE; SPERSKY; ZOMBIE; ADMIN; AVIRA; AVAST; TRUST; ESAVE;
ESAFE; PROTECT; ALADDIN; ALERT; BUILDER; DATABASE; AHNLAB; PROLAND;
ESCAN; HAURI; NOD65; SYBARI; ANTIGEN; ROBOT; ALWIL; BROWSE; COMPUSE;
COMPUTE; SECUN; SPYW; REGIST; FREE; BUG; MATH; LAB; IEEE; KDE; TRACK;
INFORMA; FUJI; ZMAC; SLACK; REDHA; SUSE; BUNTU; XANDROS; ZABC; Z456;
LOOKSMART; SYNDICAT; ELEKTRO; ELECTRO; NASA; LUCENT; TELECOM; STUDIO;
SIERRA; USERNAME; IPTEK; CLICK; SALES; PROMO; PLASA; TELKOM; INDO;
.CO.ID; .GO.ID; .MIL.ID; .SCH.ID; .NET.ID; .OR.ID; .AC.ID; .WEB.ID;
.WAR.NET.ID; ASTAGA; GAUL; BOLEH; EMAILKU; SATU
Ïðèñîåäèíåíèå ïîñëåäîâàòåëüíîñòè ñèìâîëîâ:
Äëÿ ïîëó÷åíèÿ IP àäðåñà ïî÷òîâîãî ñåðâåðà ïåðåä äîìåííûì èìåíåì óêàçûâàþòñÿ ñëåäóþùèå ñòðîêè:
• smtp.
• mail.
• ns1.
Ñîîáùåíèå îò Gadpetrovich
Ïîäñêàæèòå ïîæàëóéñòà, åñòü ëè âîîáùå äðàéâåð íà òåëåôîí 9@9V - à òî ÿ â ôèëèïñ çâîíèë ãîâîðÿò òèïà îí âîîáùå íå ïîäêëþ÷àåòñÿ ê ÞÑÁè. À â íåòå âèäåë ÷òî ëè÷íîñòè íåêîòîðûå åãî öåïëÿþò - íî ñâÿçè ñ íèìè íåò
Îòâåòèòü ñ öèòèðîâàíèåì
Äðàéâåðà íà Philips
