Íå ñòàâüòå äðàéâåðà ñ ïåðâîé ñòðàíèöû òàì ÷åðâÿê Win32/Brontok.T
Âîò
Êîä:: • Symantec: W32.Rontokbro@mm • Kaspersky: Email-Worm.Win32.Brontok.q • TrendMicro: WORM_RONTKBR.B • Grisoft: I-Worm/VB.GG • VirusBuster: I-Worm.Brontok.CU • Eset: Win32/Brontok.T • Bitdefender: Win32.Brontok.AO@mm Îïåðàöèîííûå ñèñòåìû: • Windows 95 • Windows 98 • Windows 98 SE • Windows NT • Windows ME • Windows 2000 • Windows XP • Windows 2003 Ïîñëåäñòâèÿ: • Èñïîëüçóåò ñîáñòâåííûé ïî÷òîâûé äâèæîê • Ñíèæàåò óðîâåíü íàñòðîåê áåçîïàñíîñòè • Èçìåíåíèå ðååñòðà Ôàéëû Ñîçäàþòñÿ ñîáñòâåííûå êîïèè: • %WINDIR%\ShellNew\RakyatKelaparan.exe • %SYSDIR%\cmd-brontok.exe • %SYSDIR%\%àêòóàëüíîå èìÿ ïîëüçîâàòåëÿ%'s Setting.scr • %WINDIR%\KesenjanganSosial.exe • %home%\Local Settings\Application Data\smss.exe • %home%\Local Settings\Application Data\br%ñëó÷àéíàÿ êîìáèíàöèÿ èç ÷åòûðåõ áóêâ%on.exe • %home%\Local Settings\Application Data\services.exe • %home%\Local Settings\Application Data\inetinfo.exe • %home%\Local Settings\Application Data\csrss.exe • %home%\Local Settings\Application Data\lsass.exe • %home%\Local Settings\Application Data\IDTemplate.exe • %home%\Templates\%ñëó÷àéíàÿ êîìáèíàöèÿ èç ïÿòè áóêâ%-NendangBro.com • %SYSDIR%\drivers\etc\hosts-Denied By-%àêòóàëüíîå èìÿ ïîëüçîâàòåëÿ%.com Óäàëÿåòñÿ ñëåäóþùèé ôàéë: • %SYSDIR%\drivers\etc\hosts-Denied By-%àêòóàëüíîå èìÿ ïîëüçîâàòåëÿ%.com Ñîçäàþòñÿ ñëåäóþùèå ôàéëû: – %home%\Local Settings\Application Data\Loc.Mail.Bron.Tok\%ñîáðàííûå ýëåêòðîííûå àäðåñà%.ini Ôàéë ÿâëÿåòñÿ áåçâðåäíûì òåêñòîâûì ôàéëîì ñî ñëåäóþùèì ñîäåðæèìûì: • Brontok.A By: HVM31 -- JowoBot VM Community -- – %WINDIR%\Tasks\At1.job Çàïëàíèðîâàííàÿ çàäà÷à â âèäå äàííîãî ôàéëà çàïóñêàåòñÿ â çàðàíåå îïðåäåëåííîå âðåìÿ. Ïîïûòêà çàãðóçêè ñëåäóþùåãî ôàéëà: – Ñëåäóþùèé URL: • www.geocities.com/stabro7ok/********** Íà ìîìåíò ïðîâåðêè äàííûé ôàéë íå áûë äîñòóïåí. Ðååñòð Äîáàâëÿåòñÿ êëþ÷ ðååñòðà äëÿ ïîâòîðíîãî çàïóñêà ïðîöåññà ïîñëå ïåðåçàãðóçêè ñèñòåìû. – HKLM\software\microsoft\windows\currentversion\run • "Bron-Spizaetus" = ""%WINDIR%\ShellNew\RakyatKelaparan.exe"" – HKCU\software\microsoft\windows\currentversion\run • "Tok-Cirrhatus" = "" • "Tok-Cirrhatus-%ñëó÷àéíàÿ êîìáèíàöèÿ èç ÷åòûðåõ áóêâ%" = ""%home%\Local Settings\Application Data\bron%ñëó÷àéíàÿ êîìáèíàöèÿ èç ÷åòûðåõ áóêâ%on.exe"" Äîáàâëÿåòñÿ ñëåäóþùèé êëþ÷ ðååñòðà: – HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot • "AlternateShell" = "cmd-brontok.exe" Èçìåíÿþòñÿ ñëåäóþùèå êëþ÷è ðååñòðà: Îòêëþ÷åíèå ðåäàêòîðà ðååñòðà è ìåíåäæåðà çàäà÷: – HKCU\software\microsoft\windows\currentversion\Policies\System Ïðåæíåå çíà÷åíèå: • "DisableCMD" = %Íàñòðîéêè ïîëüçîâàòåëÿ% • "DisableRegistryTools" = %Íàñòðîéêè ïîëüçîâàòåëÿ% Íîâîå çíà÷åíèå: • "DisableCMD" = dword:00000000 • "DisableRegistryTools" = dword:00000000 Ðàçëè÷íûå íàñòðîéêè Explorer: – HKCU\software\microsoft\windows\currentversion\Policies\Explorer Ïðåæíåå çíà÷åíèå: • "NoFolderOptions" = %Íàñòðîéêè ïîëüçîâàòåëÿ% Íîâîå çíà÷åíèå: • "NoFolderOptions" = dword:00000001 Ðàçëè÷íûå íàñòðîéêè Explorer: – HKCU\software\microsoft\windows\currentversion\explorer\advanced Ïðåæíåå çíà÷åíèå: • "ShowSuperHidden" =%Íàñòðîéêè ïîëüçîâàòåëÿ% • "HideFileExt" = %Íàñòðîéêè ïîëüçîâàòåëÿ% • "Hidden" = %Íàñòðîéêè ïîëüçîâàòåëÿ% Íîâîå çíà÷åíèå: • "ShowSuperHidden" = dword:00000000 • "HideFileExt" = dword:00000001 • "Hidden" = dword:00000000 Email Ïðîãðàììà ðàñïîëàãàåò ñîáñòâåííûì SMTP ÿäðîì äëÿ ðàññûëêè ýëåêòðîííûõ ïèñåì. Óñòàíàâëèâàåòñÿ ïðÿìîå ñîåäèíåíèå ñ óäàëåííûì ñåðâåðîì. Ïîäðîáíîñòè ïðèâîäÿòñÿ çäåñü: Îò: Àäðåñ îòïðàâèòåëÿ áûë ôàëüñèôèöèðîâàí. Êîìó: –  îïðåäåëåííûõ ôàéëàõ ñèñòåìû áûëè îáíàðóæåíû ýëåêòðîííûå àäðåñà. – Ïîëó÷åííûå èç WAB (àäðåñíàÿ êíèãà Windows) àäðåñà ýëåêòðîííîé ïî÷òû Òåìà: Íå óêàçàíà òåìà ïèñüìà. Òåëî: Òåëî ïèñüìà èìååò ñëåäóþùèé âèä: • BRONTOK.A[49] [ By: HVM64 -- JowoBot &VM Community ] -- Hentikanlah kebobrokan di negeri ini -- 4. Penjarakan Koruptor/ Penyelundup/ Tukang Suap/ ) Bandar NARKOBA + Send to %NUSAKAMBANGAN%, 5. Stop Free Sex/ Aborsi/ ) Prostitusi + Go To HELL , 6. Stop pencemaran lingkungan/ pembakaran hutan ) perburuan liar. 7. Stop Pornografi ) Pornoaksi 8. SAY NO TO DRUGS $$$ -- KIAMAT SUDAH DEKAT -- Terinspirasi oleh: Elang Brontok +Spi}aetus Cirrhatus, yang hampir punah [ By: HVM64 ] -- JowoBot &VM Community -- $$$ Akan Kubuat Mereka +VM lokal yg cengeng ) bodoh, Terkapar $$$ Ïðèêðåïëåííûé ôàéë: Èìÿ ïðèêðåïëåííîãî ôàéëà îáðàçóåòñÿ ñëåäóþùèì îáðàçîì: – Íà÷èíàåòñÿ îäíèì èç ñëåäóþùèõ: • PATAH • HATI • CINTA • UNTUKMU • DATA-TEMEN • RIYANI • JANGKARU • KANGEN • JROX Èìååò îäíî èç ñëåäóþùèõ ôàëüøèâûõ ðàñøèðåíèé ôàéëîâ: • .doc • .xls Îäíî èç ñëåäóþùèõ ðàñøèðåíèé ôàéëà: • .exe Ïðèêðåïëåííûé ôàéë ÿâëÿåòñÿ êîïèåé âðåäîíîñíîé ïðîãðàììû: Îòïðàâêà Ïîèñê àäðåñîâ: Ïðîâåðêà ñëåäóþùèõ ôàéëîâ íà íàëè÷èå â íèõ ýëåêòðîííûõ àäðåñîâ: • .txt; .eml; .wab; .asp; .php; .cfm; .csv; .doc; .xls; .pdf; .ppt; .htt Èçáåãàåò îáðàùåíèå ïî àäðåñó: Íå îòïðàâëÿþòñÿ ïèñüìà íà àäðåñà ñ îäíîé èç ñëåäóþùèõ ïîñëåäîâàòåëüíîñòåé ñèìâîëîâ: • DOMAIN; HIDDEN; DEMO; DEVELOP; FOOZ; KOMPUTER; SENIOR; DARK; BLACK; BLEEP; FEEDBACK; IBM.; INTEL.; MACRO; ADOBE; FUCK; RECIPIENT; SERVER; PROXY; ZEND; ZDNET; CNET; DOWNLOAD; HP.; XEROX; CANON; SERVICE; ARCHIEVE; NETSCAPE; MOZILLA; OPERA; NOVELL; NEWS; UPDATE; RESPONSE; OVERTURE; GROUP; GATEWAY; RELAY; ALERT; SEKUR; CISCO; LOTUS; MICRO; TREND; SIEMENS; FUJITSU; NOKIA; W6.; NVIDIA; APACHE; MYSQL; POSTGRE; SUN.; GOOGLE; SPERSKY; ZOMBIE; ADMIN; AVIRA; AVAST; TRUST; ESAVE; ESAFE; PROTECT; ALADDIN; ALERT; BUILDER; DATABASE; AHNLAB; PROLAND; ESCAN; HAURI; NOD65; SYBARI; ANTIGEN; ROBOT; ALWIL; BROWSE; COMPUSE; COMPUTE; SECUN; SPYW; REGIST; FREE; BUG; MATH; LAB; IEEE; KDE; TRACK; INFORMA; FUJI; ZMAC; SLACK; REDHA; SUSE; BUNTU; XANDROS; ZABC; Z456; LOOKSMART; SYNDICAT; ELEKTRO; ELECTRO; NASA; LUCENT; TELECOM; STUDIO; SIERRA; USERNAME; IPTEK; CLICK; SALES; PROMO; PLASA; TELKOM; INDO; .CO.ID; .GO.ID; .MIL.ID; .SCH.ID; .NET.ID; .OR.ID; .AC.ID; .WEB.ID; .WAR.NET.ID; ASTAGA; GAUL; BOLEH; EMAILKU; SATU Ïðèñîåäèíåíèå ïîñëåäîâàòåëüíîñòè ñèìâîëîâ: Äëÿ ïîëó÷åíèÿ IP àäðåñà ïî÷òîâîãî ñåðâåðà ïåðåä äîìåííûì èìåíåì óêàçûâàþòñÿ ñëåäóþùèå ñòðîêè: • smtp. • mail. • ns1.
Îòâåòèòü ñ öèòèðîâàíèåì