|
웜이 실행되면 다음과 같이 윈도우 시스템 폴더(win 2000, NT : c:\Wint\system32, win XP : c:\windows\system32)
에 WIWSHOST.EXE(9,216 byte)파일을 생성 한다.
이파일은 터보백신 제품군에서 Trojan-W32/Bagle.9216.H 로
진단 삭제 한다.
또한, 다음처럼 레지스트를 수정하여 다음 부팅시 실행되도록 조작한다.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
항목에
(win9x의 경우)
winshost.exe = c:\windows\system\winshost.exe
(win2000, NT의 경우)
winshost.exe = c:\winnt\system32\winshost.exe
(WinXP의 경우)
winshost.exe = c:\windows\system32\winshost.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
항목에
(win9x의 경우)
winshost.exe = c:\windows\system\winshost.exe
(win2000, NT의 경우)
winshost.exe = c:\winnt\system32\winshost.exe
(WinXP의 경우)
winshost.exe = c:\windows\system32\winshost.exe
HKEY_CURRENT_USER\Software\FirstRun
항목에
FirstRunRR = "dword:00000001"
를 기록한다.
윈도우 xp 에서는 서비스팩 2의 방화벽을 중지 시키도록 레지스트리를 조작한다.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess
항목에
Start = "4" (방화벽 디폴트 값은 "2" 이다)
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv
항목에
Start = "dword:00000004" (업데이트 디폴트 값은 "00000002" 이다)
Windows NT 에서 다음 처럼 레지스트리를 조작한다.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Alerter
항목에
Start = "dword:00000004" (업데이트 디폴트 값은 "00000002" 이다)
다음과 같은 항목이 있다면 삭제 한다.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"APVXDWIN"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"avg7_cc"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"avg7_emc"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"ccApp"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"KAV50"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"McAfee Guardian"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"NAV CfgWiz"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"SSC_UserPrompt"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"Symantec NetDriver Monitor"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"Zone Labs Client"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
"McAfee.InstantUpdate.Monitor"
또한 다음과 같은 파일이 실행되면 강제 종료 시키게 된다.
ATUPDATER.EXE
ATUPDATER.EXE
AUPDATE.EXE
AUTODOWN.EXE
AUTOTRACE.EXE
AUTOUPDATE.EXE
AVPUPD.EXE
AVWUPD32.EXE
AVXQUAR.EXE
AVXQUAR.EXE
CFIAUDIT.EXE
DRWEBUPW.EXE
ESCANH95.EXE
ESCANHNT.EXE
FIREWALL.EXE
ICSSUPPNT.EXE
ICSUPP95.EXE
LUALL.EXE
MCUPDATE.EXE
NUPGRADE.EXE
NUPGRADE.EXE
OUTPOST.EXE
UPDATE.EXE
UPGRADER.EXE
그리고 일부 안티 바이러스 프로그램과 보안 프로그램의 관련 서비스 항목을
레지스트리에서 삭제하거나 변경 한다.
그 리스트는 다음과 같다.
Ahnlab task Scheduler
alerter
AlertManger
AVExch32Service
avg7alrt
avg7updsvc
AvgCore
AvgFsh
AvgServ
avpcc
AVUPDService
AvxIni
awhost32
backweb client - 4476822
BackWeb Client - 7681197
backweb client-4476822
BlackICE
CAISafe
ccEvtMgr
ccPwdSvc
ccSetMgr
ccSetMgr.exe
DefWatch
dvpapi
dvpinit
F-Secure Gatekeeper Handler Starter
fsbwsys
fsdfwd
FSMA
KAVMonitorService
kavsvc
KLBLMain
McAfee Firewall
McAfeeFramework
McShield
McTaskManager
mcupdmgr.exe
MCVSRte
MonSvcNT
navapsvc
Network Associates Log Service
NISSERV
NISUM
NOD32ControlCenter
NOD32Service
Norman NJeeves
Norman ZANDA
Norton Antivirus Server
NPFMntor
NProtectService
NSCTOP
nvcoas
NVCScheduler
nwclntc
nwclntd
nwclnte
nwclntf
nwclntg
nwclnth
NWService
Outbreak Manager
Outpost Firewall
OutpostFirewall
PASSRV
PAVFNSVR
Pavkre
PavProt
PavPrSrv
PAVSRV
PCCPFW
PersFW
PREVSRV
PSIMSVC
ravmon8
SAVFMSE
SAVScan
SBService
schscnt
SharedAccess
SmcService
SNDSrvc
SPBBCSvc
SweepNet
SWEEPSRV.SYS
Symantec AntiVirus Client
Symantec Core LC
Tmntsrv
V3MonNT
V3MonSvc
VexiraAntivirus
VisNetic AntiVirus Plug-in
vsmon
wuauserv
XCOMM
마지막으로 Hosts 파일을 수정하여 127.0.0.1 localhost 를 포함시키고
다음 싸이트에서 osa4.gif 파일을 다운로드 하여 윈도우즈 폴더에 _re_file.exe로 저장한다.
www.21ebuild.com/
www.51.net/
www.acsohio.com/
www.agria.hu/
www.andi.com.vn/
www.angham.de/
www.ascolfibras.com/
www.automobilonline.de/
www.bangyan.cn/
www.beall-cpa.com/
www.bolz.at/
www.bs-security.de/
www.centrovestecasa.it/
www.checkonemedia.nl/
www.contentproject.com/
www.cz-wanjia.com/
www.czwanqing.com/
www.czzm.com/
www.datanet.huwww.datanet.hu/
www.designgong.org/
www.dgy.com.cn/
www.die-fliesen.de/
www.discoteka-funfactory.com/
www.dom-invest.com.pl/
www.eagle.com.cn/
www.eagleclub.com.cn/
www.eagleclub.com.cn/
www.ehc.hu/
www.elvis-presley.ch/
www.engelhardtgmbh.de/
www.externet.hu/
www.fahrschule-herb.de/
www.fahrschule-lesser.de/
www.fermegaroy.com/
www.festivalteatrooccidente.com/
www.festivalteatrooccidente.com/
www.formholz.at/
www.fotomax.fi/
www.gemtrox.com.tw/
www.gepeters.org/
www.gimex-messzeuge.de/
www.gomyhome.com.tw/
www.gymzn.cz/
www.gymzn.cz/
www.gymzn.cz/
www.hondenservice.be/
www.idaf.de/
www.idcs.be/
www.ider.cl/
www.inside-tgweb.de/
www.izoli.sk/
www.jcm-american.com/
www.jeoushinn.com/
www.jingjuok.com/
www.jue-bo.com/
www.kingsley.ch/
www.marketvw.com/
www.megaserve.net/
www.mild.at/
www.mild.at/
www.mild.at/
www.niko.de/
www.nikogmbh.com/
www.olva.com.pe/
www.on24.ee/
www.onlink.net/
www.ppm-alliance.de/
www.presley.ch/
www.renegaderc.com/
www.replayu.com/
www.sachsenbuecher.de/
www.sanjinyuan.com/
www.scvanravenswaaij.nl/
www.slovanet.sk/
www.snsphoto.com/
www.societaet.de/
www.soeco.org/
www.softmajor.ru/
www.solt3.org/
www.spacium.biz/
www.speedcom.home.pl/
www.spirit-in-steel.at/
www.spoden.de/
www.sportnf.com/
www.spy.az/
www.sqnsolutions.com/
www.st-paulus-bonn.dehtdocs/
www.stbs.com.hk/
www.steripharm.com/
www.students.stir.ac.uk/
www.subsplanet.com/
www.sungodbio.com/
www.superbetcs.com/
www.sweb.cz/
www.sydolo.com/
www.szdiheng.com/
www.tcicampus.net/
www.techni.com.cn/
www.tg-sandhausen-basketball.de/
www.th-mutan.com/
www.thaifast.com/
www.thaiventure.com/
www.thefunkiest.com/
www.thefunkiest.com/
www.thenextstep.tv/
www.thenextstep.tv/
www.thetexasoutfitter.com/
www.tmhcsd1987.friko.pl/
www.toussain.be/
www.trago.com.pt/
www.travelourway.com/
www.trgd.dobrcz.pl/
www.triapex.cz/
www.triptonic.ch/
www.tv-marina.com/
www.udc-cassinadepecchi.it/
www.universe.sk/
www.uspowerchair.com/
www.uw.hu/
www.vercruyssenelektro.be/
www.vet24h.com/
www.vinimeloni.com/
www.vnn.vn/
www.vnrvjiet.ac.in/
www.vote2fateh.com/
www.vw.press-bank.pl/
www.wamba.asn.au/
www.wdlp.co.za/
www.welchcorp.com/
www.wesartproductions.com/
www.wilsonscountry.com/
www.windstar.pl/
www.wise-industries.com/
www.witold.pl/
www.witold.pl/
www.wombband.com/
www.x-treme.cz/
www.xiantong.net/
www.xmpie.com/
www.xmpie.com/
www.xmtd.com/
www.xojc.com/
www.yannick-spruyt.be/
www.yayadownload.com/
www.yesterdays.co.za/
www.yesterdays.co.za/
www.yshkj.com/
www.yshkj.com/
www.zakazcd.dp.ua/
www.zenesoftware.com/
www.zentek.co.za/
www.zorbas.az/
www.zsbersala.edu.sk/osa4.gif
|
|
|
Home 
