*감염
경로
감염된
시스템에서
메일
주소를
수집하여
해당웜을
첨부하여
메일로
전파
된다.
*증상
-
파일
생성
윈도우
폴더에
tsrv.exe라는
파일을
생성한다.
윈도우
폴더에
tsrv.c
라는
파일을
생성한다.
윈도우
폴더에
tsrv.s 라는
파일을
생성한다.
윈도우
폴더에
tsrv.wax
라는
파일을
생성한다.
윈도우
폴더에
tsrv.dll
라는
파일을
생성한다.
-
윈도우
폴더?
-
윈도우
95/98/ME/XP
-C:\Windows,
-
윈도우
NT/2000
- C:\WinNT
윈도우
시스템
폴더에
msji449c14b7.dll 라는
파일을
생성한다.
윈도우
시스템
폴더에
hpzl449c14b7.exe 라는
파일을
생성한다.
윈도우
시스템
폴더에
cmut449c14b7.dll 라는
파일을
생성한다.
-윈도우
시스템
폴더?
-
윈도우
95/98/ME/XP -
C:\Windows\System,
-
윈도우
NT/2000
-C:\WinNT\System32
-
윈도우
XP
- C:\Windows\System32
생성된
tsrv.dll 파일은 실행 중인 모든 프로세스에 강제로 주입되고,
프로세스를 감추는 기능을 가지고 있다.
또한 tsrv.wax
파일은 WAB 파일을 통해 자신이 보낼 이메일 주소 리스트를 얻는다.
-레지스트리
등록
레지스트리에
다음
value를
등록해
윈도우
구동시
자동
실행되도록
만든다.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
tsrv=
윈도우 폴더\tsrv.exe s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Windows
AppInit_DLLs = msji449c14b7.dll
감염된
시스템은
호스트
파일을
변경하여
보안
관련
사이트의
접속을
방해,
사용자가
악성코드의
치료를
방해한다.
호스트
파일에
추가하는
주소는
아래와
같다.
127.0.0.1
download.microsoft.com
127.0.0.1 go.microsoft.com
127.0.0.1
msdn.microsoft.com
127.0.0.1 office.microsoft.com
127.0.0.1
windowsupdate.microsoft.com
127.0.0.1
http://www.microsoft.com/downloads/Search.aspx?displaylang=en
127.0.0.1
avp.ru
127.0.0.1 www.avp.ru
127.0.0.1 http://avp.ru
127.0.0.1
http://www.avp.ru
127.0.0.1 kaspersky.ru
127.0.0.1 www.kaspersky.ru
127.0.0.1 http://kaspersky.ru
127.0.0.1 kaspersky.com
127.0.0.1
www.kaspersky.com
127.0.0.1 http://kaspersky.com
127.0.0.1
kaspersky-labs.com
127.0.0.1 www.kaspersky-labs.com
127.0.0.1
http://kaspersky-labs.com
127.0.0.1 avp.ru/download/
127.0.0.1
www.avp.ru/download/
127.0.0.1 http://www.avp.ru/download/
127.0.0.1
http://www.kaspersky.ru/updates/
127.0.0.1
http://www.kaspersky-labs.com/updates/
127.0.0.1
http://kaspersky.ru/updates/
127.0.0.1 http://kaspersky-labs.com/updates/
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1
downloads2.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1
downloads5.kaspersky-labs.com
127.0.0.1 http://downloads1.kaspersky-labs.com
127.0.0.1 http://downloads2.kaspersky-labs.com
127.0.0.1
http://downloads3.kaspersky-labs.com
127.0.0.1
http://downloads4.kaspersky-labs.com
127.0.0.1
http://downloads5.kaspersky-labs.com
127.0.0.1
downloads1.kaspersky-labs.com/products/
127.0.0.1
downloads2.kaspersky-labs.com/products/
127.0.0.1
downloads3.kaspersky-labs.com/products/
127.0.0.1
downloads4.kaspersky-labs.com/products/
127.0.0.1
downloads5.kaspersky-labs.com/products/
127.0.0.1
http://downloads1.kaspersky-labs.com/products/
127.0.0.1
http://downloads2.kaspersky-labs.com/products/
127.0.0.1
http://downloads3.kaspersky-labs.com/products/
127.0.0.1
http://downloads4.kaspersky-labs.com/products/
127.0.0.1
http://downloads5.kaspersky-labs.com/products/
127.0.0.1
downloads1.kaspersky-labs.com/updates/
127.0.0.1
downloads2.kaspersky-labs.com/updates/
127.0.0.1
downloads3.kaspersky-labs.com/updates/
127.0.0.1
downloads4.kaspersky-labs.com/updates/
127.0.0.1
downloads5.kaspersky-labs.com/updates/
127.0.0.1
http://downloads1.kaspersky-labs.com/updates/
127.0.0.1
http://downloads2.kaspersky-labs.com/updates/
127.0.0.1
http://downloads3.kaspersky-labs.com/updates/
127.0.0.1
http://downloads4.kaspersky-labs.com/updates/
127.0.0.1
http://downloads5.kaspersky-labs.com/updates/
127.0.0.1
ftp://downloads1.kaspersky-labs.com
127.0.0.1
ftp://downloads2.kaspersky-labs.com
127.0.0.1
ftp://downloads3.kaspersky-labs.com
127.0.0.1
ftp://downloads4.kaspersky-labs.com
127.0.0.1
ftp://downloads5.kaspersky-labs.com
127.0.0.1
ftp://downloads1.kaspersky-labs.com/products/
127.0.0.1
ftp://downloads2.kaspersky-labs.com/products/
127.0.0.1
ftp://downloads3.kaspersky-labs.com/products/
127.0.0.1
ftp://downloads4.kaspersky-labs.com/products/
127.0.0.1
ftp://downloads5.kaspersky-labs.com/products/
127.0.0.1
ftp://downloads1.kaspersky-labs.com/updates/
127.0.0.1
ftp://downloads2.kaspersky-labs.com/updates/
127.0.0.1
ftp://downloads3.kaspersky-labs.com/updates/
127.0.0.1
ftp://downloads4.kaspersky-labs.com/updates/
127.0.0.1
ftp://downloads5.kaspersky-labs.com/updates/
127.0.0.1
http://updates.kaspersky-labs.com/updates/
127.0.0.1
http://updates1.kaspersky-labs.com/updates/
127.0.0.1
http://updates2.kaspersky-labs.com/updates/
127.0.0.1
http://updates3.kaspersky-labs.com/updates/
127.0.0.1
http://updates4.kaspersky-labs.com/updates/
127.0.0.1
ftp://updates.kaspersky-labs.com/updates/
127.0.0.1
ftp://updates1.kaspersky-labs.com/updates/
127.0.0.1
ftp://updates2.kaspersky-labs.com/updates/
127.0.0.1
ftp://updates3.kaspersky-labs.com/updates/
127.0.0.1
ftp://updates4.kaspersky-labs.com/updates/
127.0.0.1 viruslist.com
127.0.0.1 www.viruslist.com
127.0.0.1 http://viruslist.com
127.0.0.1
viruslist.ru
127.0.0.1 www.viruslist.ru
127.0.0.1 http://viruslist.ru
127.0.0.1 ftp://ftp.kasperskylab.ru/updates/
127.0.0.1 symantec.com
127.0.0.1 www.symantec.com
127.0.0.1 http://symantec.com
127.0.0.1
customer.symantec.com
127.0.0.1 http://customer.symantec.com
127.0.0.1
liveupdate.symantec.com
127.0.0.1 http://liveupdate.symantec.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1
http://liveupdate.symantecliveupdate.com
127.0.0.1
securityresponse.symantec.com
127.0.0.1 http://securityresponse.symantec.com
127.0.0.1 service1.symantec.com
127.0.0.1 http://service1.symantec.com
127.0.0.1 symantec.com/updates
127.0.0.1 http://symantec.com/updates
127.0.0.1 updates.symantec.com
127.0.0.1 http://updates.symantec.com
127.0.0.1 eset.com/
127.0.0.1 www.eset.com/
127.0.0.1
http://www.eset.com/
127.0.0.1 eset.com/products/index.php
127.0.0.1
www.eset.com/products/index.php
127.0.0.1
http://www.eset.com/products/index.php
127.0.0.1 eset.com/download/index.php
127.0.0.1 www.eset.com/download/index.php
127.0.0.1
http://www.eset.com/download/index.php
127.0.0.1 eset.com/joomla/
127.0.0.1 www.eset.com/joomla/
127.0.0.1 http://www.eset.com/joomla/
127.0.0.1 u3.eset.com/
127.0.0.1 http://u3.eset.com/
127.0.0.1
u4.eset.com/
127.0.0.1 http://u4.eset.com/
127.0.0.1
www.symantec.com/updates |
