IT ȱǰ Tip ó ȿ ȹŸ Ķ
DB ã
Į
긮 Zip긮 See긮 FTP

  IT
  ȱǰ
  Tip
  ó
  
  ȿ
  ȹŸ
  Ķ
  DBã
  Į

   DBã
   
  
  |   |  Ʒ  
W32/Warezov.150844@mm
 ̷
Worm
 ȯ
Windows
 ߰
20060911
 
Һи
 
 Ȯ
 ̷ ũ
150,844 Byte
 ÷
 
  Error, Good Day, Mail Delivery System, Mail Transaction Failed ..
 
   Ϸ ĵǸ, ý ּҸ Ͽ ÷ε Ѵ.
 ġ

ͺ ǰ /ġ մϴ.



  
 
󼼼

 

*

ýۿ ּҸ Ͽ ش ÷Ͽ Ϸ ȴ.



*



-

 

tsrv.exe Ѵ.

 

tsrv.c Ѵ.

 

tsrv.s  Ѵ.

 

tsrv.wax Ѵ.

 

tsrv.dll Ѵ.


-
?

-          95/98/ME/XP   -C:\Windows,

-          NT/2000           - C:\WinNT

 

ý msji449c14b7.dll  Ѵ.

 

ý hpzl449c14b7.exe  Ѵ.

 

ý cmut449c14b7.dll Ѵ.

 

- ý ?

-          95/98/ME/XP  - C:\Windows\System,

-          NT/2000          -C:\WinNT\System32

-          XP                  - C:\Windows\System32

 

tsrv.dll μ Եǰ,

μ ߴ ִ.

tsrv.wax WAB ڽ ̸ ּ Ʈ ´.

 

 

-Ʈ
 
Ʈ value ڵ ǵ .


HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run


tsrv= \tsrv.exe s   

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows


AppInit_DLLs = msji449c14b7.dll


ý ȣƮ Ͽ Ʈ , ڰ Ǽڵ ġḦ Ѵ.

 

ȣƮ Ͽ ߰ϴ ּҴ Ʒ .

 

127.0.0.1 download.microsoft.com
127.0.0.1 go.microsoft.com
127.0.0.1 msdn.microsoft.com
127.0.0.1 office.microsoft.com
127.0.0.1 windowsupdate.microsoft.com
127.0.0.1 http://www.microsoft.com/downloads/Search.aspx?displaylang=en
127.0.0.1 avp.ru
127.0.0.1 www.avp.ru
127.0.0.1 http://avp.ru
127.0.0.1 http://www.avp.ru
127.0.0.1 kaspersky.ru
127.0.0.1 www.kaspersky.ru
127.0.0.1 http://kaspersky.ru
127.0.0.1 kaspersky.com
127.0.0.1 www.kaspersky.com
127.0.0.1 http://kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.kaspersky-labs.com
127.0.0.1 http://kaspersky-labs.com
127.0.0.1 avp.ru/download/
127.0.0.1 www.avp.ru/download/
127.0.0.1 http://www.avp.ru/download/
127.0.0.1 http://www.kaspersky.ru/updates/
127.0.0.1 http://www.kaspersky-labs.com/updates/
127.0.0.1 http://kaspersky.ru/updates/
127.0.0.1 http://kaspersky-labs.com/updates/
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 downloads5.kaspersky-labs.com
127.0.0.1 http://downloads1.kaspersky-labs.com
127.0.0.1 http://downloads2.kaspersky-labs.com
127.0.0.1 http://downloads3.kaspersky-labs.com
127.0.0.1 http://downloads4.kaspersky-labs.com
127.0.0.1 http://downloads5.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com/products/
127.0.0.1 downloads2.kaspersky-labs.com/products/
127.0.0.1 downloads3.kaspersky-labs.com/products/
127.0.0.1 downloads4.kaspersky-labs.com/products/
127.0.0.1 downloads5.kaspersky-labs.com/products/
127.0.0.1 http://downloads1.kaspersky-labs.com/products/
127.0.0.1 http://downloads2.kaspersky-labs.com/products/
127.0.0.1 http://downloads3.kaspersky-labs.com/products/
127.0.0.1 http://downloads4.kaspersky-labs.com/products/
127.0.0.1 http://downloads5.kaspersky-labs.com/products/
127.0.0.1 downloads1.kaspersky-labs.com/updates/
127.0.0.1 downloads2.kaspersky-labs.com/updates/
127.0.0.1 downloads3.kaspersky-labs.com/updates/
127.0.0.1 downloads4.kaspersky-labs.com/updates/
127.0.0.1 downloads5.kaspersky-labs.com/updates/
127.0.0.1 http://downloads1.kaspersky-labs.com/updates/
127.0.0.1 http://downloads2.kaspersky-labs.com/updates/
127.0.0.1 http://downloads3.kaspersky-labs.com/updates/
127.0.0.1 http://downloads4.kaspersky-labs.com/updates/
127.0.0.1 http://downloads5.kaspersky-labs.com/updates/
127.0.0.1 ftp://downloads1.kaspersky-labs.com
127.0.0.1 ftp://downloads2.kaspersky-labs.com
127.0.0.1 ftp://downloads3.kaspersky-labs.com
127.0.0.1 ftp://downloads4.kaspersky-labs.com
127.0.0.1 ftp://downloads5.kaspersky-labs.com
127.0.0.1 ftp://downloads1.kaspersky-labs.com/products/
127.0.0.1 ftp://downloads2.kaspersky-labs.com/products/
127.0.0.1 ftp://downloads3.kaspersky-labs.com/products/
127.0.0.1 ftp://downloads4.kaspersky-labs.com/products/
127.0.0.1 ftp://downloads5.kaspersky-labs.com/products/
127.0.0.1 ftp://downloads1.kaspersky-labs.com/updates/
127.0.0.1 ftp://downloads2.kaspersky-labs.com/updates/
127.0.0.1 ftp://downloads3.kaspersky-labs.com/updates/
127.0.0.1 ftp://downloads4.kaspersky-labs.com/updates/
127.0.0.1 ftp://downloads5.kaspersky-labs.com/updates/
127.0.0.1 http://updates.kaspersky-labs.com/updates/
127.0.0.1 http://updates1.kaspersky-labs.com/updates/
127.0.0.1 http://updates2.kaspersky-labs.com/updates/
127.0.0.1 http://updates3.kaspersky-labs.com/updates/
127.0.0.1 http://updates4.kaspersky-labs.com/updates/
127.0.0.1 ftp://updates.kaspersky-labs.com/updates/
127.0.0.1 ftp://updates1.kaspersky-labs.com/updates/
127.0.0.1 ftp://updates2.kaspersky-labs.com/updates/
127.0.0.1 ftp://updates3.kaspersky-labs.com/updates/
127.0.0.1 ftp://updates4.kaspersky-labs.com/updates/
127.0.0.1 viruslist.com
127.0.0.1 www.viruslist.com
127.0.0.1 http://viruslist.com
127.0.0.1 viruslist.ru
127.0.0.1 www.viruslist.ru
127.0.0.1 http://viruslist.ru
127.0.0.1 ftp://ftp.kasperskylab.ru/updates/
127.0.0.1 symantec.com
127.0.0.1 www.symantec.com
127.0.0.1 http://symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 http://customer.symantec.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 http://liveupdate.symantec.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 http://liveupdate.symantecliveupdate.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 http://securityresponse.symantec.com
127.0.0.1 service1.symantec.com
127.0.0.1 http://service1.symantec.com
127.0.0.1 symantec.com/updates
127.0.0.1 http://symantec.com/updates
127.0.0.1 updates.symantec.com
127.0.0.1 http://updates.symantec.com
127.0.0.1 eset.com/
127.0.0.1 www.eset.com/
127.0.0.1 http://www.eset.com/
127.0.0.1 eset.com/products/index.php
127.0.0.1 www.eset.com/products/index.php
127.0.0.1 http://www.eset.com/products/index.php
127.0.0.1 eset.com/download/index.php
127.0.0.1 www.eset.com/download/index.php
127.0.0.1 http://www.eset.com/download/index.php
127.0.0.1 eset.com/joomla/
127.0.0.1 www.eset.com/joomla/
127.0.0.1 http://www.eset.com/joomla/
127.0.0.1 u3.eset.com/
127.0.0.1 http://u3.eset.com/
127.0.0.1 u4.eset.com/
127.0.0.1 http://u4.eset.com/
127.0.0.1 www.symantec.com/updates

 
ġ
긮 ϴ ۱ 긮 ̸ ù ȣ ޽ϴ.
긮 㰡 긮 , Ǿ ֽϴ.
̸ ϴ ع Ǵ . Ҽ ֽϴ.
* 긮 ̿ : greenking@everyzone.com