IT ȱǰ Tip ó ȿ ȹŸ Ķ
DB ã
Į
긮 Zip긮 See긮 FTP

  IT
  ȱǰ
  Tip
  ó
  
  ȿ
  ȹŸ
  Ķ
  DBã
  Į

   DBã
   
  
  |   |  Ʒ  
Backdoor-W32/IRCBot.18944.C
 ̷
Backdoor
 ȯ
Windows
 ߰
20070326
 
Һи
 
 Ȯ
޽
 ̷ ũ
18,944 Byte
 ÷
photo album.zip
 
  
 
  MSN ޽ ؼ ĵǸ ý ý Ǽڵ带 Ѵ.
 ġ

ͺ ǰ /ġ մϴ.



  
 
󼼼

*


MSN
޽ ĵȴ.



*

 

 photo album.zip ̶ ϸ msn޽ ȮǸ photo album.zip ϼӿ photo album.pif Ǿ ִ.

 

  ϸ ý photo album.zip, rdshost.dll Ѵ.

msn ޽ .

 

      -      lol my sister wants me to send you this photo album 

-         HEY lol i''''''''''''''''ve done a new photo album !:) Second ill find file and send you it.  

-          - Hey wanna see my new photo album?  

-         OMG just accept please its only my photo album!!

-         Hey accept my photo album, Nice new pics of me and my friends and stuff and when i was young lol... 

- Hey just finished new photo album! :) might be a few nudes ;) lol...     

- hey you got a photo album? anyways heres my new photo album :) accept k?     

- hey man accept my new photo album.. :( made it for yah, been doing picture story of my life lol..

 

 

-

 

Backdoor Ǹ, Ϲ photo album.zip ġ ȴ
-
photo album.pif(Backdoor-W32/IRCBot.18944.C) Ǿ

 

- ?

-          95/98/ME/XP  - C:\Windows\

-          NT/2000       -C:\WinNT\

 

Backdoor Ǹ, Ϲ ý rdshost.dll(Backdoor-W32/IRCBot.14848.B) ġ ȴ


-
ý ?

-          95/98/ME     - C:\Windows\System,

-          NT/2000      -C:\WinNT\System32

-          XP           - C:\Windows\System32

 

 

-Ʈ .


ý ڽ Ʈ ý ǵ Ѵ.


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ ShellServiceObjectDelayLoad
rdshost = {829053f7 6ED6 4557 95D4- 628CF4C5946D}

HKEY_CLASSES_ROOT\CLSID\{829053f7 – 6ED6 – 4557 – 95D4- 628CF4C5946D}\InProcServer32
(⺻) = rdshost.dll


ý TCP 8080 Ʈ LISTENING · д. (κ ٸ )

߼, ֵ ġ, , ׸ ǻ ĺų ( , ) ܺη Ȼ ߻ ִ. 


鵵μ ϰԵǸ, ý Ͼ ִ.

1.

2.
Ʈ
3.
Ű Ÿ
4.
ٿε
5. ftp
IRC ۰
6.
ý ϵ

 
ġ
긮 ϴ ۱ 긮 ̸ ù ȣ ޽ϴ.
긮 㰡 긮 , Ǿ ֽϴ.
̸ ϴ ع Ǵ . Ҽ ֽϴ.
* 긮 ̿ : greenking@everyzone.com