Worm/Bagz.C.2 - Worm

In alte limbi

Descriere completa

Nume:	Worm/Bagz.C.2
Descoperit pe data de:	04/10/2004
Tip:	Vierme
ITW:	Nu
Numar infectii raportate:	Scazut
Potential de raspandire:	Mediu
Potential de distrugere:	Mediu
Fisier static:	Nu
Marime:	~157.200 Bytes
Versiune VDF:	6.28.00.28

General Metoda de raspandire:
   • Email

Alias:
   • Symantec: W32.Bagz.D@mm
   • Mcafee: W32/Bagz.d@MM
   • Kaspersky: Email-Worm.Win32.Bagz.c
   • TrendMicro: WORM_BAGZ.C
   • Grisoft: I-Worm/Bagz.C
   • VirusBuster: I-Worm.Bagz.F1
   • Bitdefender: Win32.Bagz.D@mm

Sistem de operare:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Efecte secundare:
   • Blocheaza accesul la website-uri ale firmelor de securitate
   • Inchide aplicatiile de securitate
   • Creeaza fisiere malware
   • Utilizeaza propriul motor de email
   • Reduce setarile de securitate
   • Modificari in registri

Fisiere Se copiaza in urmatoarele locatii (fisierele au atasate la sfarsit caractere aleatorii si se diferentiaza astfel de original):
   • %SYSDIR%\backup.doc %spatii libere% .exe
   • %SYSDIR%\admin.doc %spatii libere% .exe
   • %SYSDIR%\archivator.doc %spatii libere% .exe
   • %SYSDIR%\about.doc %spatii libere% .exe
   • %SYSDIR%\readme.doc %spatii libere% .exe
   • %SYSDIR%\help.doc %spatii libere% .exe
   • %SYSDIR%\photos.doc %spatii libere% .exe
   • %SYSDIR%\payment.doc %spatii libere% .exe
   • %SYSDIR%\archives.doc %spatii libere% .exe
   • %SYSDIR%\manual.doc %spatii libere% .exe
   • %SYSDIR%\inbox.doc %spatii libere% .exe
   • %SYSDIR%\outbox.doc %spatii libere% .exe
   • %SYSDIR%\save.doc %spatii libere% .exe
   • %SYSDIR%\rar.doc %spatii libere% .exe
   • %SYSDIR%\zip.doc %spatii libere% .exe
   • %SYSDIR%\ataches.doc %spatii libere% .exe
   • %SYSDIR%\documentation.doc %spatii libere% .exe
   • %SYSDIR%\docs.doc %spatii libere% .exe
   • %SYSDIR%\sysboot.doc %spatii libere% .exe

Arhivare:
Creeaza arhive si stocheaza fisiere in acestea.

Fisierele procesate sunt:
   • %SYSDIR%\backup.doc %spatii libere% .exe
   • %SYSDIR%\admin.doc %spatii libere% .exe
   • %SYSDIR%\archivator.doc %spatii libere% .exe
   • %SYSDIR%\about.doc %spatii libere% .exe
   • %SYSDIR%\readme.doc %spatii libere% .exe
   • %SYSDIR%\help.doc %spatii libere% .exe
   • %SYSDIR%\photos.doc %spatii libere% .exe
   • %SYSDIR%\payment.doc %spatii libere% .exe
   • %SYSDIR%\archives.doc %spatii libere% .exe
   • %SYSDIR%\manual.doc %spatii libere% .exe
   • %SYSDIR%\inbox.doc %spatii libere% .exe
   • %SYSDIR%\outbox.doc %spatii libere% .exe
   • %SYSDIR%\save.doc %spatii libere% .exe
   • %SYSDIR%\rar.doc %spatii libere% .exe
   • %SYSDIR%\zip.doc %spatii libere% .exe
   • %SYSDIR%\ataches.doc %spatii libere% .exe
   • %SYSDIR%\documentation.doc %spatii libere% .exe
   • %SYSDIR%\docs.doc %spatii libere% .exe
   • %SYSDIR%\sysboot.doc %spatii libere% .exe

Numele arhivei este unul din urmatoarele:
   • %SYSDIR%\backup.zip
   • %SYSDIR%\admin.zip
   • %SYSDIR%\archivator.zip
   • %SYSDIR%\about.zip
   • %SYSDIR%\readme.zip
   • %SYSDIR%\help.zip
   • %SYSDIR%\photos.zip
   • %SYSDIR%\payment.zip
   • %SYSDIR%\archives.zip
   • %SYSDIR%\manual.zip
   • %SYSDIR%\inbox.zip
   • %SYSDIR%\outbox.zip
   • %SYSDIR%\save.zip
   • %SYSDIR%\rar.zip
   • %SYSDIR%\zip.zip
   • %SYSDIR%\ataches.zip
   • %SYSDIR%\documentation.zip
   • %SYSDIR%\docs.zip

Sunt create fisierele:

– Fisiere inofensive:
   • %SYSDIR%\ipdb.dll
   • %SYSDIR%\jobdb.dll
   • %SYSDIR%\wdate.dll

– %SYSDIR%\rpc32.exe Fisierul este executat dupa ce a fost creat. Analiza ulterioara a relevat ca si acest fisier este malware. Detectat ca: Worm/Bagz.C.1

– %SYSDIR%\run32.exe Analiza ulterioara a relevat ca si acest fisier este malware. Detectat ca: Worm/Bagz.D.2

Registrii sistemului Urmatoarele chei sunt adaugate in registri pentru a incarca serviciul la repornirea sistemului:

– [HKLM\SYSTEM\CurrentControlSet\Services\RPC32]
   • Type = 120
   • Start = 2
   • ErrorControl = 0
   • ImagePath = %SYSDIR%\rpc32.exe
   • DisplayName = Network Explorer
   • ObjectName = LocalSystem
   • Description = Starts and configures accessibility tools from one window

– [HKLM\SYSTEM\CurrentControlSet\Services\RPC32\Security]
   • Security = %valori hex%

– [HKLM\SYSTEM\CurrentControlSet\Services\RPC32\Enum]
   • 0 = Root\LEGACY_RPC32\0000
   • Count = 1
   • NextInstance = 1

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RPC32]
   • NextInstance = 1

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RPC32\0000]
   • Service = RPC32
   • Legacy = 1
   • ConfigFlags = 0
   • Class = LegacyDriver
   • ClassGUID = {8ECC055D-047F-11D1-A537-0000F8753ED1}
   • DeviceDesc = Network Explorer

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RPC32\0000\Control]
   • *NewlyCreated* = 0
   • ActiveService = RPC32

Valorile urmatoarelor chei sunt sterse din registrii sistemului:

– %all registry keys%
   • %necunoscut% = %toate directoarele%\pfwadmin.exe
   • %necunoscut% = %toate directoarele%\persfw.exe
   • %necunoscut% = %toate directoarele%\sched.exe
   • %necunoscut% = %toate directoarele%\aswupdsv.exe
   • %necunoscut% = %toate directoarele%\aswregsvr.exe
   • %necunoscut% = %toate directoarele%\aswboot.exe
   • %necunoscut% = %toate directoarele%\ashskpck.exe
   • %necunoscut% = %toate directoarele%\ashskpcc.exe
   • %necunoscut% = %toate directoarele%\ashsimpl.exe
   • %necunoscut% = %toate directoarele%\ashserv.exe
   • %necunoscut% = %toate directoarele%\ashquick.exe
   • %necunoscut% = %toate directoarele%\ashpopwz.exe
   • %necunoscut% = %toate directoarele%\ashmaisv.exe
   • %necunoscut% = %toate directoarele%\ashlogv.exe
   • %necunoscut% = %toate directoarele%\ashdisp.exe
   • %necunoscut% = %toate directoarele%\ashchest.exe
   • %necunoscut% = %toate directoarele%\ashbug.exe
   • %necunoscut% = %toate directoarele%\ashavast.exe
   • %necunoscut% = %toate directoarele%\symnavo.dll
   • %necunoscut% = %toate directoarele%\statushp.dll
   • %necunoscut% = %toate directoarele%\sdstp32i.dll
   • %necunoscut% = %toate directoarele%\sdsok32i.dll
   • %necunoscut% = %toate directoarele%\sdsnd32i.dll
   • %necunoscut% = %toate directoarele%\sdpck32i.dll
   • %necunoscut% = %toate directoarele%\scriptui.dll
   • %necunoscut% = %toate directoarele%\scanmgr.dll
   • %necunoscut% = %toate directoarele%\scandres.dll
   • %necunoscut% = %toate directoarele%\scandlvr.dll
   • %necunoscut% = %toate directoarele%\savscan.exe
   • %necunoscut% = %toate directoarele%\savrtpel.sys
   • %necunoscut% = %toate directoarele%\savrt32.dll
   • %necunoscut% = %toate directoarele%\savrt.sys
   • %necunoscut% = %toate directoarele%\s32navo.dll
   • %necunoscut% = %toate directoarele%\s32integ.dll
   • %necunoscut% = %toate directoarele%\quaropts.dat
   • %necunoscut% = %toate directoarele%\quarantine
   • %necunoscut% = %toate directoarele%\quar32.dll
   • %necunoscut% = %toate directoarele%\qspak32.dll
   • %necunoscut% = %toate directoarele%\qconsole.exe
   • %necunoscut% = %toate directoarele%\qconres.dll
   • %necunoscut% = %toate directoarele%\ptchinst.dll
   • %necunoscut% = %toate directoarele%\probegse.dll
   • %necunoscut% = %toate directoarele%\patch25d.dll
   • %necunoscut% = %toate directoarele%\opscan.exe
   • %necunoscut% = %toate directoarele%\officeav.dll
   • %necunoscut% = %toate directoarele%\oeheur.dll
   • %necunoscut% = %toate directoarele%\netbrext.dll
   • %necunoscut% = %toate directoarele%\navwnt.exe
   • %necunoscut% = %toate directoarele%\navw32.exe
   • %necunoscut% = %toate directoarele%\navuihtm.dll
   • %necunoscut% = %toate directoarele%\navui.nsi
   • %necunoscut% = %toate directoarele%\navui.dll
   • %necunoscut% = %toate directoarele%\navtskwz.dll
   • %necunoscut% = %toate directoarele%\navtasks.dll
   • %necunoscut% = %toate directoarele%\navstub.exe
   • %necunoscut% = %toate directoarele%\navstats.dll
   • %necunoscut% = %toate directoarele%\navshext.dll
   • %necunoscut% = %toate directoarele%\navprod.dll
   • %necunoscut% = %toate directoarele%\navopts.dll
   • %necunoscut% = %toate directoarele%\navoptrf.dll
   • %necunoscut% = %toate directoarele%\navntutl.dll
   • %necunoscut% = %toate directoarele%\navlucbk.dll
   • %necunoscut% = %toate directoarele%\navlogv.dll
   • %necunoscut% = %toate directoarele%\navlnch.dll
   • %necunoscut% = %toate directoarele%\navlcom.dll
   • %necunoscut% = %toate directoarele%\navevent.dll
   • %necunoscut% = %toate directoarele%\naverror.dll
   • %necunoscut% = %toate directoarele%\navcomui.dll
   • %necunoscut% = %toate directoarele%\navcfgwz.dll
   • %necunoscut% = %toate directoarele%\navapw32.exe
   • %necunoscut% = %toate directoarele%\navapw32.dll
   • %necunoscut% = %toate directoarele%\navapsvc.exe
   • %necunoscut% = %toate directoarele%\navapscr.dll
   • %necunoscut% = %toate directoarele%\navap32.dll
   • %necunoscut% = %toate directoarele%\n32exclu.dll
   • %necunoscut% = %toate directoarele%\n32call.dll
   • %necunoscut% = %toate directoarele%\ltchkres.dll
   • %necunoscut% = %toate directoarele%\djsalert.dll
   • %necunoscut% = %toate directoarele%\defalert.dll
   • %necunoscut% = %toate directoarele%\cfgwzres.dll
   • %necunoscut% = %toate directoarele%\cfgwiz.exe
   • %necunoscut% = %toate directoarele%\ccimscn.exe
   • %necunoscut% = %toate directoarele%\ccimscan.dll
   • %necunoscut% = %toate directoarele%\ccavmail.dll
   • %necunoscut% = %toate directoarele%\bootwarn.exe
   • %necunoscut% = %toate directoarele%\avres.dll
   • %necunoscut% = %toate directoarele%\avcompbr.dll
   • %necunoscut% = %toate directoarele%\apwutil.dll
   • %necunoscut% = %toate directoarele%\apwcmdnt.dll
   • %necunoscut% = %toate directoarele%\aboutplg.dll
   • %necunoscut% = %toate directoarele%\zlparser.dll
   • %necunoscut% = %toate directoarele%\vsvault.dll
   • %necunoscut% = %toate directoarele%\vsruledb.dll
   • %necunoscut% = %toate directoarele%\vsmon.exe
   • %necunoscut% = %toate directoarele%\vsdb.dll
   • %necunoscut% = %toate directoarele%\vsavpro.dll
   • %necunoscut% = %toate directoarele%\ssleay32.dll
   • %necunoscut% = %toate directoarele%\cerbprovider.pvx
   • %necunoscut% = %toate directoarele%\camupd.dll
   • %necunoscut% = %toate directoarele%\zonealarm.exe
   • %necunoscut% = %toate directoarele%\zl_priv.htm
   • %necunoscut% = %toate directoarele%\zlclient.exe
   • %necunoscut% = %toate directoarele%\zav.zap
   • %necunoscut% = %toate directoarele%\zauninst.exe
   • %necunoscut% = %toate directoarele%\zatutor.exe
   • %necunoscut% = %toate directoarele%\tutorwiz.dll
   • %necunoscut% = %toate directoarele%\security.zap
   • %necunoscut% = %toate directoarele%\programs.zap
   • %necunoscut% = %toate directoarele%\idlock.zap
   • %necunoscut% = %toate directoarele%\framewrk.dll
   • %necunoscut% = %toate directoarele%\firewall.zap
   • %necunoscut% = %toate directoarele%\filter.zap
   • %necunoscut% = %toate directoarele%\email.zap
   • %necunoscut% = %toate directoarele%\alert.zap
   • %necunoscut% = %toate directoarele%\wormres.dll
   • %necunoscut% = %toate directoarele%\vsowow.dll
   • %necunoscut% = %toate directoarele%\vsoupd.dll
   • %necunoscut% = %toate directoarele%\vsoui.dll
   • %necunoscut% = %toate directoarele%\mcshield.dll
   • %necunoscut% = %toate directoarele%\vsagntui.dll
   • %necunoscut% = %toate directoarele%\shlres.dll
   • %necunoscut% = %toate directoarele%\shextres.inf
   • %necunoscut% = %toate directoarele%\shextbin.inf
   • %necunoscut% = %toate directoarele%\scrstres.inf
   • %necunoscut% = %toate directoarele%\scrpsbin.inf
   • %necunoscut% = %toate directoarele%\scrpres.dll
   • %necunoscut% = %toate directoarele%\scanserv.dll
   • %necunoscut% = %toate directoarele%\scan.dat
   • %necunoscut% = %toate directoarele%\patchw32.dll
   • %necunoscut% = %toate directoarele%\outscres.dll
   • %necunoscut% = %toate directoarele%\outscan.dll
   • %necunoscut% = %toate directoarele%\ntclient.dll
   • %necunoscut% = %toate directoarele%\naievent.dll
   • %necunoscut% = %toate directoarele%\naiann.dll
   • %necunoscut% = %toate directoarele%\mcvsworm.dll
   • %necunoscut% = %toate directoarele%\mcvsskt.dll
   • %necunoscut% = %toate directoarele%\mcvsshld.exe
   • %necunoscut% = %toate directoarele%\mcvsshl.dll
   • %necunoscut% = %toate directoarele%\mcvsscrp.dll
   • %necunoscut% = %toate directoarele%\mcvsrte.exe
   • %necunoscut% = %toate directoarele%\mcvsmap.exe
   • %necunoscut% = %toate directoarele%\mcvsftsn.exe
   • %necunoscut% = %toate directoarele%\mcvsescn.exe
   • %necunoscut% = %toate directoarele%\mcvsctl.dll
   • %necunoscut% = %toate directoarele%\mcurial.dll
   • %necunoscut% = %toate directoarele%\mcshield.exe
   • %necunoscut% = %toate directoarele%\mcscan32.dll
   • %necunoscut% = %toate directoarele%\mcmnhdlr.exe
   • %necunoscut% = %toate directoarele%\mcavtsub.dll
   • %necunoscut% = %toate directoarele%\imscnres.inf
   • %necunoscut% = %toate directoarele%\imscnbin.inf
   • %necunoscut% = %toate directoarele%\ftscnres.dll
   • %necunoscut% = %toate directoarele%\emscnres.dll
   • %necunoscut% = %toate directoarele%\edisk.dll
   • %necunoscut% = %toate directoarele%\ashldres.dll
   • %necunoscut% = %toate directoarele%\appinit.ini
   • %necunoscut% = %toate directoarele%\804mbd1.img
   • %necunoscut% = %toate directoarele%\804mbd1.chk
   • %necunoscut% = %toate directoarele%\mghtml.exe
   • %necunoscut% = %toate directoarele%\mcinfo.exe
   • %necunoscut% = %toate directoarele%\mcappins.exe
   • %necunoscut% = %toate directoarele%\dunzip32.dll
   • %necunoscut% = %toate directoarele%\mvtx.exe
   • %necunoscut% = %toate directoarele%\mpfwizard.exe
   • %necunoscut% = %toate directoarele%\mpfupdchk.dll
   • %necunoscut% = %toate directoarele%\mpfui.dll
   • %necunoscut% = %toate directoarele%\mpftray.exe
   • %necunoscut% = %toate directoarele%\mpfservice.exe
   • %necunoscut% = %toate directoarele%\mpfconsole.exe
   • %necunoscut% = %toate directoarele%\mpfagent.exe

Email Are un motor SMTP integrat. Va fi facuta o conexiune directa cu serverul destinatar. Iata caracteristicile lui:

De la:
Adresa este falsificata.

Catre:
– Adrese de email gasite pe sistem.

Subiect:
Unul din urmatoarele:
   • please responce; Read this; urgent; toxic; contract; Money; office;
      Have a nice day; Hello; Russian's; Amirecans; attachments; attach;
      waiting; best regards; Administrator; Warning; text; Vasia; re:
      Andrey; re: please; re: order; Allert!; Att; Hi

Corpul email-ului:
Corpul email-ului este unul din textele:

   • Did you get the previous document I attached for you?
     I resent it in this email just in case, because I
     really need you to check it out asap.

     Best Regards

   • Hi

     I made a mistake and forgot to click attach
     on the previous email I sent you. Please give me
     your opinion on this opportunity when you get a chance.

     Best Regards

   • Hi

     I was supposed to send you this document yesterday.
     Sorry for the delay, please forward this to your family if possible.
     It contains important info for both of you.

   • Hi

     Sorry, I forgot to send an important
     document to you in that last email. I had an important phone call.
     Please checkout attached doc file when you have a moment.

     Best Regards

   • Hi

     I was in a rush and I forgot to attach an important
     document. Please see attached doc file.

     Best Regards,

   • Sorry to bother you, but I am having a problem receiving your emails.
     I am responding to your last email in the attached file.
     Please get back to me if there is any problem reading the attachment

   • I am responding to your last email in the attached file.
     I had a delivery problem with your inbox, so maybe you'll receive this now.

   • Can you please check out the email I have attached?
     For some reason, I received only part of your last several emails.
     I want to make sure that there are no problems with either of our accounts.

   • This email is being sent as attachment because
     it was previously blocked by your email filters.
     Please view the attachment and respond.
     Thanks

   • I resent this email as attachment because
     it was previously blocked by your email filters.
     Please read the attachment and respond.
     Thanks

   • I apologize, but I need you to verify
     that I have the correct contact info for you.
     My system crashed last weekend and
     I lost most of my friends and work contacts.
     Please check the attached (.pdf) and
     please let me know if your info is current.

   • My last email to you was returned.
     The reason is that I am not currently
     added to your "allowed" contact list.
     Please add my updated contact info
     provided in the attached (.pdf) file
     so I can send you emails in the future.
     Sincerely

   • I have updated my email address
     See the (.pdf) file attached and
     please respond if you have any questions.

   • We have made recent updates to our database.
     Please verify your mailing address on file is correct.
     We have attached a (.pdf) sheet for you to use for your response.

   • Hello

     Our contact information has changed.
     See the attached (.pdf) sheet for details.

     Sincerely,

   • ***URGENT: SERVICE SHUTDOWN NOTICE***
     Due to your failure to comply with our email
     Rules and Regulations, your email account has been
     temporarily suspended for 24 hours unless we are contacted regarding
     this situation.
     You must read the attached document for further
     instructions. Failure to comply will result in termination of your account.
     Regards,
     Net Operator
     ***URGENT: SERVICE SHUTDOWN NOTICE***

   • ***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***

     ,
     You are currently unable to send emails.
     This may be a billing issue.
     Please call the billing center.
     The
      for the billing office is located in the attached
     contact list for your convenience.
     ***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***

   • ***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***
     Hello,

     The previous email you sent has been recognized as spam.
     This means your email was not delivered to your friend or client.
     You must open the attached file to receive more information.
     ***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***

   • Hello,
     What version of windows you are using?
     This last document I received from you came out weird.
     Please see the attached word file and resend the file to me.
     Many thanks,
     User

   • Hello,
     My PC crashed while I was sending that last email.
     I have re-attached the document of yours that I discovered.
     Please read attached document and respond ASAP.
     Sincerely,
     User

   • Hello,
     Your email was sent in an INVALID format.
     To verify this email was sent from you,
     simply open the attached email (.eml) file
     and click yes in the sender options box.
     Thank You,
     User

   • Hello,
      Your email was received.
     YOUR REPLY IS URGENT!
     Please view the attached text file for instructions.
     Regards,
     User

   • Hello,
      I was in a hurry and I forgot to attach an important
      document. Please see attached.
      Best Regards,
     User

   • Hello,
      I resent this email as attachment because
      it was previously blocked by your email filters.
      Please read the attachment and respond.

     Thanks,User

   • Hello,
     Sorry, I forgot to attach the new contact information.
     Please view the attached (.pdf) contact sheet.
     Sincerely,
     User

Atasament:
Numele fisierului atasat este unul din urmatoarele:
   • backup.zip; admin.zip; archivator.zip; about.zip; readme.zip;
      help.zip; photos.zip; payment.zip; archives.zip; manual.zip;
      inbox.zip; outbox.zip; save.zip; rar.zip; zip.zip; ataches.zip;
      documentation.zip; docs.zip; backup.doc %spatii libere%.exe;
      admin.doc %spatii libere%.exe; archivator.doc %spatii
      libere%.exe; about.doc %spatii libere%.exe; readme.doc
      %spatii libere%.exe; help.doc %spatii libere%.exe;
      photos.doc %spatii libere%.exe; payment.doc %spatii
      libere%.exe; archives.doc %spatii libere%.exe; manual.doc
      %spatii libere%.exe; inbox.doc %spatii libere%.exe;
      outbox.doc %spatii libere%.exe; save.doc %spatii
      libere%.exe; rar.doc %spatii libere%.exe; zip.doc
      %spatii libere%.exe; ataches.doc %spatii libere%.exe;
      documentation.doc %spatii libere%.exe; docs.doc %spatii
      libere%.exe; sysboot.doc %spatii libere%.exe

Email-ul poate arata ca unul din urmatoarele:

Email Cautare adrese:
Cauta adrese de email in urmatoarele fisiere:
   • .TBB
   • .tbb
   • .TBI
   • .tbi
   • .DBX
   • .dbx
   • .HTM
   • .htm
   • .TXT
   • .txt

Adrese evitate:
Nu trimite email-uri la adrese care contin unul din urmatoarele siruri de caractere:
   • winzip; winrar; webmaster@; update; unix; support@; support; spam;
      sopho; samples; root@; rating@; postmaster@; pgp; panda; ntivi;
      noreply; noone@; nobody@; news; netadmin@; local; listserv; linux;
      kasp; info@; icrosoft; hostmaster@; help@; google; gold-certs@; gold-;
      free-av; feste; f-secur; contract@; contact@; certs@; certific; cafee;
      bugs@; bsd; anyone@; all@; administrator@; admin; abuse; @microsoft;
      @messagelab; @iana; @foo; @avp; oocies

Fisiere host Fisierul

– In acest caz, inregistrarile existente sunt sterse.

– Accesul la urmatoarele domenii este blocat:
   • ad.doubleclick.net; ad.fastclick.net; ads.fastclick.net;
      ar.atwola.com; atdmt.com; avp.ch; avp.com; avp.ru; awaps.net;
      banner.fastclick.net; banners.fastclick.net; ca.com; click.atdmt.com;
      clicks.atdmt.com; dispatch.mcafee.com; download.mcafee.com;
      download.microsoft.com; downloads.microsoft.com; engine.awaps.net;
      fastclick.net; f-secure.com; ftp.f-secure.com; ftp.sophos.com;
      go.microsoft.com; liveupdate.symantec.com; mast.mcafee.com;
      mcafee.com; media.fastclick.net; msdn.microsoft.com; my-etrust.com;
      nai.com; networkassociates.com; office.microsoft.com;
      phx.corporate-ir.net; secure.nai.com; securityresponse.symantec.com;
      service1.symantec.com; sophos.com; spd.atdmt.com;
      support.microsoft.com; symantec.com; update.symantec.com;
      updates.symantec.com; us.mcafee.com; vil.nai.com; viruslist.ru;
      windowsupdate.microsoft.com; www.avp.ch; www.avp.com; www.avp.ru;
      www.awaps.net; www.ca.com; www.fastclick.net; www.f-secure.com;
      www.kaspersky.ru; www.mcafee.com; www.my-etrust.com; www.nai.com;
      www.networkassociates.com; www.sophos.com; www.symantec.com;
      www.trendmicro.com; www.viruslist.ru; www3.ca.com; localhost

Fisierul hosts modificat va arata astfel:

Detaliile fisierului Limbaj de programare:
Limbaj de programare folosit: C (compilat cu Microsoft Visual C++).

Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit urmatorul program de arhivare:
• UPX

Pentru o descriere scurta click aici.

Inserat de Andrei Gherman la Thu, 04 May 2006 13:27 (GMT+1)
Updatat de Andrei Gherman la Thu, 04 May 2006 15:00 (GMT+1)

« Inapoi

Worm/Bagz.C.2 - Worm

Noutati