TrojanSpy.Win32.EMOTET.TIABOFIZ
Windows
Tipo de grayware:
Trojan Spy
Destrutivo:
Não
Criptografado:
In the Wild:
Sim
Visão geral
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Löscht Dateien, so dass Programme und Anwendungen nicht ordnungsgemäß ausgeführt werden.
Detalhes técnicos
Übertragungsdetails
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
Erstellt die folgenden Ordner:
- %Windows%\SysWOW64\regini
- %Windows%\SysWOW64\sechost
- %Windows%\SysWOW64\adprovider
- %Windows%\SysWOW64\NlsData0024
- %Windows%\SysWOW64\ole2
- %Windows%\SysWOW64\logoncli
- %Windows%\SysWOW64\cipher
- %Windows%\SysWOW64\hid
- %Windows%\SysWOW64\mfh264enc
- %Windows%\SysWOW64\NlsLexicons001d
- %Windows%\SysWOW64\ntlanman
- %Windows%\SysWOW64\mscpx32r
- %Windows%\SysWOW64\netcfgx
- %Windows%\SysWOW64\comsnap
- %Windows%\SysWOW64\KBDUKX
- %Windows%\SysWOW64\MshtmlDac
- %Windows%\SysWOW64\P2PGraph
- %Windows%\SysWOW64\CPFilters
- %Windows%\SysWOW64\NlsData001d
- %Windows%\SysWOW64\vfwwdm32
- %Windows%\SysWOW64\msports
- %Windows%\SysWOW64\NlsData000a
- %Windows%\SysWOW64\msrepl40
- %Windows%\SysWOW64\wmdmps
- %Windows%\SysWOW64\dhcpcmonitor
- %Windows%\SysWOW64\newdev
- %Windows%\SysWOW64\Query
- %Windows%\SysWOW64\mscat32
- %Windows%\SysWOW64\scansetting
- %Windows%\SysWOW64\olecli32
- %Windows%\SysWOW64\pku2u
- %Windows%\SysWOW64\KBDCA
- %Windows%\SysWOW64\framedyn
- %Windows%\SysWOW64\powercfg
(Hinweis: %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.)
Autostart-Technik
Registriert sich als Systemdienst, damit sie bei jedem Systemstart automatisch ausgeführt wird, indem sie die folgenden Registrierungseinträge hinzufügt:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\odbccp32
ImagePath = "%Windows%\SysWOW64\mscat32\odbccp32.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dsound
ImagePath = "%Windows%\SysWOW64\MshtmlDac\dsound.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\secproc_ssp_isv
ImagePath = "%Windows%\SysWOW64\mfh264enc\secproc_ssp_isv.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\itss
ImagePath = "%Windows%\SysWOW64\logoncli\itss.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\winsta
ImagePath = "%Windows%\SysWOW64\msports\winsta.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\netdiagfx
ImagePath = "%Windows%\SysWOW64\ole2\netdiagfx.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dhcpcsvc6
ImagePath = "%Windows%\SysWOW64\regini\dhcpcsvc6.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\riched32
ImagePath = "%Windows%\SysWOW64\Query\riched32.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\FirewallControlPanel
ImagePath = "%Windows%\SysWOW64\NlsData0024\FirewallControlPanel.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\TCPSVCS
ImagePath = "%Windows%\SysWOW64\ntlanman\TCPSVCS.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\kerberos
ImagePath = "%Windows%\SysWOW64\olecli32\kerberos.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WMVSDECD
ImagePath = "%Windows%\SysWOW64\NlsData000a\WMVSDECD.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\nlhtml
ImagePath = "%Windows%\SysWOW64\pku2u\nlhtml.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dbghelp
ImagePath = "%Windows%\SysWOW64\powercfg\dbghelp.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\rasdial
ImagePath = "%Windows%\SysWOW64\P2PGraph\rasdial.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\fdProxy
ImagePath = "%Windows%\SysWOW64\newdev\fdProxy.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WcnEapAuthProxy
ImagePath = "%Windows%\SysWOW64\sechost\WcnEapAuthProxy.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ncrypt
ImagePath = "%Windows%\SysWOW64\wmdmps\ncrypt.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dmvdsitf
ImagePath = "%Windows%\SysWOW64\cipher\dmvdsitf.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SensApi
ImagePath = "%Windows%\SysWOW64\comsnap\SensApi.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\kbdgeoqw
ImagePath = "%Windows%\SysWOW64\dhcpcmonitor\kbdgeoqw.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wpdwcn
ImagePath = "%Windows%\SysWOW64\framedyn\wpdwcn.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NlsData000a
ImagePath = "%Windows%\SysWOW64\KBDCA\NlsData000a.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\drtprov
ImagePath = "%Windows%\SysWOW64\mscpx32r\drtprov.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\syssetup
ImagePath = "%Windows%\SysWOW64\NlsData001d\syssetup.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\mpr
ImagePath = "%Windows%\SysWOW64\scansetting\mpr.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\cfgbkend
ImagePath = "%Windows%\SysWOW64\vfwwdm32\cfgbkend.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\rdprefdrvapi
ImagePath = "%Windows%\SysWOW64\adprovider\rdprefdrvapi.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\KBDARME
ImagePath = "%Windows%\SysWOW64\CPFilters\KBDARME.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wship6
ImagePath = "%Windows%\SysWOW64\hid\wship6.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NlsLexicons0021
ImagePath = "%Windows%\SysWOW64\KBDUKX\NlsLexicons0021.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dxdiagn
ImagePath = "%Windows%\SysWOW64\msrepl40\dxdiagn.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
ImagePath = "%Windows%\SysWOW64\netcfgx\storage.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\KBDSW09
ImagePath = "%Windows%\SysWOW64\NlsLexicons001d\KBDSW09.exe"
Andere Systemänderungen
Löscht die folgenden Dateien:
- %Windows%\SysWOW64\adprovider\rdprefdrvapi.exe:Zone.Identifier
- %Windows%\SysWOW64\P2PGraph\rasdial.exe:Zone.Identifier
- %Windows%\SysWOW64\mscat32\odbccp32.exe:Zone.Identifier
- %Windows%\SysWOW64\msports\winsta.exe:Zone.Identifier
- %Windows%\SysWOW64\ntlanman\TCPSVCS.exe:Zone.Identifier
- %Windows%\SysWOW64\scansetting\mpr.exe:Zone.Identifier
- %Windows%\SysWOW64\msrepl40\dxdiagn.exe:Zone.Identifier
- %Windows%\SysWOW64\cipher\dmvdsitf.exe:Zone.Identifier
- %Windows%\SysWOW64\pku2u\nlhtml.exe:Zone.Identifier
- %Windows%\SysWOW64\olecli32\kerberos.exe:Zone.Identifier
- %Windows%\SysWOW64\vfwwdm32\cfgbkend.exe:Zone.Identifier
- %Windows%\SysWOW64\hid\wship6.exe:Zone.Identifier
- %Windows%\SysWOW64\NlsData000a\WMVSDECD.exe:Zone.Identifier
- %Windows%\SysWOW64\framedyn\wpdwcn.exe:Zone.Identifier
- %Windows%\SysWOW64\Query\riched32.exe:Zone.Identifier
- %Windows%\SysWOW64\MshtmlDac\dsound.exe:Zone.Identifier
- %Windows%\SysWOW64\KBDCA\NlsData000a.exe:Zone.Identifier
- %Windows%\SysWOW64\ole2\netdiagfx.exe:Zone.Identifier
- %Windows%\SysWOW64\powercfg\dbghelp.exe:Zone.Identifier
- %Windows%\SysWOW64\regini\dhcpcsvc6.exe:Zone.Identifier
- %Windows%\SysWOW64\KBDUKX\NlsLexicons0021.exe:Zone.Identifier
- %Windows%\SysWOW64\logoncli\itss.exe:Zone.Identifier
- %Windows%\SysWOW64\wmdmps\ncrypt.exe:Zone.Identifier
- %Windows%\SysWOW64\dhcpcmonitor\kbdgeoqw.exe:Zone.Identifier
- %Windows%\SysWOW64\NlsLexicons001d\KBDSW09.exe:Zone.Identifier
- {malware file path and name}
- %Windows%\SysWOW64\comsnap\SensApi.exe:Zone.Identifier
- %Windows%\SysWOW64\NlsData001d\syssetup.exe:Zone.Identifier
- %Windows%\SysWOW64\newdev\fdProxy.exe:Zone.Identifier
- %Windows%\SysWOW64\mfh264enc\secproc_ssp_isv.exe:Zone.Identifier
- %Windows%\SysWOW64\mscpx32r\drtprov.exe:Zone.Identifier
- %Windows%\SysWOW64\NlsData0024\FirewallControlPanel.exe:Zone.Identifier
- %Windows%\SysWOW64\sechost\WcnEapAuthProxy.exe:Zone.Identifier
- %Windows%\SysWOW64\netcfgx\storage.exe:Zone.Identifier
- %Windows%\SysWOW64\CPFilters\KBDARME.exe:Zone.Identifier
(Hinweis: %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.)
Fügt die folgenden Registrierungseinträge hinzu:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\odbccp32
DisplayName = "odbccp32"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\odbccp32
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dsound
DisplayName = "dsound"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dsound
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\secproc_ssp_isv
DisplayName = "secproc_ssp_isv"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\secproc_ssp_isv
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\itss
DisplayName = "itss"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\itss
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\winsta
DisplayName = "winsta"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\winsta
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\netdiagfx
DisplayName = "netdiagfx"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\netdiagfx
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dhcpcsvc6
DisplayName = "dhcpcsvc6"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dhcpcsvc6
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\riched32
DisplayName = "riched32"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\riched32
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\FirewallControlPanel
DisplayName = "FirewallControlPanel"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\FirewallControlPanel
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\TCPSVCS
DisplayName = "TCPSVCS"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\TCPSVCS
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\kerberos
DisplayName = "kerberos"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\kerberos
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WMVSDECD
DisplayName = "WMVSDECD"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WMVSDECD
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\nlhtml
DisplayName = "nlhtml"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\nlhtml
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dbghelp
DisplayName = "dbghelp"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dbghelp
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\rasdial
DisplayName = "rasdial"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\rasdial
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\fdProxy
DisplayName = "fdProxy"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\fdProxy
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WcnEapAuthProxy
DisplayName = "WcnEapAuthProxy"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WcnEapAuthProxy
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ncrypt
DisplayName = "ncrypt"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ncrypt
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dmvdsitf
DisplayName = "dmvdsitf"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dmvdsitf
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SensApi
DisplayName = "SensApi"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SensApi
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\kbdgeoqw
DisplayName = "kbdgeoqw"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\kbdgeoqw
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wpdwcn
DisplayName = "wpdwcn"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wpdwcn
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NlsData000a
DisplayName = "NlsData000a"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NlsData000a
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\drtprov
DisplayName = "drtprov"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\drtprov
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\syssetup
DisplayName = "syssetup"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\syssetup
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\mpr
DisplayName = "mpr"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\mpr
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\cfgbkend
DisplayName = "cfgbkend"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\cfgbkend
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\rdprefdrvapi
DisplayName = "rdprefdrvapi"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\rdprefdrvapi
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\KBDARME
DisplayName = "KBDARME"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\KBDARME
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wship6
DisplayName = "wship6"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wship6
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NlsLexicons0021
DisplayName = "NlsLexicons0021"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NlsLexicons0021
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dxdiagn
DisplayName = "dxdiagn"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\dxdiagn
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
DisplayName = "storage"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
Start = "SERVICE_AUTO_START"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\KBDSW09
DisplayName = "KBDSW09"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\KBDSW09
Start = "SERVICE_AUTO_START"
Einschleusungsroutine
Schleust die folgenden Dateien ein:
- %Windows%\SysWOW64\framedyn\wpdwcn.exe
- %Windows%\SysWOW64\adprovider\rdprefdrvapi.exe
- %Windows%\SysWOW64\powercfg\dbghelp.exe
- %Windows%\SysWOW64\logoncli\itss.exe
- %Windows%\SysWOW64\newdev\fdProxy.exe
- %Windows%\SysWOW64\dhcpcmonitor\kbdgeoqw.exe
- %Windows%\SysWOW64\mfh264enc\secproc_ssp_isv.exe
- %Windows%\SysWOW64\KBDUKX\NlsLexicons0021.exe
- %Windows%\SysWOW64\Query\riched32.exe
- %Windows%\SysWOW64\ntlanman\TCPSVCS.exe
- %Windows%\SysWOW64\P2PGraph\rasdial.exe
- %Windows%\SysWOW64\NlsData001d\syssetup.exe
- %Windows%\SysWOW64\pku2u\nlhtml.exe
- %Windows%\SysWOW64\NlsData0024\FirewallControlPanel.exe
- %Windows%\SysWOW64\msrepl40\dxdiagn.exe
- %Windows%\SysWOW64\cipher\dmvdsitf.exe
- %Windows%\SysWOW64\vfwwdm32\cfgbkend.exe
- %Windows%\SysWOW64\NlsLexicons001d\KBDSW09.exe
- %Windows%\SysWOW64\netcfgx\storage.exe
- %Windows%\SysWOW64\wmdmps\ncrypt.exe
- %Windows%\SysWOW64\comsnap\SensApi.exe
- %Windows%\SysWOW64\MshtmlDac\dsound.exe
- %Windows%\SysWOW64\scansetting\mpr.exe
- %Windows%\SysWOW64\CPFilters\KBDARME.exe
- %Windows%\SysWOW64\ole2\netdiagfx.exe
- %Windows%\SysWOW64\sechost\WcnEapAuthProxy.exe
- %Windows%\SysWOW64\msports\winsta.exe
- %Windows%\SysWOW64\KBDCA\NlsData000a.exe
- %Windows%\SysWOW64\NlsData000a\WMVSDECD.exe
- %Windows%\SysWOW64\mscpx32r\drtprov.exe
- %Windows%\SysWOW64\mscat32\odbccp32.exe
- %Windows%\SysWOW64\regini\dhcpcsvc6.exe
- %Windows%\SysWOW64\olecli32\kerberos.exe
- %Windows%\SysWOW64\hid\wship6.exe
(Hinweis: %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.)
Solução
Step 1
Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.
Step 2
Diesen Registrierungswert löschen
Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\odbccp32
- DisplayName = "odbccp32"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\odbccp32
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dsound
- DisplayName = "dsound"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dsound
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\secproc_ssp_isv
- DisplayName = "secproc_ssp_isv"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\secproc_ssp_isv
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\itss
- DisplayName = "itss"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\itss
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winsta
- DisplayName = "winsta"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winsta
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netdiagfx
- DisplayName = "netdiagfx"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netdiagfx
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dhcpcsvc6
- DisplayName = "dhcpcsvc6"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dhcpcsvc6
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\riched32
- DisplayName = "riched32"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\riched32
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirewallControlPanel
- DisplayName = "FirewallControlPanel"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirewallControlPanel
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TCPSVCS
- DisplayName = "TCPSVCS"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TCPSVCS
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kerberos
- DisplayName = "kerberos"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kerberos
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMVSDECD
- DisplayName = "WMVSDECD"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMVSDECD
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nlhtml
- DisplayName = "nlhtml"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nlhtml
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dbghelp
- DisplayName = "dbghelp"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dbghelp
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rasdial
- DisplayName = "rasdial"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rasdial
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fdProxy
- DisplayName = "fdProxy"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fdProxy
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WcnEapAuthProxy
- DisplayName = "WcnEapAuthProxy"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WcnEapAuthProxy
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ncrypt
- DisplayName = "ncrypt"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ncrypt
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmvdsitf
- DisplayName = "dmvdsitf"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmvdsitf
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SensApi
- DisplayName = "SensApi"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SensApi
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdgeoqw
- DisplayName = "kbdgeoqw"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdgeoqw
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wpdwcn
- DisplayName = "wpdwcn"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wpdwcn
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlsData000a
- DisplayName = "NlsData000a"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlsData000a
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\drtprov
- DisplayName = "drtprov"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\drtprov
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\syssetup
- DisplayName = "syssetup"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\syssetup
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mpr
- DisplayName = "mpr"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mpr
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cfgbkend
- DisplayName = "cfgbkend"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cfgbkend
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdprefdrvapi
- DisplayName = "rdprefdrvapi"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdprefdrvapi
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KBDARME
- DisplayName = "KBDARME"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KBDARME
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wship6
- DisplayName = "wship6"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wship6
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlsLexicons0021
- DisplayName = "NlsLexicons0021"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlsLexicons0021
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dxdiagn
- DisplayName = "dxdiagn"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dxdiagn
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storage
- DisplayName = "storage"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storage
- Start = "SERVICE_AUTO_START"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KBDSW09
- DisplayName = "KBDSW09"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KBDSW09
- Start = "SERVICE_AUTO_START"
Step 3
Diese Dateien suchen und löschen
- %Windows%\SysWOW64\framedyn\wpdwcn.exe
- %Windows%\SysWOW64\adprovider\rdprefdrvapi.exe
- %Windows%\SysWOW64\powercfg\dbghelp.exe
- %Windows%\SysWOW64\logoncli\itss.exe
- %Windows%\SysWOW64\newdev\fdProxy.exe
- %Windows%\SysWOW64\dhcpcmonitor\kbdgeoqw.exe
- %Windows%\SysWOW64\mfh264enc\secproc_ssp_isv.exe
- %Windows%\SysWOW64\KBDUKX\NlsLexicons0021.exe
- %Windows%\SysWOW64\Query\riched32.exe
- %Windows%\SysWOW64\ntlanman\TCPSVCS.exe
- %Windows%\SysWOW64\P2PGraph\rasdial.exe
- %Windows%\SysWOW64\NlsData001d\syssetup.exe
- %Windows%\SysWOW64\pku2u\nlhtml.exe
- %Windows%\SysWOW64\NlsData0024\FirewallControlPanel.exe
- %Windows%\SysWOW64\msrepl40\dxdiagn.exe
- %Windows%\SysWOW64\cipher\dmvdsitf.exe
- %Windows%\SysWOW64\vfwwdm32\cfgbkend.exe
- %Windows%\SysWOW64\NlsLexicons001d\KBDSW09.exe
- %Windows%\SysWOW64\netcfgx\storage.exe
- %Windows%\SysWOW64\wmdmps\ncrypt.exe
- %Windows%\SysWOW64\comsnap\SensApi.exe
- %Windows%\SysWOW64\MshtmlDac\dsound.exe
- %Windows%\SysWOW64\scansetting\mpr.exe
- %Windows%\SysWOW64\CPFilters\KBDARME.exe
- %Windows%\SysWOW64\ole2\netdiagfx.exe
- %Windows%\SysWOW64\sechost\WcnEapAuthProxy.exe
- %Windows%\SysWOW64\msports\winsta.exe
- %Windows%\SysWOW64\KBDCA\NlsData000a.exe
- %Windows%\SysWOW64\NlsData000a\WMVSDECD.exe
- %Windows%\SysWOW64\mscpx32r\drtprov.exe
- %Windows%\SysWOW64\mscat32\odbccp32.exe
- %Windows%\SysWOW64\regini\dhcpcsvc6.exe
- %Windows%\SysWOW64\olecli32\kerberos.exe
- %Windows%\SysWOW64\hid\wship6.exe
Step 4
Diese Ordner suchen und löschen
- %Windows%\SysWOW64\regini
- %Windows%\SysWOW64\sechost
- %Windows%\SysWOW64\adprovider
- %Windows%\SysWOW64\NlsData0024
- %Windows%\SysWOW64\ole2
- %Windows%\SysWOW64\logoncli
- %Windows%\SysWOW64\cipher
- %Windows%\SysWOW64\hid
- %Windows%\SysWOW64\mfh264enc
- %Windows%\SysWOW64\NlsLexicons001d
- %Windows%\SysWOW64\ntlanman
- %Windows%\SysWOW64\mscpx32r
- %Windows%\SysWOW64\netcfgx
- %Windows%\SysWOW64\comsnap
- %Windows%\SysWOW64\KBDUKX
- %Windows%\SysWOW64\MshtmlDac
- %Windows%\SysWOW64\P2PGraph
- %Windows%\SysWOW64\CPFilters
- %Windows%\SysWOW64\NlsData001d
- %Windows%\SysWOW64\vfwwdm32
- %Windows%\SysWOW64\msports
- %Windows%\SysWOW64\NlsData000a
- %Windows%\SysWOW64\msrepl40
- %Windows%\SysWOW64\wmdmps
- %Windows%\SysWOW64\dhcpcmonitor
- %Windows%\SysWOW64\newdev
- %Windows%\SysWOW64\Query
- %Windows%\SysWOW64\mscat32
- %Windows%\SysWOW64\scansetting
- %Windows%\SysWOW64\olecli32
- %Windows%\SysWOW64\pku2u
- %Windows%\SysWOW64\KBDCA
- %Windows%\SysWOW64\framedyn
- %Windows%\SysWOW64\powercfg
Step 5
Durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt, und löschen Sie Dateien, die als TrojanSpy.Win32.EMOTET.TIABOFIZ entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.
Step 6
Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.
- %Windows%\SysWOW64\adprovider\rdprefdrvapi.exe:Zone.Identifier
- %Windows%\SysWOW64\P2PGraph\rasdial.exe:Zone.Identifier
- %Windows%\SysWOW64\mscat32\odbccp32.exe:Zone.Identifier
- %Windows%\SysWOW64\msports\winsta.exe:Zone.Identifier
- %Windows%\SysWOW64\ntlanman\TCPSVCS.exe:Zone.Identifier
- %Windows%\SysWOW64\scansetting\mpr.exe:Zone.Identifier
- %Windows%\SysWOW64\msrepl40\dxdiagn.exe:Zone.Identifier
- %Windows%\SysWOW64\cipher\dmvdsitf.exe:Zone.Identifier
- %Windows%\SysWOW64\pku2u\nlhtml.exe:Zone.Identifier
- %Windows%\SysWOW64\olecli32\kerberos.exe:Zone.Identifier
- %Windows%\SysWOW64\vfwwdm32\cfgbkend.exe:Zone.Identifier
- %Windows%\SysWOW64\hid\wship6.exe:Zone.Identifier
- %Windows%\SysWOW64\NlsData000a\WMVSDECD.exe:Zone.Identifier
- %Windows%\SysWOW64\framedyn\wpdwcn.exe:Zone.Identifier
- %Windows%\SysWOW64\Query\riched32.exe:Zone.Identifier
- %Windows%\SysWOW64\MshtmlDac\dsound.exe:Zone.Identifier
- %Windows%\SysWOW64\KBDCA\NlsData000a.exe:Zone.Identifier
- %Windows%\SysWOW64\ole2\netdiagfx.exe:Zone.Identifier
- %Windows%\SysWOW64\powercfg\dbghelp.exe:Zone.Identifier
- %Windows%\SysWOW64\regini\dhcpcsvc6.exe:Zone.Identifier
- %Windows%\SysWOW64\KBDUKX\NlsLexicons0021.exe:Zone.Identifier
- %Windows%\SysWOW64\logoncli\itss.exe:Zone.Identifier
- %Windows%\SysWOW64\wmdmps\ncrypt.exe:Zone.Identifier
- %Windows%\SysWOW64\dhcpcmonitor\kbdgeoqw.exe:Zone.Identifier
- %Windows%\SysWOW64\NlsLexicons001d\KBDSW09.exe:Zone.Identifier
- {malware file path and name}
- %Windows%\SysWOW64\comsnap\SensApi.exe:Zone.Identifier
- %Windows%\SysWOW64\NlsData001d\syssetup.exe:Zone.Identifier
- %Windows%\SysWOW64\newdev\fdProxy.exe:Zone.Identifier
- %Windows%\SysWOW64\mfh264enc\secproc_ssp_isv.exe:Zone.Identifier
- %Windows%\SysWOW64\mscpx32r\drtprov.exe:Zone.Identifier
- %Windows%\SysWOW64\NlsData0024\FirewallControlPanel.exe:Zone.Identifier
- %Windows%\SysWOW64\sechost\WcnEapAuthProxy.exe:Zone.Identifier
- %Windows%\SysWOW64\netcfgx\storage.exe:Zone.Identifier
- %Windows%\SysWOW64\CPFilters\KBDARME.exe:Zone.Identifier
Participe da nossa pesquisa!