TROJ64_WHAIM.A

Wird möglicherweise von anderer Malware eingeschleust.

Übertragungsdetails

Wird möglicherweise von der folgenden Malware eingeschleust:

• TROJ_WHAIM.A

Installation

Schleust die folgenden Eigenkopien in das betroffene System ein:

• %System%\{random file name}.dll
  where {random file name} can be any of the following:
  • bddsvc.dll
  • iconsvc.dll
  • ehressvc.dll
  • netstsvc.dll
  • pnas.dll
  • pnrpmchname.dll
  • pwpsvc.dll
  • pcssvc.dll
  • rregconf.dll
  • scardmngsvc.dll
  • tcpmsvc.dll
  • tschmng.dll
  • mmthread.dll
  • wcmngsvc.dll
  • coladj.dll
  • wndmodmng.dll
  • timesyncsvc.dll
  • wiredconfsvc.dll
  • wlanconf.dll
  • wstmng.dll

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows XP und Server 2003.)

Autostart-Technik

Registriert die eigene eingeschleuste Komponente als Systemdienst, um zu gewährleisten, dass diese bei jedem Systemstart automatisch ausgeführt wird. Erstellt dafür die folgenden Registrierungseinträge:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{service name}
ImagePath = "%SystemRoot%\System32\svchost.exe -k {random service name}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{service name}
DisplayName = "{display name}"
where {display name} can be any of the following:

• BitLocker Drive Decryption Service
• Internet Connection Service
• Media Center Service
• Network Storage Service
• Peer Networking Address
• PNRP Machine Name
• Power Policy
• Program Compatibility Service
• Remote Registry Configuration
• Smart Card Management Service
• Tablet PC Management Service
• Task Schedule Manager
• Thread Ordering Service
• WebClient Manage Service
• Windows Color Adjustment
• Windows Modules Management
• Windows Time Synchronization
• Wired Config Service
• WLAN Config Service
• Workstation management

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{service name}
Description = "{service description}"
where {service description} can be any of the following:

• BDESVC hosts the BitLocker Drive Decryption service.
• Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.
• Allows Media Center to locate and connect to the computer.
• This service delivers network notifications (e.
• Enables multi-party communication using Peer-to-Peer Connecting.
• This service publishes a machine name using the Peer Name Resolution Protocol.
• Manages power policy and power policy notification delivery.
• This service provides support for the Program Compatibility Assistant (PCA).
• Enables remote users to modify registry configurations on this computer.
• Manages access to smart cards read by this computer.
• Enables Tablet PC pen and ink functionality
• Enables a user to configure and schedule automated tasks on this computer.
• Provides ordered execution for a group of threads within a specific period of time.
• Enables Windows-based programs to create, access, and modify Internet-based files.
• The WcasPlugInService service hosts third-party Windows Color System color device model and gamut map model plug-in modules.
• Enables installation, modification, and removal of Windows updates and optional components.
• Maintains date and time synchronization on all clients and servers in the network.
• The Wired AutoConfig (DOT3SVC) service is responsible for performing IEEE 802.1X
• Creates and maintains client network connections to remote server using the SMB protocol