TROJ_SRIZBI.BY

Agrega determinadas entradas de registro para desactivar el Administrador de tareas. Esta acción impide que el usuario lleve a cabo la cancelación del proceso de malware, la cual suele realizarse a través del Administrador de tareas.

Instalación

Infiltra los archivos siguientes:

• %Current Folder%\userid.dat

Técnica de inicio automático

Agrega las siguientes entradas de registro para permitir su ejecución automática cada vez que se inicia el sistema:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
mscj = "{malware path and file name}"

Otras modificaciones del sistema

Agrega las siguientes entradas de registro para desactivar el Administrador de tareas:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

Rutina de descarga

Accede a los siguientes sitios Web para descargar archivos:

• http://1.images.{BLOCKED}ost1.com/tps/thumbs/{random folder 1}/{random folder 2}/{random characters}.jpg
• http://{BLOCKED}6.{BLOCKED}0.167.37/{BLOCKED}ovideo.com/{random characters}.jpg
• http://{BLOCKED}9.{BLOCKED}5.10.99/st/thumbs/{random folder name}/{random characters}.jpg
• http://{BLOCKED}4.{BLOCKED}6.167.150/nitro/teens/{random characters}.jpg
• http://{BLOCKED}4.{BLOCKED}6.167.152/nitro/mix/{random characters}.jpg
• http://{BLOCKED}4.{BLOCKED}6.167.152/nitro/teens/{random characters}.jpg
• http://{BLOCKED}4.{BLOCKED}6.167.154/nitro/mix/{random characters}.jpg
• http://{BLOCKED}4.{BLOCKED}6.167.156/nitro/mix/{random characters}.jpg
• http://8.images.{BLOCKED}ost1.com/tps/thumbs/008/240x180/{random characters}.jpg
• http://9.images.{BLOCKED}st1.com/tps/thumbs/009/240x180/{random characters}.jpg
• http://{BLOCKED}9.{BLOCKED}2.165.53/nitro/teens/{random characters}.jpg
• http://{BLOCKED}xclips.com/ftt2/check.php?{random characters}
• http://{BLOCKED}xclips.com/ftt2/toplists/img/{random characters}.jpg
• http://{BLOCKED}-vids.com/ban/{random characters}.gif
• http://{BLOCKED}ro-{BLOCKED}ising.com/datanew/thumbs/{random folder}/{random characters}.jpg
• http://{BLOCKED}xshow.com/{random characters}
• http://{BLOCKED}orn.com/streamrotator/thumbs/c/{random characters}.jpg
• http://i.{BLOCKED}36.com/sr/thumbs/{random folder}/{random characters}.jpg
• http://{BLOCKED}2.vidz.com/thumbs/{random characters}.jpg
• http://img.{BLOCKED}xshow.com/newgalls/th3/{random characters}.jpg
• http://img.{BLOCKED}xshow.com/th1/{random characters}.jpg
• http://img.{BLOCKED}rn-video.com/A/{random characters}.jpg
• http://img1.{BLOCKED}xclips.com/st/thumbs/{random folder}/{random characters}.jpg
• http://{BLOCKED}00.{BLOCKED}s.com/videos/thumbslll/{random characters}.jpg
• http://{BLOCKED}2.{BLOCKED}xclips.com/st/thumbs/{random folder}/{random characters}.jpg
• http://{BLOCKED}oo.com/thumb/{random characters}.jpg
• http://{BLOCKED}sgall.com/images/{random characters}.jpg
• http://{BLOCKED}sgall.com/newcj/out.php
• http://{BLOCKED}sgall.com/{random characters}.jpg
• http://{BLOCKED}vies.com/cj_out.php?{random characters}
• http://{BLOCKED}vies.com/thumb/{random characters}
• http://{BLOCKED}bmovies.net//cgi-bin/at3/out.cgi?{random characters}
• http://{BLOCKED}bmovies.net/streamrotator/out.php?{random characters}
• http://{BLOCKED}bmovies.net/streamrotator/thumbs/{random folder}/{random characters}.jpg
• http://{BLOCKED}teronline.in/?aid=244&si=726050&rd=20101229095920&{random characters}
• http://s10.{BLOCKED}ts.com/js9.js
• http://s4.{BLOCKED}ts.com/stats/0.php?312801&@f16&@g1&@h1&@i1&@j1293588537640&@k0&@l1&@mTeens%20Juice%20Movies%20Udated%20Daily&@n0&@o1000&@q0&@r0&@s0&@ten-us&@u1123&@vhttp%3A%2F%2Fwww.{BLOCKED}juice.com%2Findex1.shtml&@w
• http://s4.{BLOCKED}ts.com/stats/e.php?312801&@Ab&@R30852&@w
• http://{BLOCKED}ic.{BLOCKED}os.com/{random characters}
• http://{BLOCKED}eteenies.com/cgi-bin/at3/out.cgi?id=164&l=toplist2&880&trade=http://zoo-sex-porn.com/
• http://{BLOCKED}eteenies.com/st/stt.php?aid=244&from=cnhjb3VudGVyb25saW5lLmlu&32075
• http://{BLOCKED}ealthy-place.com/tds/in.cgi?9
• http://{BLOCKED}ro.biz/{random characters}
• http://{BLOCKED}unts.com/cgi-bin/at3/out.cgi?{random characters}
• http://{BLOCKED}unts.com/st/stt.php?{random characters}
• http://{BLOCKED}ma.com/cgi-bin/at3/out.cgi?{random characters}
• http://{BLOCKED}ma.com/st/stt.php?{random characters}
• http://{BLOCKED}-design.net/ts/in.cgi?asfalt
• http://video.{BLOCKED}vs.com/video678880/0/video_store_incident
• http://www.{BLOCKED}eo.com/seo.php?username=Lelik
• http://www.{BLOCKED}36.com/{random characters}
• http://www.{BLOCKED}esex.com/{random characters}
• http://www.{BLOCKED}-vids.com/ban/{random characters}.gif
• http://www.{BLOCKED}hthot.com/images/{random characters}.gif
• http://www.{BLOCKED}nthumbs.com/buttons/new-button-4.gif
• http://www.{BLOCKED}sex365.com/galleries/dog/7fw/{random characters}.jpg
• http://www.{BLOCKED}movs.com/out.php?urls=http://video.milfmovs.com/video678880/0/video_store_incident
• http://www.{BLOCKED}nvids.com/niches/{random characters}.php
• http://www.{BLOCKED}ovideo.com/{random characters}
• http://www.{BLOCKED}ktubes.com/{random characters}
• http://www.{BLOCKED}avids.com/images/{random characters}.jpg
• http://www.{BLOCKED}vids.com/streamrotator/thumbs/a/{random characters}.jpg
• http://www.{BLOCKED}wn.com/65/nua.php
• http://www.{BLOCKED}ill.com/{random characters}
• http://www.{BLOCKED}ice.com/{random characters}
• http://www.{BLOCKED}older.com/in/in.php?agent1510
• http://www.{BLOCKED}be.tv/wtf/{random characters}.jpg
• http://www.{BLOCKED}vs.com/{random characters}
• http://{BLOCKED}yhole.com/{random characters}
• http://{BLOCKED}tic.com/ydd/images/{random characters}.jpg
• http://{BLOCKED}-video.com/free/{random characters}/index.html
• http://{BLOCKED}orn.com/cj_out.php?thumb={random characters}.jpg&url=http://galls.forbiddenmovs.in/{random characters}.html
• http://{BLOCKED}orn.com/thumb/{random characters}.jpg
• http://{BLOCKED}ils.com/images/{random characters}.gif