NEUREVT
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Type de grayware:
Backdoor
Destructif:
Non
Chiffrement:
In the wild::
Oui
Overview
Détails techniques
Installation
Schleust die folgenden Eigenkopien in das betroffene System ein:
- %Program Files%\Common Files\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe
- %Program Files%\Common Files\Identities.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe
(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.)
Andere Systemänderungen
Fügt die folgenden Registrierungsschlüssel hinzu:
HKEY_CLASSES_ROOT\CLSID\{CLSID}
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
0BAC02C7
HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\TaskManager
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CS1
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CW1
HKEY_CURRENT_USER\Software\Win7zip
HKEY_LOCAL_MACHINE\SOFTWARE\Win7zip
Fügt die folgenden Registrierungseinträge hinzu:
HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\TaskManager
Task Service ID = "{hex value}"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
Flash Update Client = "%Program Files%\Common Files\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Flash Update Client = "%Program Files%\Common Files\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Flash Update Client = "%Program Files%\Common Files\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
2500 = "3"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\2
2500 = "3"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
2500 = "3"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\4
2500 = "3"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
{application}
Debugger = "{random characters}.exe"
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
GLA = "{hex value}"
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
LCT = "{hex value}"
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
LSF = "{hex value}"
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
CF03 = "{hex value}"
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CS1
SO3 = "{hex value}"
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CW1
1480 = "{hex value}"
HKEY_CURRENT_USER\Software\Win7zip
Uuid = "{hex value}"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Device Installer = "{malware path and file name}"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Device Installer = "{malware path and file name}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Device Installer = "{malware path and file name}"
HKEY_LOCAL_MACHINE\SOFTWARE\Win7zip
Uuid = "{hex value}"
HKEY_CURRENT_USER\Software\Win7zip
Uuid = "{hex value}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
nvtrays = "%Program Files%\Common Files\Identities.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe"
Ändert die folgenden Registrierungseinträge:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"
(Note: The default value data of the said registry entry is "1".)
HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\
Java Update\Policy
EnableJavaUpdate = "0"
(Note: The default value data of the said registry entry is "1".)