Plate-forme:

Windows 2000, Windows XP, Windows Server 2003

 Overall Risk:
 Dommages potentiels: :
 Distribution potentielle: :
 reportedInfection:
Faible
Medium
Élevé
Critique

  • Type de grayware:
    File infector

  • Destructif:
    Non

  • Chiffrement:
     

  • In the wild::
    Oui

  Overview

Voie d'infection: Infiziert Dateien, Verbreitet sich über Wechseldatenträger, Verbreitet sich über Netzwerkfreigaben, Aus dem Internet heruntergeladen


  Détails techniques

Memory resident: Oui
Charge malveillante: Connects to URLs/IPs, Modifies HOSTS file, Terminates processes

Installation

Schleust die folgenden Dateien ein:

  • %System%\vcmgcd32.dll
  • %System%\vcmgcd32.dl_
  • {drive letter}:\ autorun.inf
  • %System%\drivers\{random file name}.sys

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows XP und Server 2003.)

Schleust die folgenden Eigenkopien in das betroffene System ein:

  • {drive letter}:\{random}.exe/cmd/pif
  • {drive letter}:\{malware file name}.exe

Andere Systemänderungen

Fügt die folgenden Registrierungsschlüssel hinzu:

HKEY_CURRENT_USER\Software\{random}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG

Fügt die folgenden Registrierungseinträge hinzu:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
system
DisableRegistryTools = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
system
DisableTaskMgr = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSetServices\
SharedAccess\ParametersFirewallPolicy\StandardProfile
DisableNotifications = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSetServices\
SharedAccess\ParametersFirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSetServices\
SharedAccess\ParametersFirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
{malware path and name} = "{malware path and name}:*:Enabled:{infected file name}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{malware path and name} = "{malware path and name}:*:Enabled:ipsec"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\{random}
DisplayName = "{random}"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\{random}
ErrorControl = "1"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\{random}
ImagePath = "\??\%System%\drivers\{random file name}.sys"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\{random}
Start = "3"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\{random}
Type = "1"

Ändert die folgenden Registrierungsschlüssel/-einträge während der eigenen Installation:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UacDisableNotify = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = "4"

(Note: The default value data of the said registry entry is 2.)

Löscht die folgenden Registrierungsschlüssel:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\SafeBoot\Minimal

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\SafeBoot\Network