作者decorum (Brave New World)
看板AntiVirus
标题Re: [问题] SLATKO\torta.exe
时间Fri Jan 29 22:08:11 2010
※ 引述《decorum (Brave New World)》之铭言：
: 在随身碟上发现的，应该是在图书馆看资料库，存取资料时感染的，
: 会在随身碟上显示出一个资源回收桶。google 了一下，发现讨论的人很少，
: 而且没什麽结论：
: http://forum.avast.com/index.php?action=printpage;topic=53297.0
: 不知道有什麽损害。早上用 xpe 开机，把 autorun.ini 和 SLATKO 目录
: 砍了，不知道算了帐了吗？
Symantec 有这个木马的资讯了。 会开後门，监视网路浏览活动，
并盗取密码。google 查到的资讯只有700多条，但是我跟学校
图书馆说机器中标，已经过了几个星期，他们也还没处理！
http://www.symantec.com/security_response/writeup.jsp?
docid=2010-011915-4635-99&tabid=2
Discovered: January 19, 2010
Updated: January 19, 2010 5:21:37 PM
Type: Worm
Infection Length: 142,848 bytes
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows
Vista, Windows NT, Windows Server 2003, Windows 2000
When the worm is executed, it creates the following files:
%SystemDrive%\RECYCLER\[SID]\nissan.exe
%SystemDrive%\RECYCLER\[SID]\Desktop.ini
%DriveLetter%\RECYCLER\[SID]\csrxx.exe (W32.IRCBot)
%DriveLetter%\SLATKO\torta.exe
%DriveLetter%\SLATKO\Desktop.ini
%DriveLetter%\autorun.inf
It then creates the following registry entry, so that it starts when Windows
starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\"Taskman" = "C:\RECYCLER\[SID]\nissan.exe"
The worm then opens a back door and connects to the following domains on UDP
port 25000:
sandra.prichaonica.com
pica.banjalucke-ljepotice.ru
l33t.brand-clothes.net
The worm also copies itself to the shared folder of the following
file-sharing programs:
Ares
BearShare
iMesh
Shareaza
Kazaa
DC++
eMule
LimeWire
It then monitors browsing activities, logging passwords stored in the
browsers.
The worm will send messages through Microsoft instant messaging programs,
such as MSN Messenger and Windows Live Messenger, that include a link to
download the worm.
--
There are a lot things we don't want to know about the people we love.
--- Chuck Palahniuk
--
※ 发信站: 批踢踢实业坊(ptt.cc)
◆ From: 203.67.147.36