��

�� .

mybb@mybb.ru (GuDwin2610) — Thu, 14 Feb 2013 16:56:28 +0400

�� , �� , �� , �� - �� , �� , �� , �� , �� , �� , � �� - �� . �� 2 iframe , �� , �� - �� , �� . ��. �� . �� ( �� , �� ) wwwskript.info.ms , �� !!!!

��

mybb@mybb.ru (qwa) — Wed, 25 Feb 2009 16:47:12 +0300

***

Trojan-Downloader.JS.Agent.sv

mybb@mybb.ru (qwa) — Sun, 12 Oct 2008 13:17:24 +0400

�� : .bnc, .bxr, .ex, .mp
��

�� , �� . �� Java Script. �� 6497 ��.
��

�� , � �� URL ��:
http://NoP.gs/***/t368.gif
http://NoP.gs/***/t368ok.gif
http://NoP.gs/***/Link368.gif
http://NoP.gs/***/reader368.gif
http://NoP.gs/***/Go368.gif

��

�� , �� :

1. �� (�� , �� ).
2. �� %Temporary Internet Files%.
3. �� ActiveX �� (�� ActiveX � �� Internet Explorer).
�� http://www.viruslist.com/ru/viruses/enc … sid=219589

Trojan-Downloader.JS.Agent.mp

mybb@mybb.ru (qwa) — Sun, 12 Oct 2008 13:15:32 +0400

�� : .bnc, .bxr, .ex, .sv
��
��, �� . �� Java Script. �� 9656 ��.
��

�� , �� :

{BD96C556-65A3-11D0-983A-00C04FC29E30}
{BD96C556-65A3-11D0-983A-00C04FC29E36}
{AB9BCEDD-EC7E-47E1-9322-D4A210617116}
{0006F033-0000-0000-C000-000000000046}
{0006F03A-0000-0000-C000-000000000046}
{6e32070a-766d-4ee6-879c-dc1fa91d2fc3}
{6414512B-B978-451D-A0D8-FCFDF33E833C}
{7F5B7F63-F06F-4331-8A26-339E03C0AE3D}
{06723E09-F4C2-43c8-8358-09FCD1DB0766}
{639F725F-1B2D-4831-A9FD-874847682010}
{BA018599-1DB3-44f9-83B4-461454C84BF8}
{D0C07D56-7C69-43F1-B4A0-25F5A11FAB19}
{E8CCCDDF-CA28-496b-B050-6C07C962476B}

�� ActiveX-�� WinZIP FileView�, �QuickTime�, �WebViewFolderIcon�, � �� MS Internet Explorer � �Msdds.dll�.

�� ActiveX-�� XMLHTTP� �� URL:

--.***/file.php

�� ADODB.Stream�, �� : �� sys<rnd>.exe� (�� <rnd> � �� , �� ):

�:\sys.exe

�� Windows �� ~.exe�:

%System%\~.exe

� �cpu.exe�:

%System%\cpu.exe

�� , �� , �� , � �� tm.exe�.

�� .
��

�� , �� :

1. �� (�� , �� ).
2. �� :

�:\sys<rnd>.exe
%System%\~.exe
%System%\cpu.exe
<...>/tm.exe

�� http://www.viruslist.com/ru/viruses/enc … d=21780349

Trojan-Downloader.JS.Agent.ex

mybb@mybb.ru (qwa) — Sun, 12 Oct 2008 13:11:44 +0400

�� : .bnc, .bxr, .mp, .sv
��
�� , �� . �� JavaScript. �� 7 �� 19 ��.
��

�� , �� :

http://www.tankersite.com/1/*****/zerr.exe

�� C:\1.exe� � �� .
��

�� , �� :

1. �� (�� , �� ).
2. �� :

C:\1.exe

�� http://www.viruslist.com/ru/viruses/enc … sid=158371

Trojan-Downloader.JS.Agent.bnc

mybb@mybb.ru (qwa) — Sun, 12 Oct 2008 13:08:16 +0400

�� : .bxr, .ex, .mp, .sv
��

�� , �� . �� html-��, �� Java Script. �� 1527 ��.
��

�� , �� :
{BD96C556-65A3-11D0-983A-00C04FC29E36}

�� ActiveX �� "Microsoft.XMLHTTP", �� URL:
http://www.mbspro*****.com/naizi/xia.exe

�� 45717 �� Trojan-Downloader.Win32.Delf.jfj.

�� ActiveX �� "ADODB.Stream", �� Windows �� "~Temp.tmp" (�� - �� 1 �� 9999):
%WinDir%\~Temp.tmp

�� .
��

�� , �� :

1. �� ( "�� ") �� :
~Temp.tmp
2. �� (�� , �� ).
3. �� :
%WinDir%\~Temp.tmp
4. �� %Temporary Internet Files%.
5. �� ActiveX ��.
�� http://www.viruslist.com/ru/viruses/enc … sid=313461

Trojan-Downloader.JS.Agent.bxr

mybb@mybb.ru (qwa) — Sun, 12 Oct 2008 13:06:10 +0400

�� : .bnc, .ex, .mp, .sv

��

�� , �� . �� Java Script. �� 1159 ��.
��

�� :
http://veryblomar.com/*****/load.php

�� :
%Documents and Settings%\Local settings\Temporary Internet Files\svchosts.exe

�� .

�� .
��

�� , �� :

1. �� <�� > �� .
2. �� (�� , �� ).
3. �� :
%Documents and Settings%\Local settings\Temporary Internet Files\svchosts.exe
�� http://www.viruslist.com/ru/viruses/enc … d=21782521

Win32.Alman

mybb@mybb.ru (qwa) — Sun, 12 Oct 2008 13:01:21 +0400

(BackDoor.Generic6.REC, Generic4.I, PE_CORELINK.A-O, PE_CORELINK.C, Rootkit.Win32.Agent.ev, Rootkit.Win32.Agent.ga, TROJ_AGENT.THK, TROJ_CORELINK.A, Trojan.Rootkit.AY, Virus.Win32.Alman.a, Virus.Win32.Alman.b, W32/Backdoor.AMKY, Win32.Almanahe.B, Win32/Alman, Win32/Almanahe, Win32/Almanahe!generic, Win32/Almanahe.A, Win32/Almanahe.F)
�� Dr.Web: 2007-06-08 17:12
�� : ��

��:

�� : Win NT-based

��: -

��

�� : %windir%\linkinfo.dll, %systemroot%\system32\drivers\nvmini.sys � �� %systemroot%\system32\drivers\IsDrv118.sys.

�� , �� , �� boot.exe � autorun.inf.

�� , �� :

nvmini.sys
linkinfo.dll
autorun.inf
boot.exe

� �� "nvmini".

�� (�� ):

ISPUBDRV
ISDRV1
RKREVEAL
PROCEXP
SAFEMON
RKHDRV10
NPF
IRIS
NPPTNT
DUMP_WMIMMC
SPLITTER
EAGLENT

�� , �� KeServiceDescriptorTable.

�� :

DLLWM.DLL
DLLHOSTS.DLL
NOTEPAD.DLL
RPCS.DLL
RDIHOST.DLL
RDFHOST.DLL
RDSHOST.DLL
LGSYM.DLL
RUND11.DLL
MDDDSCCRT.DLL
WSVBS.DLL
CMDBCS.DLL
RICHDLL.DLL
WININFO.RXK
WINDHCP.DLL
UPXDHND.DLL

�� Explorer.exe

�� %windir%\AppPatch\AcLue.dll

�� , �� , �� SFC �� :

\QQ
\WINNT\
\WINDOWS\
LOCAL SETTINGS\TEMP\

�� :

zhengtu.exe
audition.exe
kartrider.exe
nmservice.exe
ca.exe
nmcosrv.exe
nsstarter.exe
maplestory.exe
neuz.exe
zfs.exe
gc.exe
mts.exe
hs.exe
mhclient-connect.exe
dragonraja.exe
nbt-dragonraja2006.exe
wb-service.exe
game.exe
xlqy2.exe
sealspeed.exe
asktao.exe
dbfsupdate.exe
autoupdate.exe
dk2.exe
main.exe
userpic.exe
zuonline.exe
config.exe
mjonline.exe
patcher.exe
meteor.exe
cabalmain.exe
cabalmain9x.exe
cabal.exe
au_unins_web.exe
xy2.exe
flyff.exe
xy2player.exe
trojankiller.exe
patchupdate.exe
ztconfig.exe
woool.exe
wooolcfg.exe

�� :

sxs.exe
lying.exe
logo1_.exe
logo_1.exe
fuckjacks.exe
spoclsv.exe
nvscv32.exe
svch0st.exe
c0nime.exe
iexpl0re.exe
ssopure.exe
upxdnd.exe
wdfmgr32.exe
spo0lsv.exe
ncscv32.exe
iexplore.exe
iexpl0re.exe
ctmontv.exe
explorer.exe
internat.exe
lsass.exe
smss.exe
svhost32.exe
rundl132.exe
msvce32.exe
rpcs.exe
sysbmw.exe
tempicon.exe
sysload3.exe
run1132.exe
msdccrt.exe
wsvbs.exe
cmdbcs.exe
realschd.exe

�� , �� Administrator, �� :

""
"admin"
"1"
"111"
"123"
"aaa"
"12345"
"123456789"
"654321"
"!@#$"
"asdf"
"asdfgh"
"!@#$%"
"!@#$%^"
"!@#$%^&"
"!@#$%^&*"
"!@#$%^&*("
"!@#$%^&*()"
"qwer"
"admin123"
"love"
"test123"
"owner"
"mypass123"
"root"
"letmein"
"qwerty"
"abc123"
"password"
"monkey"
"password1"

� �� setup.exe � �� .

�� , ��:
Trojan.PWS.Gamania.4375,Trojan.PWS.Wow.632, Trojan.PWS.Legmir.1949
�� http://vms.drweb.com/virus/?i=154207

Trojan.Packed.142

mybb@mybb.ru (qwa) — Sat, 11 Oct 2008 17:40:35 +0400

(Downloader.Tibs.5.BI, Downloader.Tibs.5.BJ, Email-Worm.Win32.Zhelatin.fc, Email-Worm.Win32.Zhelatin.fk, Email-Worm.Win32.Zhelatin.fl, Packed.Win32.Tibs.ab, Packed.Win32.Tibs.al, Packed.Win32.Tibs.an, Possible_Nucrp-3, SpamTool.Win32.Agent.af, TROJ_PACKED.JW, TROJ_SMALL.FYT, TROJ_SMALL.KAC, TROJ_TIBS.AKK, Trojan-Downloader.Win32.Tibs.mq, Trojan.Peed.HYP, Trojan.Peed.HYR, Trojan.Peed.OK, Trojan.Peed.OL, Trojan.Peed.ON, Trojan.Peed.OP, Virus.Win32.KME, W32/Tibs.TV, Win32/Sinteri!downloader, Win32/Sintun)
�� : �� , �� , � �� . �� BackDoor.Groan
�� http://vms.drweb.com/virus/?i=157409

Trojan.PWS.GoldSpy

mybb@mybb.ru (qwa) — Sat, 11 Oct 2008 17:17:11 +0400

(Backdoor.Win32.Agent.ky, Generic PWS.o, PWS-Banker.an, PWS-Goldun, PWS-Goldun.dll, PWS-Goldun.dr, PWS-Goldun.sys, PWSteal.Raidys, PWSteal.Trojan, Spy-Agent.k, Trojan Horse, Trojan-Spy.Win32.Banker.aft, Trojan-Spy.Win32.Goldun.az, Trojan-Spy.Win32.Goldun.bw, Trojan-Spy.Win32.Goldun.cj, Trojan-Spy.Win32.Goldun.dc, Trojan-Spy.Win32.Goldun.ds, Trojan-Spy.Win32.Goldun.dt, Trojan-Spy.Win32.Goldun.fo, Trojan-Spy.Win32.Goldun.gt, Trojan.Bankem, Trojan.Goldun, Win32/Goldun.82660!Trojan, Win32/Haxdoor.Variant!Trojan)
�� : ��
�� : Win NT-based
��: �� 8 - 50 ��
��: FSG, UPX, PECRYPT, MEW

��

* �� , �� (��).

* �� , � �� , �� :
1) �� , �� Internet Explorer (iexplore.exe - c:\Program Files\Internet Explorer\). �� , �� Internet Explorer.

2) �� Winsdows (%systemroot%\system32) �� (�� Internet Explorer) � �� .

* �� Windows, �� :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs: "[path-to-goldspy-dll]"

* �� HTTP-��, �� , �� Trojan.PWS.GoldSpy. �� .
�� http://vms.drweb.com/virus/?i=9582

VBS.Generic.544

mybb@mybb.ru (qwa) — Sat, 11 Oct 2008 17:14:06 +0400

(INF/Slogod.A, VBS.Flesh.A, VBS/Butsur, VBS/IE-Title, VBS/Slogod, VBS/Solow, VBS_SOLOW.A, Worm.VBS.Solow.A, Worm.VBS.Solow.a)
�� : ��, �� Visual Basic Script

�� : Win95/98/Me/2000/XP

�� : 1 906, 3 642

��: Unicode

��

# �� .

# �� :

1. �� Windows � �� MS32DLL.dll.vbs � �� "��".
2. �� autorun.inf, � �� MS32DLL.dll.vbs �� . �� , � �� "��".
3. �� MS32DLL.dll.vbs � autorun.inf �� flash-��, �� .
4. �� :

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS32DLL

C:\WINDOWS\MS32DLL.dll.vbs
�� VBS.Generic.544 �� :

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fucker C:\WINDOWS\fucker.vbs

5. �� Internet Explorer �� "Hacked by Godzilla".
�� VBS.Generic.544 �� "Hacked by Godzilla" �� "Malaysian Hackers"

��

�� :

--8<------------------------------------------------------------------
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="about:blank"
"Window Title"=-

--8<------------------------------------------------------------------

�� .reg-��, �� . �� .
�� http://vms.drweb.com/virus/?i=133546

VBS.Generic.536

mybb@mybb.ru (qwa) — Sat, 11 Oct 2008 17:10:04 +0400

(Email-Worm.VBS.Small.e, VBS.Mailer.Gen, I-Worm.VBS.virus, VBS/GenMail.A, VBS.Alein@mm)
�� : �� , �� Visual Basic Script
�� : Win95/98/Me/2000/XP
�� : �� 5 ��
��: ��

��

�� C:\Windows\System �� Gigabyte.vbs.
�� , �� :
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Gigabyte �
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Gigabyte

�� - �� MS Outlook, �� :

1. �� RegEdit.
2. �� (�� Win9x).
3. �� : ��, �� , ��, ��, �� .�.
4. �� (�� Win9x).
5. �� .
6. �� Documents and Settings.
7. �� (�� Win9x).
8. �� .

�� , �� , � �� .
�� http://vms.drweb.com/virus/?i=114360

Win32.HLLW.Gavir.ini

mybb@mybb.ru (qwa) — Sat, 11 Oct 2008 15:38:20 +0400

(W32/HLLP.Philis.ini)

�� , �� _desktop.ini. �� Win32.HLLW.Gavir �� .
�� http://vms.drweb.com/virus/?i=135553

Win32.HLLP.Neshta

mybb@mybb.ru (qwa) — Fri, 10 Oct 2008 21:30:37 +0400

(PE_NESHTA.A, Virus.Win32.Neshta.a, W32.Neshuta, W32/Generic.Delphi.c, W32/HLLP.41472, W32/HLLP.41472 - Packed, Win32.Neshta.A)

�� Dr.Web: 2005-12-01 18:25:00

��

Win32.HLLP.Neshta - �� . �� Borland Delphi. �� 41472 ��.

��

�� EXE PE, �� 41472 ��.
�� , � �� . �� (�� 1000 ��) ��.

�� windows �� svchost.com.

�� :
Neshta 1.0 Made in Belarus.
�� http://vms.drweb.com/virus/?i=468

�� Dr. Web

mybb@mybb.ru (qwa) — Wed, 08 Oct 2008 17:25:17 +0400

�� Dr. Web

�� � �������

�������� ������� ����������� ���� .

�������� ���������

Trojan-Downloader.JS.Agent.sv

Trojan-Downloader.JS.Agent.mp

Trojan-Downloader.JS.Agent.ex

Trojan-Downloader.JS.Agent.bnc

Trojan-Downloader.JS.Agent.bxr

Win32.Alman

Trojan.Packed.142

Trojan.PWS.GoldSpy

VBS.Generic.544

VBS.Generic.536

Win32.HLLW.Gavir.ini

Win32.HLLP.Neshta

����������� Dr. Web

��

�� .

��

�� Dr. Web