• Ǽڵ DB / ̷ DB Ʈ Ȳ
  • ټ Ʈ ǽϰ Ǽڵ ߻ żϰ ߰ Ʈ ǽϰ ֽϴ.
    ڵ Ʈ ̿Ͻø ϰ Ʈ ֽϴ.
̸ Backdoor-W32/IRCBot.14848.B
̷ Backdoor ȯ Windows
Ȯ ޽
MSN ޽ ؼ ĵǸ ý ý Ǽڵ带 Ѵ.
ġ ͺ ǰ /ġ մϴ.

󼼼  /ġ

*


MSN
޽ ĵȴ.



*

 

 photo album.zip ̶ ϸ msn޽ ȮǸ photo album.zip ϼӿ photo album.pif Ǿ ִ.

 

  ϸ ý photo album.zip, rdshost.dll Ѵ.

msn ޽ .

 

      -      lol my sister wants me to send you this photo album 

-         HEY lol i''''''''ve done a new photo album !:) Second ill find file and send you it.  

-          - Hey wanna see my new photo album?  

-         OMG just accept please its only my photo album!!

-         Hey accept my photo album, Nice new pics of me and my friends and stuff and when i was young lol... 

- Hey just finished new photo album! :) might be a few nudes ;) lol...     

- hey you got a photo album? anyways heres my new photo album :) accept k?     

- hey man accept my new photo album.. :( made it for yah, been doing picture story of my life lol..

 

 

-

 

Backdoor Ǹ, Ϲ photo album.zip ġ ȴ
-
photo album.pif(Backdoor-W32/IRCBot.18944.C) Ǿ

 

- ?

-          95/98/ME/XP  - C:\Windows\

-          NT/2000       -C:\WinNT\

 

Backdoor Ǹ, Ϲ ý rdshost.dll(Backdoor-W32/IRCBot.14848.B) ġ ȴ


-
ý ?

-          95/98/ME     - C:\Windows\System,

-          NT/2000      -C:\WinNT\System32

-          XP           - C:\Windows\System32

 

 

-Ʈ .


ý ڽ Ʈ ý ǵ Ѵ.


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ ShellServiceObjectDelayLoad
rdshost = {829053f7 6ED6 4557 95D4- 628CF4C5946D}

HKEY_CLASSES_ROOT\CLSID\{829053f7 – 6ED6 – 4557 – 95D4- 628CF4C5946D}\InProcServer32
(⺻) = rdshost.dll


ý TCP 8080 Ʈ LISTENING · д. (κ ٸ )

߼, ֵ ġ, , ׸ ǻ ĺų ( , ) ܺη Ȼ ߻ ִ. 


鵵μ ϰԵǸ, ý Ͼ ִ.

1.

2.
Ʈ
3.
Ű Ÿ
4.
ٿε
5. ftp
IRC ۰
6.
ý ϵ

ġ
  • ۱ '긮' ̿ մϴ.
  • ̿ Ǵ '긮' Ͽ ֽʽÿ
Ϻ
Backdoor-W32/IRCBot.18944.C
W32/Sality.A