PCC KILL: BKDR_HUPIGON.CVT
惡意程式類別: Backdoor
別名: No Alias Found
廣泛傳播: 是
破壞性的: 不
語言: English
平台: Windows 98, ME, NT, 2000, XP, Server 2003
加密的: 不
整體的風險程度: 低度
回報的感染案例: 低度
損害可能性: 高度
散佈可能性: 低度
掃描引擎版本最低需求: 8.000
需要的病毒碼: 4.426.08
病毒碼發佈日期: Apr 20, 2007
常駐記憶體: 是
惡意程式大小: 291,840 Bytes (compressed .EXE file); 591,360 Bytes (compressed .DLL file)
細節:
This backdoor may arrive as a file dropped or downloaded by other malware.
Upon execution, it drops the following files in the Windows folder:
G_SERVER2007.EXE - copy of itself
G_SERVER2007.DLL - also detected by Trend Micro as BKDR_HUPIGON.CVT
On Windows NT-based systems (Windows NT, 2000, XP, and Server 2003), it registers itself as a service to ensure its automatic execution at every system startup. It does this by adding the following registry key and entry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ServerGrayPigeon2007
ImagePath = "%Windows%\G_SERVER2007.EXE"
(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)
On Windows 98 and ME, it creates the following registries to ensure its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
G_Server2007.exe = "%Windows%\G_SERVER2007.EXE"
It opens random ports to allow a remote malicious user to connect to the affected system. Once a successful connection is established, it allows the remote malicious user to issue the following commands locally, effectively compromising the affected system:
Create files in any folder
Create registry entries
Download files from the Internet
Log keystrokes
Retrieve disk status
Start and terminate services and processes
This backdoor comes with its own compression. It runs on Windows 98, ME, NT, 2000, XP, and Server 2003.
都算是新毒
最初收到的樣本: Mar 18, 2007
| Computers infected since April 8, 2007 | | Asia | | 93 | | | North America | | 17 | | | Europe | | 3 | | | Africa | | 0 | | | South America | | 0 | | | Australia and New Zealand | | 0 | | | Total | | 113 | | | | | Top 10 countries | | China | | 76 | | | Taiwan | | 15 | | | United States | | 15 | | | Denmark | | 3 | | | Canada | | 2 | | | Thailand | | 1 | | Hong Kong
| | 1 |
|
[ 本帖最后由 tonyyu2008 于 2007-4-21 20:08 编辑 ] |
发表于 2007-4-21 19:41:33
发表于 2007-4-21 19:42:27
发表于 2007-4-21 19:43:20
