BACKDOOR.WIN32.IRCBOT.AFM (Video.exe) Virus processing method _ virus killing

File name: Video.exe

File Size: 40960 bytes

AV name: BACKDOOR.WIN32.IRCBOT.AFM (Kaspersky)

Adding shell mode: Unknown

Writing language: Microsoft Visual C + +

Virus type: IRC back door

File Md5:c06d070c232bc6ac6346cbd282ef73ae

Behavioral Analysis:

1. Release virus copy:

%srstemroot%system32\firewall.exe 40960 bytes.

(The filename should be random, not necessarily this).

Compress the replica virus and save it as a compressed package. and randomly named, which may be:

IMG0007. Pictureupload.com
IMG0007
Game
Video
PhotoAlbum

2, modify the registry, starting from:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Registry value:windows Network Firewall TYPE:REG_SZ

Point:%srstemroot%system32\firewall.exe

3, add to the system Firewall ignore list:

Hkey_local_machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\ Authorizedapplications\list\list

Key Name:%srstemroot%system32\firewall.exe, to achieve through the wall.

4, the Connection 72.10.167.**IRC server, accepts the remote control, may terminate any process in the controlled end, and uses for the springboard or the DDoS attack.

The following commands may be accepted:

QUIT
Part
JOIN
TOPIC
NOTICE
Privmsg
Ddos
Servu
Serv u
Serv-u
Clone
Flood

5, download other Trojan, technical behavior are similar, randomly named.

6, enumerate local network resources, try to use IPC, print, admin and other sharing spread virus, to the following dictionary guessing users and passwords:

db1234
DatabasePassWord
Databasepass
Dbpassword
Dbpass
Domainpassword
Domainpass
Hello
Hell
Love
Money
Slut
**
**
Exchange
Loginpass
Login
Win2000
Winnt
WinXP
Win2K
Win98
Windows
Oeminstall
Accounting
Accounts
Letmein
Outlook
Mail
Qwerty
Temp123
Temp
Null
Default
Changeme
Demo
Test
2005
2004
2001
Secret
Payday
Deadline
Work
1234567890
123456789
12345678
1234567
123456
12345
1234
Pass
pass1234
passwd
Password
Password1
If successful, copy the virus copy to the other directory, which may be:

C:\Documents and Settings\All Users\documentsc:\windows\system32
C:\Winnt\System32
C:\Windows
C:\Winnt

7, the use of System vulnerability propagation (Lsass, RPC and other vulnerabilities), the IP range of attacks:

124.72.143.173 (starting)-random.

The compromised computer may be propagated to the virus.

8. Try to connect to another server as an administrator, possibly the following unauthorized user name:


Staff
Teacher
Owner
Student
Intranet
Main
Office
Control
Siemens
Compaq
Dell
Cisco
Oracle
Data
Access
Database
Domain
Backup
Technical
Mary
Katie
Kate
George
Eric
None
Guest
Chris
Neil
Brian
Susan
Luke
Peter
John
Mike
Bill
Fred
Wwwadmin
Oemuser
User
Homeuser
Home
Internet
Root
Server
Linux
Unix
Computer
Admin
Admins
Administrat
Administrateur
Administrador
Administrator

If successful, read and attempt to crack the Flashfxp\sites.dat.

The virus file may then be copied to the server.

9, try to steal some cd-key, may be Unreal3, World of Warcraft and so on.


Workaround:

1, download Sreng2.zip


2, restart, press F8 into the safe mode.

3, open Sreng, delete the registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

<windows network firewall><c:\winnt\system32\firewall.exe> []

PS: The key value may also be different from the filename. Pay attention to the difference Ah, do not understand, the log sent to the anti-drug zone.

4, be sure to hit the system loopholes.