Win32.Hack.Bofra

Virus name (in Chinese):

Virus alias:

Threat Level: ★★☆☆☆

Virus type: Hacker program

Virus Length: 80130

Impact System: WIN9X\WINNT

Virus behavior:

This is a hacker program that can be spread through IRC. Through IRC remote control user machine, download virus program from network, steal user information, such as game Cdkey etc. The virus can also be a weak guess of the user name and password of other machines, after gaining control, you may perform any operation.

1, release the following documents:

%system%\wuamgrd.exe

2, modify the registration form:

"WindowsUpdateEngine32" = "Wuamgrd16.exe"

To achieve the purpose of self-starter

3, the virus released itself to the system directory, will delete other places of the copy, to achieve the hidden purpose

4, if you guess the machine's username and password, if successfully logged in, you can fully obtain the control of the machine.

The user name is as follows:

"Administrator"

"Administrador"

"Administrat"

"Admins"

"Admin"

"Staff"

"Root"

"Computer"

"Owner"

"Student"

"Teacher"

"Wwwadmin"

"Guest"

"Default"

"Database"

"DBA"

"Oracle"

"DB2"

The password is as follows:

"Administrator"

"Administrador"

"Administrateur"

"Administrat"

"Admins"

"Admin"

"ADM"

"Password1"

"Password"

"passwd"

"Pass1234"

"Pass"

"PWD"

"007"

"1"

"12"

"123"

"1234"

"12345"

"123456"

"1234567"

"12345678"

"123456789"

"1234567890"

"2000"

"2001"

"2002"

"2003"

"2004"

"Test"

"Guest"

"None"

"Demo"

"Unix"

"Linux"

"Changeme"

"Default"

Wait a minute.

5, to the IRC users to send special instructions to obtain user information, to the other machine embedded hacker program, download the Mybot worm from the network, restart the user's machine.

6, steal the Cdkey of the following games:

Redalart

Nascarracing

Nhl

FIFA

Counter-Strike