Win32.Hack.ThiefTool Flash Disk Spy

Virus name (Chinese): Flash disc Spy

Virus alias:

Threat Level: ★☆☆☆☆

Virus type: Hacker program

Virus Length: 106496

Impact System: WIN9X\WINME\WINNT\WIN2000\WINXP\WIN2003

Virus behavior:

The virus is a Trojan Horse generator beta, based on user choice to generate injection of different processes (Explorer.exe or Winlogon.exe) of the Trojan Thief.exe, run Thief.exe, first copy itself to the%system%\ Inetsvr.exe, then generate temporary file Boot.inf, and install service, disguised as "Windowsinternetservice", with boot (FDTDLL.dll injector) And then in the current directory generation system to hide the properties of the Trojan FDTDLL.dll, and inject FDTDLL.dll into the Explorer.exe or Winlogon.exe process, FDTDLL.dll create two threads, one to continue to execute delete thief.exe files, resulting in a great resource waste; another thread monitors the flash disk and copies the files inside to the specified folder (Beta is c:\test\).

1, Build Trojan

% current directory%\thief.exe

2, Trojan Thief.exe generate files

%system%\inetsvr.exe

% current directory%\fdtdll.dll

3, the use of service technology to enable the Trojan boot

C:\boot.inf, temporary files, installation service after the deletion.

Content is:

[Version]
Signature="$WINDOWSNT$"
[DefaultInstall.Services]
AddService=inetsvr,,My_AddService_Name
[My_AddService_Name]
DisplayName=WindowsInternetService
Description=提供对Internet信息服务管理的支持.
ServiceType=0x10
StartType=2
ErrorControl=0
ServiceBinary=%\inetsvr.exe]

4, using injection process technology

Inject Explorer.exe or Winlogon.exe process, choose to generate Trojan

5, monitor flash disk, steal files

stored in the specified folder, the beta is c:\test\.