¹ÙÀÌ·¯½º DB
À̸§ W32/Brontok.43431@mm
¹ÙÀÌ·¯½º Á¾·ù Worm ½ÇÇàȯ°æ Windows
À§Çèµî±Þ À§Çè È®»ê¹æ¹ý ¸ÞÀÏ
Áõ»ó¿ä¾à ÀÌ ¿úÀº ¸ÞÀÏ·Î ÀüÆÄµÇ¸ç, °¨¿°µÈ ½Ã½ºÅÛÀº ¸ÞÀÏ ÁÖ¼Ò¸¦ ¼öÁýÇÏ¿© ¿úÀÌ Ã·ºÎµÈ ¸ÞÀÏÀ» Àü¼ÛÇÑ´Ù.
Ä¡·á¹æ¹ý Åͺ¸¹é½Å Á¦Ç°±ºÀ¸·Î Áø´Ü/Ä¡·á °¡´ÉÇÕ´Ï´Ù.

»ó¼¼¼³¸í  Áø´Ü/Ä¡·á¹æ¹ý
¡Ø »ó¼¼ ¼³¸í

°¨¿° °æ·Î

°¨¿°µÈ ½Ã½ºÅÛ¿¡¼­ ¸ÞÀÏ ÁÖ¼Ò¸¦ ¼öÁýÇÏ¿© ÇØ´ç¿úÀ» ÷ºÎÇÏ¿© ¸ÞÀÏ·Î ÀüÆÄ µÈ´Ù.



*Áõ»ó



-ÆÄÀÏ »ý¼º

 

À©µµ¿ì Æú´õ¿¡ KesenjanganSosial.exe ¶ó´Â ÆÄÀÏÀ» »ý¼ºÇÑ´Ù.

 

- À©µµ¿ì Æú´õ ?

- À©µµ¿ì 95/98/ME/XP  - C:\Windows,

- À©µµ¿ì NT/2000          - C:\WinNT

 

À©µµ¿ì ½Ã½ºÅÛ Æú´õ¿¡ »ç¿ëÀÚÀ̸§''s Setting.scr ,cmd-brontok.exe ¶ó´Â ÆÄÀÏÀ» »ý¼ºÇÑ´Ù.

 

- À©µµ¿ì ½Ã½ºÅÛ Æú´õ?

- À©µµ¿ì 95/98/ME/XP   - C:\Windows\System

- À©µµ¿ì NT/2000          - C:\WinNT\System32

- À©µµ¿ì XP                  - C:\Windows\System32

 

 

Documents and Settings\»ç¿ëÀÚ °èÁ¤\½ÃÀÛ ¸Þ´º\ÇÁ·Î±×·¥\½ÃÀÛÇÁ·Î±×·¥\ Æú´õ¿¡ Empty.pif ÆÄÀÏÀ» »ý¼ºÇÑ´Ù.

 

Documents and Settings\»ç¿ëÀÚ °èÁ¤\Local Settings\Application Data\ Æú´õ¿¡ services.exe ÆÄÀÏÀ» »ý¼ºÇÑ´Ù.

 

Documents and Settings\»ç¿ëÀÚ °èÁ¤\Local Settings\Application Data\ Æú´õ¿¡ inetinfo.exe ÆÄÀÏÀ» »ý¼ºÇÑ´Ù.

 

Documents and Settings\»ç¿ëÀÚ °èÁ¤\Local Settings\Application Data\ Æú´õ¿¡ lsass.exe ÆÄÀÏÀ» »ý¼ºÇÑ´Ù.

 

Documents and Settings\»ç¿ëÀÚ °èÁ¤\Local Settings\Application Data\ Æú´õ¿¡ csrss.exe ÆÄÀÏÀ» »ý¼ºÇÑ´Ù.

 

Documents and Settings\»ç¿ëÀÚ °èÁ¤\Local Settings\Application Data\ Æú´õ¿¡ winlogon.exe ÆÄÀÏÀ» »ý¼ºÇÑ´Ù.

 

Documents and Settings\»ç¿ëÀÚ °èÁ¤\Local Settings\Application Data\ Æú´õ¿¡ smss.exe ÆÄÀÏÀ» »ý¼ºÇÑ´Ù.

 

Documents and Settings\»ç¿ëÀÚ °èÁ¤\Templates\ Æú´õ¿¡ Brengkolang.com ÆÄÀÏÀ» »ý¼ºÇÑ´Ù.

 

À©µµ¿ì Æú´õ\ShellNew Æú´õ¿¡ RakyatKelaparan.exe ÆÄÀÏÀ» »ý¼ºÇÑ´Ù.

 

À©µµ¿ì Æú´õ\Tasks Æú´õ¿¡ At1.job ÆÄÀÏÀ» »ý¼ºÇÑ´Ù

 

 

-·¹Áö½ºÆ®¸® µî·Ï


·¹Áö½ºÆ®¸®¿¡ ´ÙÀ½ value¸¦ µî·ÏÇØ À©µµ¿ì ±¸µ¿½Ã ÀÚµ¿ ½ÇÇàµÇµµ·Ï ¸¸µç´Ù.


HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Tok-Cirrhatus

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Tok-Cirrhatus-123 = documents and settings\
»ç¿ëÀÚ °èÁ¤\local settings\application data\smss.e

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Bron-Spizaetus =
À©µµ¿ì Æú´õ\shellnew\rakyatkelaparan.exe


°¨¿°µÈ ½Ã½ºÅÛÀº ƯÁ¤ ·¹Áö½ºÆ®¸® °ªÀ» º¯°æÇÏ¿© À©µµ¿ì Ž»ö±âÀÇ Æú´õ ¿É¼Ç ¸Þ´º, ¼û±è ÆÄÀÏ ¼Ó¼º ÄÜ¼Ö ¸í·Éâ, ·¹Áö½ºÆ®¸® ÆíÁý±â µîÀ» ½ÇÇàµÇÁö ¾Êµµ·Ï ¸¸µç´Ù.

¡Ø ¿¹¹æ ¹× ¼öµ¿ Á¶Ä¡ ¹æ¹ý
  • º» ÄÁÅÙÃ÷¿¡ ´ëÇÑ ÀúÀÛ±ÇÀº '¿¡ºê¸®Á¸'¿¡°Ô ÀÖÀ¸¸ç ÀÌ¿¡ ¹«´Ü »ç¿ë ¹× Àç¹èÆ÷¸¦ ±ÝÁöÇÕ´Ï´Ù.
  • º» ÄÁÅÙÃ÷¿¡ ´ëÇÑ ÀÌ¿ë ¹®ÀÇ´Â '¿¡ºê¸®Á¸'À¸·Î ¹®ÀÇÇÏ¿© Áֽʽÿä
ÀÌÀü±Û W32/Viking.B
´ÙÀ½±Û Trojan-W32/KorHack.45056.E