바이러스 DB - 터보백신

바이러스 정보
터보백신에서 분석한 바이러스 위협 정보, 보안 통계를 확인할 수 있습니다.

이름: Backdoor-W32/VanBot.159232

바이러스 종류: Backdoor

실행환경: Windows

증상요약: 윈도우 취약점을 이용해 전파되며 감염된 시스템은 특정 서버에 접속하여 각종 악의적인 기능을 수행한다.

위험등급: 위험

확산방법: 네트워크, 보안취약점

치료방법: 터보백신 제품군으로 진단/치료 가능합니다.

※ 상세 설명: <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan" align=left>*감염 경로 아래와 같으나 윈도우 보안 취약점을 이용해 전파 된다. <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan" align=left><?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p>  <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan" align=left>MS03-039 RPC DCOM2 취약점       <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan" align=left><A href="http://www.microsoft.com/korea/technet/security/bulletin/MS03-039.asp">http://www.microsoft.com/korea/technet/security/bulletin/MS03-039.asp</A> <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan" align=left> MS06-040 서버 서비스의 취약점으로 인한 원격 코드 실행 문제점 <A href="http://www.microsoft.com/korea/technet/security/Bulletin/MS06-040.mspx">http://www.microsoft.com/korea/technet/security/Bulletin/MS06-040.mspx</A><o:p></o:p> <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan" align=left> *증상 -파일 생성 <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan" align=left><o:p></o:p>  <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan" align=left>윈도우 시스템 폴더에 wgareg.exe 라는 파일을 생성한다. <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan" align=left><o:p></o:p>  <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; TEXT-INDENT: 27pt; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan; mso-char-indent-count: 3.0" align=left>-윈도우 시스템 폴더? <o:p></o:p> <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt 45pt; WORD-BREAK: keep-all; TEXT-INDENT: -18pt; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan; mso-list: l0 level1 lfo1; tab-stops: list 45.0pt" align=left>-          윈도우 95/98/ME/XP  - C:\Windows\System,<o:p></o:p> <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt 45pt; WORD-BREAK: keep-all; TEXT-INDENT: -18pt; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan; mso-list: l0 level1 lfo1; tab-stops: list 45.0pt" align=left>-          윈도우 NT/2000          -C:\WinNT\System32<o:p></o:p> <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt 45pt; WORD-BREAK: keep-all; TEXT-INDENT: -18pt; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan; mso-list: l0 level1 lfo1; tab-stops: list 45.0pt" align=left>-          윈도우 XP                  - C:\Windows\System32 <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt 45pt; WORD-BREAK: keep-all; TEXT-INDENT: -18pt; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan; mso-list: l0 level1 lfo1; tab-stops: list 45.0pt" align=left><o:p></o:p>  <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; TEXT-INDENT: 4.5pt; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan; mso-char-indent-count: .5" align=left>-레지스트리 등록 <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; TEXT-INDENT: 4.5pt; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan; mso-char-indent-count: .5" align=left>레지스트리에 다음 value를 등록해 윈도우 구동시 자동 실행되도록 만든다. <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; TEXT-INDENT: 4.5pt; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan; mso-char-indent-count: .5" align=left>  <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; TEXT-INDENT: 4.5pt; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan; mso-char-indent-count: .5" align=left><SPAN lang=EN-US style="FONT-SIZE: 9pt; COLOR: #608533; FONT-FAMILY: 바탕; mso-bidi-font-family: ''''Times New Roman''''; mso-font-kerning: 1.0pt; mso-hansi-font-family: ''''Times New Roman''''; mso-ansi-language: EN-US; mso-fareast-language: KO; mso-bidi-language: AR-SA">HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WGAREG <SPAN lang=EN-US style="FONT-SIZE: 9pt; COLOR: #608533; FONT-FAMILY: 바탕; mso-bidi-font-family: ''''Times New Roman''''; mso-font-kerning: 1.0pt; mso-hansi-font-family: ''''Times New Roman''''; mso-ansi-language: EN-US; mso-fareast-language: KO; mso-bidi-language: AR-SA"> <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; TEXT-INDENT: 4.5pt; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan; mso-char-indent-count: .5" align=left> <SPAN lang=EN-US style="FONT-SIZE: 9pt; COLOR: #608533; FONT-FAMILY: 바탕; mso-bidi-font-family: ''''Times New Roman''''; mso-font-kerning: 1.0pt; mso-hansi-font-family: ''''Times New Roman''''; mso-ansi-language: EN-US; mso-fareast-language: KO; mso-bidi-language: AR-SA">HKEY_LOCAL_MACHINE\SYSTEM\<SPAN lang=EN-US style="FONT-SIZE: 9pt; COLOR: #608533; FONT-FAMILY: ''''Times New Roman''''; mso-fareast-font-family: 바탕; mso-font-kerning: 1.0pt; mso-ascii-font-family: 바탕; mso-ansi-language: EN-US; mso-fareast-language: KO; mso-bidi-language: AR-SA"> <SPAN lang=EN-US style="FONT-SIZE: 9pt; COLOR: #608533; FONT-FAMILY: 바탕; mso-bidi-font-family: ''''Times New Roman''''; mso-font-kerning: 1.0pt; mso-hansi-font-family: ''''Times New Roman''''; mso-ansi-language: EN-US; mso-fareast-language: KO; mso-bidi-language: AR-SA">CurrentControlSet\ Services\wgareg <SPAN lang=EN-US style="FONT-SIZE: 9pt; COLOR: #608533; FONT-FAMILY: 바탕; mso-bidi-font-family: ''''Times New Roman''''; mso-font-kerning: 1.0pt; mso-hansi-font-family: ''''Times New Roman''''; mso-ansi-language: EN-US; mso-fareast-language: KO; mso-bidi-language: AR-SA"> <P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: keep-all; TEXT-INDENT: 4.5pt; LINE-HEIGHT: 13pt; TEXT-AUTOSPACE: ideograph-numeric; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan; mso-char-indent-count: .5" align=left> <SPAN lang=EN-US style="FONT-SIZE: 9pt; COLOR: #608533; FONT-FAMILY: 바탕; mso-bidi-font-family: ''''Times New Roman''''; mso-font-kerning: 1.0pt; mso-hansi-font-family: ''''Times New Roman''''; mso-ansi-language: EN-US; mso-fareast-language: KO; mso-bidi-language: AR-SA">HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole <SPAN lang=EN-US style="FONT-SIZE: 9pt; COLOR: #608533; FONT-FAMILY: 바탕; mso-bidi-font-family: ''''Times New Roman''''; mso-font-kerning: 1.0pt; mso-hansi-font-family: ''''Times New Roman''''; mso-ansi-language: EN-US; mso-fareast-language: KO; mso-bidi-language: AR-SA"> EnableDCOM = "n"

※ 예방 및 수동 조치 방법

본 컨텐츠에 대한 이용 문의는 '에브리존'으로 문의하여 주십시요

이전글: Backdoor-W32/Prorat.350764

다음글: W32/Warezov.150844@mm

터보백신 개인용 TurboVaccine Introduce

터보백신 개인용
TurboVaccine Introduce