• Ǽڵ DB / ̷ DB Ʈ Ȳ
  • ټ Ʈ ǽϰ Ǽڵ ߻ żϰ ߰ Ʈ ǽϰ ֽϴ.
    ڵ Ʈ ̿Ͻø ϰ Ʈ ֽϴ.
̸ Trojan-W32/Dropper.1593248
̷ Trojan ȯ
Ȯ Ʈũ
Ŭ̾Ʈ .
ġ ͺ ǰ /ġ մϴ. 󼼼  /ġ

Ŭ̾Ʈ .

Ʈũ ̿ õ.

ڵ ̿ ̷ Ư .

ȭ Ͽ Ʈ Ȱ Ʈ .

Ư URL IP ּ .

Autorun ̷ (autorun.inf )

 

%system%dfeohcg.dll

 

/ Ʈ

( Ű )
[HKEY_LOCAL_MACHINE\

 SOFTWARE\Microsoft\

  Windows NT\

    CurrentVersion\

      SvcHost]

Netsvcs= kogvea

 

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  ControlSet001\

   Enum\

    Root\

     LEGACY_KOGVEA]

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  ControlSet002\

   Enum\

    Root\

     LEGACY_KOGVEA]

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  ControlSet003\

   Enum\

    Root\

     LEGACY_KOGVEA]

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  CurrentControlSet\

   Enum\

    Root\

     LEGACY_KOGVEA]

 

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  CurrentControlSet\

   Services\

    kogvea]

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  ControlSet002\

   Services\

    kogvea]

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  ControlSet003\

   Services\

    kogvea]

 

ġ

ġ ֽ .


 



1)     ó ̷ dfeohcg.dll ǽ Ͽϴ.


2)     ó Windows XP ϴ.


3)     Ǵ Ʈ Ű Ͻñ ٶϴ.


4)     ĸȭ ׸ ٸ ֽϴ.


 


 


1.    ̷ Ȯ


1)     Ʈ մϴ.


([]-[] [cmd] )


 


2)     ý Ӽ dll Ȯ մϴ.


(%system% dir/ah)



 


3)     Gmerα׷ ̿ ƮŶ ̷ Ȯմϴ.


(www.gmer.com ٿε, ϸ Ʒ Ȯ մϴ.


Ʒ ׸ ̷ ٸϴ)





 


 


2.    ̷ ó


1)     Ʈ ⸦ մϴ.


([]-[] [regedit] )


 


2)     Svhost ش մϴ.


(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost netsvcsȿ kogvea )



 


3)     ش Ʈ մϴ.


(Ʈ ڰ ߰Ͽ ٲ ش Ʈ


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kogvea]


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\kogvea]


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\kogvea]


Start = 2  -> Start = 4)


 



         


             4)     մϴ.


 


5)     ý ̻ Ӽ մϴ.


(%system%attrib –s –r –h dfeohcg.dll


%system%del dfeohcg.dll)


 




 


6)     Ʈ մϴ.


([]-[] [services.msc]


Automactic Updates Background Intelligent Transfer Service )



 



 


 


7)     ǻ͸ մϴ. 


8)     Ʈ մϴ.


 


 

  • ۱ '긮' ̿ մϴ.
  • ̿ Ǵ '긮' Ͽ ֽʽÿ
Trojan-W32/Magania.200704.C
2018.6.25
ǰ
/
TurboVaccine ޹ħ
Copyright Everyzone, Inc. All Rights Reserved.