Diskeeper 2010 Pro Premier v14 0 900.exe.
CleanMyPC Registry Cleaner v4 02-TE.exe.Call Of Duty Modern Warfare 2 working multiplayer patch by team eloaded.exe.Bebo/Myspace/Facebook Password Stealer.exe.Babylon 8 - Instant translation tool.exe.Avira Internet Security 2010 Keygen.exe.Autorun Virus Remover v2 3 1022-Lz0.exe.Atomix Virtual DJ v6.0.2 FINAL Professional.exe.Adobe Photoshop CS4 Extended + Keygen + Activation.exe.3delite MP3 Stream Editor v3 4 4 1980 WinALL.exe.It uses the following file names for the copies it drops in the folders mentioned above: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion The folder path mentioned above is obtained by checking the following registry entry: This worm drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system. This worm connects to any of the following IRC server(s): It drops copies of itself in the following shared folders: (Note: %Program Files% is the default Program Files folder, usually C:\Program Files.) (Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\\morpheus\my shared folder\ This worm drops the following file(s)/component(s): Payload: Compromises system security, Terminates processes, Modifies HOSTS file It does this by checking the user name of the affected computer, or by checking if there are any applications running on the infected system that indicates it is being monitored or tested. SDBOT stops running when it detects that is running on a test environment. SDBOT's backdoor capabilities allows other commands and functions to be performed on the infected computer. It downloads and installs files such as FAKEAV. This family is primarily geared towards downloading other files - a pay-per-install scheme known in the cybercrime economy. It is known to spread by exploiting vulnerabilities, by dropping copies of itself in removable drives and network shares, and by being shared through peer-to-peer (P2P) networks. The SDBOT family of worms have been around since 2004.
Infection Channel: Propagates via removable drives, Propagates via peer-to-peer networks, Propagates via network shares, Propagates via software vulnerabilities, Propagates via IRC, Downloaded from the Internet
0 kommentar(er)
