P2P-Worm.Win32.Banuris.a
Материал из Total Malware Info
P2P-Worm.Win32.Banuris.a Червь распространяющий себя через сети P2P. Является приложением Windows (PE-EXE файл). Имеет размер 135 024 байт. Написан на Visual Basic.
Инсталляция
Копирует свой исполняемый файл как:
C:\winnt\winrun.exe C:\windows\winrun.exe C:\winNT\profiles\test\programma's\opstarten\winrun.exe C:\winnt\profiles\user default\programma's\opstarten\winrun.exe C:\winnt\profiles\all users\programma's\opstarten\winrun.exe C:\winNT\profiles\test\start menu\programma's\opstarten\winrun.exe C:\winnt\profiles\user default\start menu\programma's\opstarten\winrun.exe C:\winnt\profiles\all users\start menu\programma's\opstarten\winrun.exe C:\winNT\profiles\test\start menu\programs\startup\winrun.exe C:\winnt\profiles\user default\start menu\programs\startup\winrun.exe C:\winnt\profiles\all users\start menu\programs\startup\winrun.exe C:\winNT\profiles\test\programs\startup\winrun.exe C:\winnt\profiles\user default\programs\startup\winrun.exe C:\winnt\profiles\all users\programs\startup\winrun.exe C:\sharedDocs\Red alert 2 crack.exe C:\sharedDocs\Red Alert crack.exe C:\sharedDocs\Sim city 4 crack.exe C:\sharedDocs\Sim city 3 crack.exe C:\sharedDocs\Sim city 2 crack.exe C:\sharedDocs\RTTCW crack(noCD).exe C:\sharedDocs\Wolfenstein Return to the castle crack.exe C:\sharedDocs\Anno 1503 crack.exe C:\sharedDocs\Anno 1503 crack nocd.exe C:\sharedDocs\Tomb Raider 1 2 3 4 5 crack.exe C:\sharedDocs\Rollercoaster Tycoon 2 crack.exe C:\sharedDocs\Rollercoaster Tycoon 1 crack.exe C:\sharedDocs\The Sims crack (all versions!).exe C:\sharedDocs\Splinter Cell crack.exe C:\sharedDocs\Splinter Cell crack nocd.exe C:\sharedDocs\Splinter Cell demo.exe C:\sharedDocs\American Conquest Crack.exe C:\sharedDocs\American Conquest Crack nocd.exe C:\sharedDocs\Robin Hood -Legend of Sherwood- crack noCD.exe C:\sharedDocs\Robin Hood -Legend of Sherwood- crack.exe C:\sharedDocs\Highland Warriors crack.exe C:\sharedDocs\Highland Warriors crack nocd.exe C:\sharedDocs\Frontline Attack -War over Europe - Crack.exe C:\sharedDocs\Stronghold Crusader Crack.exe C:\sharedDocs\Stronghold Crusader Crack noCD.exe C:\sharedDocs\Tomb Raider 3 crack.exe C:\sharedDocs\Medieval - Total War - Crack noCD.exe C:\sharedDocs\Medieval - Total War - Crack.exe C:\sharedDocs\Beach Life Crack.exe C:\sharedDocs\Stuart Little 2 Crack.exe C:\sharedDocs\Harry Potter 1 crack.exe C:\sharedDocs\Harry Potter 2 crack.exe C:\sharedDocs\Harry Potter 1 crack noCD.exe C:\sharedDocs\Harry Potter 2 crack noCD.exe C:\sharedDocs\The elder Scrolls - Morrowind- crack.exe C:\sharedDocs\The first emperor crack.exe C:\sharedDocs\Hitman crack nocd.exe C:\sharedDocs\Norton antivirus crack nocd.exe C:\sharedDocs\Esafe crack nocd.exe C:\sharedDocs\Katja Schuurman nude movie.exe C:\sharedDocs\TMF Tooske sexy nude.exe C:\sharedDocs\Girl having sex nude anal.exe C:\sharedDocs\MS Zoo tycoon crack.exe C:\sharedDocs\Driver 2 crack.exe C:\sharedDocs\Driver crack.exe C:\sharedDocs\Theme park world crack.exe C:\sharedDocs\Theme park crack.exe C:\sharedDocs\Dungeon crack nocd.exe C:\sharedDocs\LiveUpdate crack.exe C:\sharedDocs\LiveUpdate crack(4 ever!).exe C:\sharedDocs\Live Update crack.exe C:\sharedDocs\Sex movie hardcore.exe C:\sharedDocs\Hardcore xxx secret.exe C:\sharedDocs\secret.exe C:\sharedDocs\Hardcore SM spanking movie 001.exe C:\sharedDocs\Girl having sex 001.exe C:\sharedDocs\Nude poser (sex cock).exe C:\sharedDocs\See her pussy.exe C:\sharedDocs\Bathroom sex.exe C:\sharedDocs\Voyeur movie.exe C:\sharedDocs\Bumfight (movie).exe C:\sharedDocs\CKY 4.exe C:\sharedDocs\CKY 3.exe C:\sharedDocs\CKY 2.exe C:\sharedDocs\CKY 1.exe C:\sharedDocs\Jackass - Steve O crocodile.exe C:\sharedDocs\Jackass - never shown part.exe C:\sharedDocs\Jackass - The movie(mpeg).exe C:\sharedDocs\Jackass game (be jackass!!).exe C:\sharedDocs\Bush vs Saddam (funny flash movie).exe C:\sharedDocs\Hitman crack.exe C:\sharedDocs\The thing crack.exe C:\sharedDocs\Hitman 2 crack.exe C:\sharedDocs\The Partners crack.exe C:\sharedDocs\Unreal Tournament 2003 crack noCD.exe C:\sharedDocs\UT 2003 crack.exe C:\sharedDocs\Unreal Tournament crack.exe�C:\sharedDocs\Lord of the Rings - The Fellowship of the ring- crack.exe C:\sharedDocs\Lord of the Rings - TTT - crack.exe C:\sharedDocs\Lord Of the ring - The Two Towers - crack.exe C:\sharedDocs\Lord of the rings crack noCD.exe C:\sharedDocs\Combat mission 2 crack.exe C:\sharedDocs\Neocron crack.exe C:\sharedDocs\magix music maker crack noCD.exe C:\sharedDocs\Norton Antivirus 2003 crack.exe C:\sharedDocs\Mcafee antivirus 2003 crack.exe C:\sharedDocs\Esafe desktiop Protection crack.exe C:\sharedDocs\Encarta 2003 crack.exe C:\sharedDocs\Conflict desert storm crack.exe C:\sharedDocs\Davideo 2 crack.exe C:\sharedDocs\Age of Empires 2 crack.exe C:\sharedDocs\Age of mythology crack.exe C:\sharedDocs\Age of mythology crack noCD.exe 22C:\sharedDocs\Empire Earth crack.exe C:\sharedDocs\Emergency 2 crack.exe C:\sharedDocs\Free SMS v1.0.exe C:\sharedDocs\Cable cracker.exe C:\sharedDocs\Cossacks - Back to war- crack.exe C:\sharedDocs\Mafia crack.exe C:\sharedDocs\Car Tycoon crack.exe C:\sharedDocs\World War 3 crack.exe C:\sharedDocs\This is football crack.exe C:\Program Files\Abyss Web Server\Setup\JVM4506.exe
Для автоматического запуска при следующем старте системы червь добавляет ссылку на свой исполняемый файл в ключ автозапуска системного реестра:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] Winrun=”%WinDir%\winrun.exe” Winur=”%WinDir%\winrun.exe”
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] Windir=”%WinDir%winrun.exe” Sysdir=”%WinDir%\winrun.exe”
Деструктивная активность
Извлекает из своего тела файлы:
C:\Program Files\Abyss Web Server\abyss.conf C:\Program Files\MyWebServer\mywebserver.ini C:\Program Files\Abyss Web Server\Setup\index.html C:\Program Files\MyWebServer\Setup\index.html
Файлы не содержат вредоносных объектов.
Рекомендации по удалению
Если ваш компьютер не был защищен антивирусом и оказался заражен данной вредоносной программой, то для её удаления необходимо выполнить следующие действия:
- При помощи ("Диспетчера задач") завершить процесс червя.
- Удалить оригинальный файл червя (его расположение на зараженном компьютере зависит от способа, которым программа попала на компьютер).
- Удалить параметры в ключах реестра (как работать с реестром?):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] Winrun=”%WinDir%\winrun.exe” Winur=”%WinDir%\winrun.exe”
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] Windir=”%WinDir%winrun.exe” Sysdir=”%WinDir%\winrun.exe”
- Удалить файлы:
C:\winnt\winrun.exe C:\windows\winrun.exe C:\winNT\profiles\test\programma's\opstarten\winrun.exe C:\winnt\profiles\user default\programma's\opstarten\winrun.exe C:\winnt\profiles\all users\programma's\opstarten\winrun.exe C:\winNT\profiles\test\start menu\programma's\opstarten\winrun.exe C:\winnt\profiles\user default\start menu\programma's\opstarten\winrun.exe C:\winnt\profiles\all users\start menu\programma's\opstarten\winrun.exe C:\winNT\profiles\test\start menu\programs\startup\winrun.exe C:\winnt\profiles\user default\start menu\programs\startup\winrun.exe C:\winnt\profiles\all users\start menu\programs\startup\winrun.exe C:\winNT\profiles\test\programs\startup\winrun.exe C:\winnt\profiles\user default\programs\startup\winrun.exe C:\winnt\profiles\all users\programs\startup\winrun.exe C:\sharedDocs\Red alert 2 crack.exe C:\sharedDocs\Red Alert crack.exe C:\sharedDocs\Sim city 4 crack.exe C:\sharedDocs\Sim city 3 crack.exe C:\sharedDocs\Sim city 2 crack.exe C:\sharedDocs\RTTCW crack(noCD).exe C:\sharedDocs\Wolfenstein Return to the castle crack.exe C:\sharedDocs\Anno 1503 crack.exe C:\sharedDocs\Anno 1503 crack nocd.exe C:\sharedDocs\Tomb Raider 1 2 3 4 5 crack.exe C:\sharedDocs\Rollercoaster Tycoon 2 crack.exe C:\sharedDocs\Rollercoaster Tycoon 1 crack.exe C:\sharedDocs\The Sims crack (all versions!).exe C:\sharedDocs\Splinter Cell crack.exe C:\sharedDocs\Splinter Cell crack nocd.exe C:\sharedDocs\Splinter Cell demo.exe C:\sharedDocs\American Conquest Crack.exe C:\sharedDocs\American Conquest Crack nocd.exe C:\sharedDocs\Robin Hood -Legend of Sherwood- crack noCD.exe C:\sharedDocs\Robin Hood -Legend of Sherwood- crack.exe C:\sharedDocs\Highland Warriors crack.exe C:\sharedDocs\Highland Warriors crack nocd.exe C:\sharedDocs\Frontline Attack -War over Europe - Crack.exe C:\sharedDocs\Stronghold Crusader Crack.exe C:\sharedDocs\Stronghold Crusader Crack noCD.exe C:\sharedDocs\Tomb Raider 3 crack.exe C:\sharedDocs\Medieval - Total War - Crack noCD.exe C:\sharedDocs\Medieval - Total War - Crack.exe C:\sharedDocs\Beach Life Crack.exe C:\sharedDocs\Stuart Little 2 Crack.exe C:\sharedDocs\Harry Potter 1 crack.exe C:\sharedDocs\Harry Potter 2 crack.exe C:\sharedDocs\Harry Potter 1 crack noCD.exe C:\sharedDocs\Harry Potter 2 crack noCD.exe C:\sharedDocs\The elder Scrolls - Morrowind- crack.exe C:\sharedDocs\The first emperor crack.exe C:\sharedDocs\Hitman crack nocd.exe C:\sharedDocs\Norton antivirus crack nocd.exe C:\sharedDocs\Esafe crack nocd.exe C:\sharedDocs\Katja Schuurman nude movie.exe C:\sharedDocs\TMF Tooske sexy nude.exe C:\sharedDocs\Girl having sex nude anal.exe C:\sharedDocs\MS Zoo tycoon crack.exe C:\sharedDocs\Driver 2 crack.exe C:\sharedDocs\Driver crack.exe C:\sharedDocs\Theme park world crack.exe C:\sharedDocs\Theme park crack.exe C:\sharedDocs\Dungeon crack nocd.exe C:\sharedDocs\LiveUpdate crack.exe C:\sharedDocs\LiveUpdate crack(4 ever!).exe C:\sharedDocs\Live Update crack.exe C:\sharedDocs\Sex movie hardcore.exe C:\sharedDocs\Hardcore xxx secret.exe C:\sharedDocs\secret.exe C:\sharedDocs\Hardcore SM spanking movie 001.exe C:\sharedDocs\Girl having sex 001.exe C:\sharedDocs\Nude poser (sex cock).exe C:\sharedDocs\See her pussy.exe C:\sharedDocs\Bathroom sex.exe C:\sharedDocs\Voyeur movie.exe C:\sharedDocs\Bumfight (movie).exe C:\sharedDocs\CKY 4.exe C:\sharedDocs\CKY 3.exe C:\sharedDocs\CKY 2.exe C:\sharedDocs\CKY 1.exe C:\sharedDocs\Jackass - Steve O crocodile.exe C:\sharedDocs\Jackass - never shown part.exe C:\sharedDocs\Jackass - The movie(mpeg).exe C:\sharedDocs\Jackass game (be jackass!!).exe C:\sharedDocs\Bush vs Saddam (funny flash movie).exe C:\sharedDocs\Hitman crack.exe C:\sharedDocs\The thing crack.exe C:\sharedDocs\Hitman 2 crack.exe C:\sharedDocs\The Partners crack.exe C:\sharedDocs\Unreal Tournament 2003 crack noCD.exe C:\sharedDocs\UT 2003 crack.exe C:\sharedDocs\Unreal Tournament crack.exe�C:\sharedDocs\Lord of the Rings - The Fellowship of the ring- crack.exe C:\sharedDocs\Lord of the Rings - TTT - crack.exe C:\sharedDocs\Lord Of the ring - The Two Towers - crack.exe C:\sharedDocs\Lord of the rings crack noCD.exe C:\sharedDocs\Combat mission 2 crack.exe C:\sharedDocs\Neocron crack.exe C:\sharedDocs\magix music maker crack noCD.exe C:\sharedDocs\Norton Antivirus 2003 crack.exe C:\sharedDocs\Mcafee antivirus 2003 crack.exe C:\sharedDocs\Esafe desktiop Protection crack.exe C:\sharedDocs\Encarta 2003 crack.exe C:\sharedDocs\Conflict desert storm crack.exe C:\sharedDocs\Davideo 2 crack.exe C:\sharedDocs\Age of Empires 2 crack.exe C:\sharedDocs\Age of mythology crack.exe C:\sharedDocs\Age of mythology crack noCD.exe C:\sharedDocs\Empire Earth crack.exe C:\sharedDocs\Emergency 2 crack.exe C:\sharedDocs\Free SMS v1.0.exe C:\sharedDocs\Cable cracker.exe C:\sharedDocs\Cossacks - Back to war- crack.exe C:\sharedDocs\Mafia crack.exe C:\sharedDocs\Car Tycoon crack.exe C:\sharedDocs\World War 3 crack.exe C:\sharedDocs\This is football crack.exe C:\Program Files\Abyss Web Server\Setup\JVM4506.exe
