P2P-Worm.Win32.Lolol.b

Материал из Total Malware Info

Перейти к: навигация, поиск

P2P-Worm.Win32.Lolol.b Червь распространяющий себя через P2P сети. Является приложением Windows (PE-EXE файл). Имеет размер 58 400 байт.

Инсталляция

Копирует свой исполняемый файл как: 

%System%\winsys.exe
C:\program files\kazaa\my shared folder\hotmail hack.exe
C:\program files\kazaa\my shared folder\age of empires 2 crack.exe
C:\program files\kazaa\my shared folder\age of empires 2 keygen.exe
C:\program files\kazaa\my shared folder\age of empires 2 serials.pif
C:\program files\kazaa\my shared folder\age of empires 2 serial.pif
C:\program files\kazaa\my shared folder\age of empires 2 help.exe
C:\program files\kazaa\my shared folder\age of empires 2.exe
C:\program files\kazaa\my shared folder\age of empires 2 cheats.exe
C:\program files\kazaa\my shared folder\pamela anderson screen saver.scr
C:\program files\kazaa\my shared folder\hondra screen saver.scr
C:\program files\kazaa\my shared folder\supra screen saver.scr
C:\program files\kazaa\my shared folder\porn screen saver.scr
C:\program files\kazaa\my shared folder\fireworks crack.exe
C:\program files\kazaa\my shared folder\fireworks serial.pif
C:\program files\kazaa\my shared folder\fireworks.exe
C:\program files\kazaa\my shared folder\divx pro.exe
C:\program files\kazaa\my shared folder\how to hack.exe
C:\program files\kazaa\my shared folder\steal usernames.exe
C:\program files\kazaa\my shared folder\aim cracker.exe
C:\program files\kazaa\my shared folder\aol cracker.exe
C:\program files\kazaa\my shared folder\aim password cracker.exe
C:\program files\kazaa\my shared folder\aol password cracker.exe
C:\program files\kazaa\my shared folder\100 free essays school.pif
C:\program files\kazaa\my shared folder\warcraft 3 crack.exe
C:\program files\kazaa\my shared folder\warcraft 3 serials.pif
C:\program files\kazaa\my shared folder\play station emulator.exe
C:\program files\kazaa\my shared folder\play station emulator crack.exe
C:\program files\kazaa\my shared folder\NBA 2003.exe
C:\program files\kazaa\my shared folder\NBA 2003 Crack.exe
C:\program files\kazaa\my shared folder\NBA 2003 serials.epif
C:\program files\kazaa\my shared folder\anarchist cookbook.pif
C:\program files\kazaa\my shared folder\ut 2k3.exe
C:\program files\kazaa\my shared folder\ut 2k3.pif
C:\program files\kazaa\my shared folder\super mario bros.exe
C:\program files\kazaa\my shared folder\super mario brothers.exe
C:\program files\kazaa\my shared folder\winxp.iso.pif
C:\program files\kazaa\my shared folder\virtual girl - nikki taylor.pif
C:\program files\kazaa\my shared folder\virtual girl - jammie williams.pif
C:\program files\kazaa\my shared folder\virtual girl - nikki taylor.pif
C:\program files\kazaa\my shared folder\virtual girl - melina black pepper.pif
C:\program files\kazaa\my shared folder\virtual girl - chole.pif
C:\program files\kazaa\my shared folder\virtual girl - nikki.pif
C:\program files\kazaa\my shared folder\virtual girl - victoria.pif
C:\program files\kazaa\my shared folder\virtual girl - tennis girl.pif
C:\program files\kazaa\my shared folder\virtual girl - vera.pif
C:\program files\kazaa\my shared folder\virtual girl - wet and wild.pif
C:\program files\kazaa\my shared folder\virtual girl - judith.pif
C:\program files\kazaa\my shared folder\virtual girl - business woman.pif	�C:\program files\kazaa\my shared folder\virtual girl - hells angels.pif
C:\program files\kazaa\my shared folder\virtual girl - mandy.pif
C:\program files\kazaa\my shared folder\virtual girl - courtney.pif
C:\program files\kazaa\my shared folder\virtual girl - jenn.pif
C:\program files\kazaa\my shared folder\virtual girl - Rebecca.pif
C:\program files\kazaa\my shared folder\virtual girl - bunny.pif
C:\program files\kazaa\my shared folder\virtual girl - ALL.pif
C:\program files\kazaa\my shared folder\virtual girl - adriana.pif
C:\program files\kazaa\my shared folder\virtual girl - bailey short skirt.pif
C:\program files\kazaa\my shared folder\virtual girl - completely nude.pif
C:\program files\kazaa\my shared folder\virtua girl - nikki taylor.pif
C:\program files\kazaa\my shared folder\virtua girl - jammie williams.pif
C:\program files\kazaa\my shared folder\virtua girl - melina black pepper.pif
C:\program files\kazaa\my shared folder\virtua girl - chole.pif
C:\program files\kazaa\my shared folder\virtua girl - nikki.pif
C:\program files\kazaa\my shared folder\virtua girl - victoria.pif
C:\program files\kazaa\my shared folder\virtua girl - tennis girl.pif
C:\program files\kazaa\my shared folder\virtua girl - vera.pif
C:\program files\kazaa\my shared folder\virtua girl - wet and wild.pif
C:\program files\kazaa\my shared folder\virtua girl - judith.pif
C:\program files\kazaa\my shared folder\virtua girl - business woman.pif
C:\program files\kazaa\my shared folder\virtua girl - hells angels.pif
C:\program files\kazaa\my shared folder\virtua girl - mandy.pif
C:\program files\kazaa\my shared folder\virtua girl - courtney.pif
C:\program files\kazaa\my shared folder\virtua girl - jenn.pif
C:\program files\kazaa\my shared folder\virtua girl - Rebecca.pif
C:\program files\kazaa\my shared folder\virtua girl - bunny.pif
C:\program files\kazaa\my shared folder\virtua girl - ALL.pif
C:\program files\kazaa\my shared folder\virtua girl - adriana.pif
C:\program files\kazaa\my shared folder\virtua girl - bailey short skirt.pif
C:\program files\kazaa\my shared folder\virtua girl - completely nude.pif
C:\program files\kazaa\my shared folder\driver.exe
C:\program files\kazaa\my shared folder\gta3.exe
C:\program files\kazaa\my shared folder\GTA 3 Crack.exe
C:\program files\kazaa\my shared folder\GTA 3 Serial.exe
C:\program files\kazaa\my shared folder\fuck.exe
C:\program files\kazaa\my shared folder\Virtua Sex.exe
C:\program files\kazaa\my shared folder\HotGirls.exe
C:\program files\kazaa\my shared folder\worldbook.exe
C:\program files\kazaa\my shared folder\Virtua Girl (Full).exe
C:\program files\kazaa\my shared folder\how to use a shell.pif
C:\My Downloads\hotmail hack.exe
C:\My Downloads\age of empires 2 crack.exe
C:\My Downloads\age of empires 2 keygen.exe
C:\My Downloads\age of empires 2 serials.pif
C:\My Downloads\age of empires 2 help.exe
C:\My Downloads\age of empires 2.exe
C:\My Downloads\age of empires 2 cheats.exe
C:\My Downloads\pamela anderson screen saver.scr
C:\My Downloads\hondra screen saver.scr
C:\My Downloads\supra screen saver.scr
C:\My Downloads\porn screen saver.scr
C:\My Downloads\fireworks crack.exe
C:\My Downloads\fireworks serial.pif
C:\My Downloads\fireworks.exe
C:\My Downloads\divx pro.exe
C:\My Downloads\how to hack.exe
C:\My Downloads\steal usernames.exe
C:\My Downloads\aim cracker.exe
C:\My Downloads\aol cracker.exe
C:\My Downloads\aim password cracker
C:\My Downloads\aol password cracker.exe
C:\My Downloads\100 free essays school.pif
C:\My Downloads\warcraft 3 crack.exe
C:\My Downloads\warcraft 3 serials.pif
C:\My Downloads\play station emulator.exe
C:\My Downloads\play station emulator crack.exe
C:\My Downloads\NBA 2003.exe
C:\My Downloads\NBA 2003 Crack.exe
C:\My Downloads\NBA 2003 serials.epif
C:\My Downloads\anarchist cookbook.pif
C:\My Downloads\ut 2k3.exe
C:\My Downloads\ut 2k3.pif
C:\My Downloads\super mario bros.exe
C:\My Downloads\super mario brothers.exe
C:\My Downloads\winxp.iso.pif
C:\My Downloads\virtual girl - nikki taylor.pif
C:\My Downloads\virtual girl - jammie williams.pif
C:\My Downloads\virtual girl - nikki taylor.pif
C:\My Downloads\virtual girl - melina black pepper.pif
C:\My Downloads\virtual girl - chole.pif
C:\My Downloads\virtual girl - nikki.pif
C:\My Downloads\virtual girl - victoria.pif
C:\My Downloads\virtual girl - tennis girl.pif
C:\My Downloads\virtual girl - vera.pif
C:\My Downloads\virtual girl - wet and wild.pif
C:\My Downloads\virtual girl - judith.pif
C:\My Downloads\virtual girl - business woman.pif
C:\My Downloads\virtual girl - hells angels.pif
C:\My Downloads\virtual girl - mandy.pif
C:\My Downloads\virtual girl - courtney.pif
C:\My Downloads\virtual girl - jenn.pif
C:\My Downloads\virtual girl - Rebecca.pif
C:\My Downloads\virtual girl - bunny.pif
C:\My Downloads\virtual girl - ALL.pif
C:\My Downloads\virtual girl - adriana.pif
C:\My Downloads\virtual girl - bailey short skirt.pif
C:\My Downloads\virtual girl - completely nude.pif
C:\My Downloads\virtua girl - nikki taylor.pif
C:\My Downloads\virtua girl - jammie williams.pif
C:\My Downloads\driver.exe
C:\My Downloads\gta3.exe
C:\My Downloads\GTA 3 Crack.exe
C:\My Downloads\GTA 3 Serial.exe
C:\My Downloads\fuck.exe
C:\My Downloads\Virtua Sex.exe
C:\My Downloads\HotGirls.exe
C:\My Downloads\worldbook.exe
C:\My Downloads\Virtua Girl (Full).exe
C:\My Downloads\how to use a shell.pif
C:\program files\kazaa lite\my shared folder\hotmail hack.exe
C:\program files\kazaa lite\my shared folder\age of empires 2 crack.exe
C:\program files\kazaa lite\my shared folder\age of empires 2 keygen.exe
C:\program files\kazaa lite\my shared folder\age of empires 2 serials.pif
C:\program files\kazaa lite\my shared folder\age of empires 2 serial.pif
C:\program files\kazaa lite\my shared folder\age of empires 2 help.exe
C:\program files\kazaa lite\my shared folder\age of empires 2.exe
C:\program files\kazaa lite\my shared folder\age of empires 2 cheats.exe
C:\program files\kazaa lite\my shared folder\pamela anderson screen saver.scr
C:\program files\kazaa lite\my shared folder\hondra screen saver.scr
C:\program files\kazaa lite\my shared folder\supra screen saver.scr
C:\program files\kazaa lite\my shared folder\porn screen saver.scr
C:\program files\kazaa lite\my shared folder\fireworks crack.exe
C:\program files\kazaa lite\my shared folder\fireworks serial.pif
C:\program files\kazaa lite\my shared folder\fireworks.exe
C:\program files\kazaa lite\my shared folder\divx pro.exe�C:\program files\kazaa lite\my shared folder\how to hack.exe
C:\program files\kazaa lite\my shared folder\steal usernames.exe
C:\program files\kazaa lite\my shared folder\aim cracker.exe
C:\program files\kazaa lite\my shared folder\aol cracker.exe
C:\program files\kazaa lite\my shared folder\aim password cracker
C:\program files\kazaa lite\my shared folder\aol password cracker.exe
C:\program files\kazaa lite\my shared folder\100 free essays school.pif
C:\program files\kazaa lite\my shared folder\warcraft 3 crack.exe
C:\program files\kazaa lite\my shared folder\warcraft 3 serials.pif
C:\program files\kazaa lite\my shared folder\play station emulator.exe
C:\program files\kazaa lite\my shared folder\play station emulator crack.exe
C:\program files\kazaa lite\my shared folder\NBA 2003.exe
C:\program files\kazaa lite\my shared folder\NBA 2003 Crack.exe
C:\program files\kazaa lite\my shared folder\NBA 2003 serials.epif
C:\program files\kazaa lite\my shared folder\anarchist cookbook.pif
C:\program files\kazaa lite\my shared folder\ut 2k3.exe
C:\program files\kazaa lite\my shared folder\ut 2k3.pif
C:\program files\kazaa lite\my shared folder\super mario bros.exe
C:\program files\kazaa lite\my shared folder\super mario brothers.exe
C:\program files\kazaa lite\my shared folder\winxp.iso.pif
C:\program files\kazaa lite\my shared folder\virtual girl - nikki taylor.pif
C:\program files\kazaa lite\my shared folder\virtual girl - jammie williams.pif
C:\program files\kazaa lite\my shared folder\virtual girl - nikki taylor.pif
C:\program files\kazaa lite\my shared folder\virtual girl - melina black pepper.pif
C:\program files\kazaa lite\my shared folder\virtual girl - chole.pif
C:\program files\kazaa lite\my shared folder\virtual girl - nikki.pif
C:\program files\kazaa lite\my shared folder\virtual girl - victoria.pif
C:\program files\kazaa lite\my shared folder\virtual girl - tennis girl.pif
C:\program files\kazaa lite\my shared folder\virtual girl - vera.pif
C:\program files\kazaa lite\my shared folder\virtual girl - wet and wild.pif
C:\program files\kazaa lite\my shared folder\virtual girl - judith.pif
C:\program files\kazaa lite\my shared folder\virtual girl - business woman.pif
C:\program files\kazaa lite\my shared folder\virtual girl - hells angels.pif
C:\program files\kazaa lite\my shared folder\virtual girl - mandy.pif
C:\program files\kazaa lite\my shared folder\virtual girl - courtney.pif
C:\program files\kazaa lite\my shared folder\virtual girl - jenn.pif
C:\program files\kazaa lite\my shared folder\virtual girl - Rebecca.pif
C:\program files\kazaa lite\my shared folder\virtual girl - bunny.pif
C:\program files\kazaa lite\my shared folder\virtual girl - ALL.pif
C:\program files\kazaa lite\my shared folder\virtual girl - adriana.pif
C:\program files\kazaa lite\my shared folder\virtual girl - bailey short skirt.pif
C:\program files\kazaa lite\my shared folder\virtual girl - completely nude.pif
C:\program files\kazaa lite\my shared folder\virtua girl - nikki taylor.pif
C:\program files\kazaa lite\my shared folder\virtua girl - jammie williams.pif
C:\program files\kazaa lite\my shared folder\virtua girl - nikki taylor.pif�C:\program files\kazaa lite\my shared folder\virtua girl - melina black pepper.pif
C:\program files\kazaa lite\my shared folder\virtua girl - chole.pif
C:\program files\kazaa lite\my shared folder\virtua girl - nikki.pif
C:\program files\kazaa lite\my shared folder\virtua girl - victoria.pif
C:\program files\kazaa lite\my shared folder\virtua girl - tennis girl.pif
C:\program files\kazaa lite\my shared folder\virtua girl - vera.pif
C:\program files\kazaa lite\my shared folder\virtua girl - wet and wild.pif
C:\program files\kazaa lite\my shared folder\virtua girl - judith.pif
C:\program files\kazaa lite\my shared folder\virtua girl - business woman.pif
C:\program files\kazaa lite\my shared folder\virtua girl - hells angels.pif
C:\program files\kazaa lite\my shared folder\virtua girl - mandy.pif
C:\program files\kazaa lite\my shared folder\virtua girl - courtney.pif
C:\program files\kazaa lite\my shared folder\virtua girl - jenn.pif
C:\program files\kazaa lite\my shared folder\virtua girl - Rebecca.pif
C:\program files\kazaa lite\my shared folder\virtua girl - bunny.pif
C:\program files\kazaa lite\my shared folder\virtua girl - ALL.pif
C:\program files\kazaa lite\my shared folder\virtua girl - adriana.pif
C:\program files\kazaa lite\my shared folder\virtua girl - bailey short skirt.pif
C:\program files\kazaa lite\my shared folder\virtua girl - completely nude.pif
C:\program files\kazaa lite\my shared folder\driver.exe
C:\program files\kazaa lite\my shared folder\gta3.exe
C:\program files\kazaa lite\my shared folder\GTA 3 Crack.exe
C:\program files\kazaa lite\my shared folder\GTA 3 Serial.exe
C:\program files\kazaa lite\my shared folder\fuck.exe
C:\program files\kazaa lite\my shared folder\Virtua Sex.exe
C:\program files\kazaa lite\my shared folder\HotGirls.exe
C:\program files\kazaa lite\my shared folder\worldbook.exe
C:\program files\kazaa lite\my shared folder\Virtua Girl (Full).exe
C:\program files\kazaa lite\my shared folder\how to use a shell.pif

Для автоматического запуска при следующем старте системы червь добавляет ссылку на свой исполняемый файл в ключ автозапуска системного реестра: 

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
Configuration Loader=”%System%\winsys.exe”

[HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices]
Configuration Loader=”%System%\winsys.exe”

После инсталляции червь удаляет свой оригинальный файл.

Деструктивная активность

[HKLM\SYSTEM\CurrentControlSet\Control\Lsa]
Restrictanonymous=1

Червь содержит встроенного IRC бота, который позволяет злоумышленникам удаленно получать доступ к компьютеру пользователя и создавать зомби-сети. При запуске червь пытается установить соединение со следующими IRC серверами: 

irc.observers.net
irc.seicher.net
irc.aol-files.com
us.undernet.org
atlanta.ga.us.undernet.org
irc.ef.net

после чего входит в каналы с именами:

  1. Botchan1
  2. botnet!

Далее червь уведомляет злоумышленника по ICQ о успешном заражении компьютера. Посылая управляющие команды червю злоумышленник может выполнять на компьютере пользователя следующие действия: Загружать на компьютер пользователя любые файлы и запускать их. Выполнять любую команду на компьютере пользователя. Производить DDOS атаки на указанный адрес по ICMP протоколу. Производить DDOS атаки на указанный адрес по UDP протоколу. Получать информацию о системе пользователя (версию ОС, количество оперативной памяти, частоту ЦП). Получать настройки сети пользователя: IP адрес машины, DNS сервера и шлюза. Скрытно открывать указанный URL.

Так же данная модификация червя содержит встроенный IRC сервер, который слушает входящие соединения на 113 TCP порту. К данному серверу подключаются копии червя на других зараженных машинах для поддержки работоспособности ботнета в случае падения одного из основных серверов. Бот транслирует поступающие ему команды злоумышленника всем подключенным к его серверу клиентам.

Рекомендации по удалению

Если ваш компьютер не был защищен антивирусом и оказался заражен данной вредоносной программой, то для её удаления необходимо выполнить следующие действия:

  1. При помощи ("Диспетчера задач") завершить процесс червя.
  2. Удалить оригинальный файл червя (его расположение на зараженном компьютере зависит от способа, которым программа попала на компьютер).
  3. Удалить параметры в ключах реестра (как работать с реестром?):
    4. [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
Configuration Loader=”%System%\winsys.exe”
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices]
Configuration Loader=”%System%\winsys.exe”
  4. Удалить файл:
    5. %System%\winsys.exe
  5. Удалить все копии червя на жестком диске компьютера
Источник — «http://www.totalmalwareinfo.com/rus/P2P-Worm.Win32.Lolol.b»
Язык
Видеокурс
Computer and Internet Security Video Tutorials
© 2011 ООО «Лаборатория дизайн и тест». Все права защищены.