ALERTAS EN FORO DE EMERGENCIA - 6

Mensaje por **msc hotline sat** » 30 Abr 2004, 16:21

NUEVA VARIANTE DE VIRUS GAOBOT.ali/ EXPLOIT 04-011

Autor Tema

msc hotline sat

Administrator

España

5003 Mensajes Enviado el 29/04/2004 : 11:52:30

--------------------------------------------------------------------------------

McAfee nos informa hoy de la aparicion de un nuevo virus de la familia del Gaobot, que se pasa a detectar como GAOBOT.ali , el cual entra por no estar parcheado el agujero de seguridad del exploit de vulnerabilidad MS04-011:

_____________________________________________________________________

Trojan Name Risk Assessment

Exploit-MS04-011 Corporate User : Low

Home User : Low

Trojan Information

Discovery Date: 04/28/2004

Origin: Unknown

Length: N/A

Type: Trojan

SubType: Exploit

Minimum DAT: 4354 (04/28/2004)

Updated DAT: 4354 (04/28/2004)

Minimum Engine: 4.2.40

Description Added: 04/28/2004

Description Modified: 04/29/2004 12:58 AM (PT)

Trojan Characteristics:

The following Microsoft vulnerabilities were announced on April 13, 2004.

MS04-011 - Security Update for Microsoft Windows (835732)

For Microsoft's details of this vulnerability please see:

http://www.microsoft.com/en/us/default.aspxtechnet/security/bulletin/MS04-011.mspx

Malware exploiting this vulnerability can get instant access to a machine whichout any interaction of the user. We received reports, that unpatched system may reboot when attacked and displayed an error after the next reboot saying :"LSA shell error".

Based on the type of attack, the MS04-11 update covers a few vulnerabilities, the symptoms may differ.

Generic detection for threats attempting to exploit MS04-011 (CAN-2003-0907) is included in the 4351 DAT files as Exploit-HelpInject when running Script and Macro Heuristics.

Further information about the MS04-011 - 014 advisories are available at:

http://vil.nai.com/vil/content/v_101170.htm

Example: W32/Gaobot.worm.ali uses this vulnerability to spread. Information about this worm are available at:

http://vil.nai.com/vil/content/v_125006.htm

Method Of Infection

An attacker could exploit the vulnerability by creating a specially crafted message and send it to an affected system, which could then cause the affected system to execute code.

_____________________________________________________________________

Aunque este virus no entra por agujero RPC, lo hemos incluido en el nuevo ELIRPCA.EXE v 4.4 que controla todos los demás Gaobot, además de detectar si se tiene en parche MS04-014, el cual si no lo detecta se indica actualizar conectando con windowsupdate, que ya pondrá los que le falten, uncluyendo el 011 si es el caso.

Sobre el nuevo Gaobot.ali, copio a continuacion lo indicado tambien por McAfee, que se controlará con DATS 4355, y hasta entonces con los DATS diarios (SDATDAILY) a partir de hoy:

_____________________________________________________________________

Virus Name Risk Assessment

W32/Gaobot.worm.ali Corporate User : Low

Home User : Low

Virus Information

Discovery Date: 04/28/2004

Origin: Unknown

Length: 138,752 bytes

Type: Virus

SubType: Internet Worm

Minimum DAT: 4355 (05/05/2004)

Updated DAT: 4355 (05/05/2004)

Minimum Engine: 4.2.40

Description Added: 04/28/2004

Description Modified: 04/28/2004 11:06 PM (PT)

Description Menu

Virus Characteristics

Symptoms

Method Of Infection

Removal Instructions

Variants / Aliases

Rate This page

Print This Page

Email This Page

Legend

Virus Characteristics:

At the time of this writing, there are more than 900 variants of the Gaobot virus in existence. The source code for Gaobot was posted to various websites resulting in many new variants being created each week.

W32/Gaobot.worm.ali stands out from some others as it seems to be the first variant that incorporates code to exploit a MS04-011 vulnerability (LSASS Vulnerability (CAN-2003-0533)). This particular variant is not currently a threat as it is dependant on an IRC server, which is no longer available. However, it is presumed that other variants will likely follow soon, which are functional. Details of those variants will likely vary from this one.

For maximum protection against the Gaobot family, users are recommended to:

use the latest engine/DATs combination

ensure the scanning of compressed files is enabled

keep Windows systems patched by using Windows Update

ensure weak username/passwords are not used

run a personal desktop firewall application

The virus contains lots of remote access functionality, including:

Create/Remove services

Denial of service attack

FTP/HTTP functions (upload, download files, etc)

IRC functions

Retrieve system information (RAM, CPU, Disk Space)

Secure/insecure Windows shares

Shutdown/reboot/logoff computer

Sniffer

Steal CD and product keys for various products

Terminate running processes

Top of Page

Symptoms

When run, this virus copies itself to the %SysDir% directory as msiwin84.exe and creates several registry run keys in order to load itself at system startup.

(Where %SysDir% is the System directory, for example: C:\WINNT\SYSTEM32)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\

CurrentVersion\Run "Microsoft Update" = msiwin84.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\

CurrentVersion\RunServices "Microsoft Update" = msiwin84.exe

The virus attempts to run a speed test for Internet connectivity. The following domains are contacted to check for broadband connections:

de.yahoo.com

nitro.ucsc.edu

verio.fr

http://www.1und1.de

http://www.above.net

http://www.belwue.de

http://www.burst.net

http://www.cogentco.com

http://www.d1asia.com

http://www.level3.com

http://www.lib.nthu.edu.tw

http://www.nifty.com

http://www.nocster.com

http://www.rit.edu

http://www.ryan1918.com

http://www.ryan1918.net

http://www.ryan1918.org

http://www.schlund.net

http://www.st.lib.keio.ac.jp

http://www.stanford.edu

http://www.switch.ch

http://www.utwente.nl

http://www.verio.com

http://www.xo.net

yahoo.co.jp

The virus attempts to connect to an Internet Relay Chat server (TCP Port 6667) to allow for a remote attack to send commands to the infected system:

malalala.bin-laden.cc

This threat is reliant upon connecting to this IRC server, and receiving spread commands in order to propagate. At the time of this writing, the DNS entry for this domain has been set to 0.0.0.0, therefore crippling this threat.

Infected systems list on two random TCP ports, which are control ports for attackers to exploit.

The local HOSTS file (%SysDir%\drivers\etc\hosts) is overwriten to block access to the following sites (note this file is detected with current DAT files as Qhosts.apd ):

avp.com

ca.com

customer.symantec.com

dispatch.mcafee.com

download.mcafee.com

f-secure.com

kaspersky.com

kaspersky-labs.com

liveupdate.symantec.com

liveupdate.symantecliveupdate.com

mast.mcafee.com

mcafee.com

my-etrust.com

nai.com

networkassociates.com

rads.mcafee.com

secure.nai.com

securityresponse.symantec.com

sophos.com

symantec.com

trendmicro.com

update.symantec.com

updates.symantec.com

us.mcafee.com

viruslist.com

viruslist.com

http://www.avp.com

http://www.ca.com

http://www.f-secure.com

http://www.grisoft.com

http://www.kaspersky.com

http://www.mcafee.com

http://www.my-etrust.com

http://www.nai.com

http://www.networkassociates.com

http://www.sophos.com

http://www.symantec.com

http://www.trendmicro.com

http://www.viruslist.com

It also attempts to terminate the following processes:

_AVP32.EXE

_AVPCC.EXE

_AVPM.EXE

53ARCH.EXE

ACKWIN32.EXE

ADAWARE.EXE

ADVXDWIN.EXE

AGENTSVR.EXE

AGENTW.EXE

ALERTSVC.EXE

ALEVIR.EXE

ALOGSERV.EXE

AMON.EXE

AMON9X.EXE

ANTI-TROJAN.EXE

ANTIVIRUS.EXE

ANTS.EXE

APIMONITOR.EXE

APLICA32.EXE

APORTS.EXE

APVXDWIN.EXE

ARMKILLER

ARR.EXE

ATCON.EXE

ATGUARD.EXE

ATRO55EN.EXE

ATUPDATER.EXE

ATWATCH.EXE

AU.EXE

AUPDATE.EXE

AUTODOWN.EXE

AUTO-PROTECT.NAV80TRY.EXE

AUTOTRACE.EXE

AUTOUPDATE.EXE

AV.EXE

AVCONSOL.EXE

AVE32.EXE

AVGCC32.EXE

AVGCTRL.EXE

AVGNT.EXE

AVGSERV.EXE

AVGSERV9.EXE

AVGUARD.EXE

AVGW.EXE

AVKPOP.EXE

AVKSERV.EXE

AVKSERVICE.EXE

AVKWCTl9.EXE

AVLTMAIN.EXE

AVNT.EXE

AVP.EXE

AVP32.EXE

AVPCC.EXE

AVPDOS32.EXE

AVPM.EXE

AVPTC32.EXE

AVPUPD.EXE

AVSCHED32.EXE

AVSYNMGR.EXE

AVWIN95.EXE

AVWINNT.EXE

AVWUPD.EXE

AVWUPD32.EXE

AVWUPSRV.EXE

AVXMONITOR9X.EXE

AVXMONITORNT.EXE

AVXQUAR.EXE

BACKWEB.EXE

BARGAINS.EXE

BCW.EXE

BD_PROFESSIONAL.EXE

BEAGLE.EXE

BELT.EXE

BIDEF.EXE

BIDSERVER.EXE

BIPCP.EXE

BIPCPEVALSETUP.EXE

BISP.EXE

BLACKD.EXE

BLACKICE.EXE

BLSS.EXE

BOOTCONF.EXE

BOOTWARN.EXE

BORG2.EXE

BPC.EXE

BRASIL.EXE

BS120.EXE

BUNDLE.EXE

BVT.EXE

CCAPP.EXE

CCEVTMGR.EXE

CCPXYSVC.EXE

CDP.EXE

CFD.EXE

CFGWIZ.EXE

CFIADMIN.EXE

CFIAUDIT.EXE

CFINET.EXE

CFINET32.EXE

Claw95.EXE

CLAW95CF.EXE

CLEAN.EXE

CLEANER.EXE

CLEANER3.EXE

CLEANPC.EXE

CLICK.EXE

CLIENT.EXE

CMD32.EXE

CMESYS.EXE

CMGRDIAN.EXE

CMON016.EXE

CONDOM.EXE

CONNECTIONMONITOR.EXE

CPD.EXE

CPF9X206.EXE

CPFNT206.EXE

CRACKER.EXE

CTRL.EXE

CV.EXE

CWNB181.EXE

CWNTDWMO.EXE

DATEMANAGER.EXE

DCOMX.EXE

DEBUG.EXE

DEFALERT.EXE

DEFSCANGUI.EXE

DEFWATCH.EXE

DEPUTY.EXE

DIVX.EXE

DLLCACHE.EXE

DLLREG.EXE

DOORS.EXE

DPF.EXE

DPFSETUP.EXE

DPPS2.EXE

DRWATSON.EXE

DRWEB32.EXE

DRWEBUPW.EXE

DSSAGENT.EXE

DUMP.EXE

DVP95.EXE

DVP95_0.EXE

ECENGINE.EXE

EFPEADM.EXE

EMSW.EXE

ENT.EXE

ESAFE.EXE

ESCANH95.EXE

ESCANHNT.EXE

ESCANV95.EXE

ESPWATCH.EXE

ETHEREAL.EXE

ETRUSTCIPE.EXE

EVPN.EXE

EXANTIVIRUS-CNET.EXE

EXE.AVXW.EXE

EXPERT.EXE

EXPLORE.EXE

F-AGNT95.EXE

F-AGOBOT.EXE

FAMEH32.EXE

FAST.EXE

FCH32.EXE

FIH32.EXE

FINDVIRU.EXE

FIREWALL.EXE

FLOWPROTECTOR.EXE

FNRB32.EXE

FPORT.EXE

FPROT.EXE

F-PROT.EXE

F-PROT95.EXE

FP-WIN.EXE

FP-WIN_TRIAL.EXE

FRHED.EXE

FRW.EXE

FSAA.EXE

FSAV.EXE

FSAV32.EXE

FSAV530STBYB.EXE

FSAV530WTBYB.EXE

FSAV95.EXE

FSGK32.EXE

FSM32.EXE

FSMA32.EXE

FSMB32.EXE

F-STOPW.EXE

FW.EXE

GATOR.EXE

GBMENU.EXE

GBPOLL.EXE

GENERICS.EXE

GMT.EXE

GUARD.EXE

GUARDDOG.EXE

HACKTRACERSETUP.EXE

HBINST.EXE

HBSRV.EXE

HIJACKTHIS.EXE

HONEYD.EXE

HOTACTIO.EXE

HOTPATCH.EXE

HTLOG.EXE

HTPATCH.EXE

HWPE.EXE

HXDL.EXE

HXIUL.EXE

IAMAPP.EXE

IAMSERV.EXE

IAMSTATS.EXE

IBMASN.EXE

IBMAVSP.EXE

ICLOAD95.EXE

ICLOADNT.EXE

ICMON.EXE

ICSUPP95.EXE

ICSUPPNT.EXE

IDLE.EXE

IEDLL.EXE

IEDRIVER.EXE

IEXPLORER.EXE

IFACE.EXE

IFW2000.EXE

IISLOCKD.exe

INETLNFO.EXE

INFUS.EXE

INFWIN.EXE

INIT.EXE

INTDEL.EXE

INTREN.EXE

IOMON98.EXE

IPARMOR.EXE

IRIS.EXE

ISASS.EXE

ISRV95.EXE

ISTSVC.EXE

JAMMER.EXE

JDBGMRG.EXE

JEDI.EXE

KAVLITE40ENG.EXE

KAVPERS40ENG.EXE

KAVPF.EXE

KAZZA.EXE

KD.EXE

KEENVALUE.EXE

KERIO-PF-213-EN-WIN.EXE

KERIO-WRL-421-EN-WIN.EXE

KERIO-WRP-421-EN-WIN.EXE

KERNEL32.EXE

KILLPROCESSSETUP161.EXE

LAUNCHER.EXE

LDNETMON.EXE

LDPRO.EXE

LDPROMENU.EXE

LDSCAN.EXE

LNETINFO.EXE

LOADER.EXE

LOCALNET.EXE

LOCKDOWN.EXE

LOCKDOWN2000.EXE

LOGGER.EXE

LOGVIEWER.EXE

LOOKOUT.EXE

LORDPE.EXE

LSETUP.EXE

LUALL.EXE

LUAU.EXE

LUCOMSERVER.EXE

LUINIT.EXE

LUSPT.EXE

MAPISVC32.EXE

MCAGENT.EXE

MCMNHDLR.EXE

MCSHIELD.EXE

MCTOOL.EXE

MCUPDATE.EXE

MCVSRTE.EXE

MCVSSHLD.EXE

MD.EXE

MFIN32.EXE

MFW2EN.EXE

MFWENG3.02D30.EXE

MGAVRTCL.EXE

MGAVRTE.EXE

MGHTML.EXE

MGUI.EXE

MINILOG.EXE

MMOD.EXE

MONITOR.EXE

MOOLIVE.EXE

MOSTAT.EXE

MPFAGENT.EXE

MPFSERVICE.EXE

MPFTRAY.EXE

MRFLUX.EXE

MSAPP.EXE

MSBB.EXE

MSBLAST.EXE

MSCACHE.EXE

MSCCN32.EXE

MSCMAN.EXE

MSCONFIG.EXE

MSDM.EXE

MSDOS.EXE

MSIEXEC16.EXE

MSINFO32.EXE

MSLAUGH.EXE

MSMGT.EXE

MSMSGRI32.EXE

MSSMMC32.EXE

MSSYS.EXE

MSVXD.EXE

MU0311AD.EXE

MWATCH.EXE

N32SCANW.EXE

NAV.EXE

NAVAP.NAVAPSVC.EXE

NAVAPSVC.EXE

NAVAPW32.EXE

NAVDX.EXE

NAVENGNAVEX15.NAVLU32.EXE

NAVLU32.EXE

NAVNT.EXE

NAVSTUB.EXE

NAVW32.EXE

NAVWNT.EXE

NC2000.EXE

NCINST4.EXE

NDD32.EXE

NEOMONITOR.EXE

NEOWATCHLOG.EXE

NETARMOR.EXE

NETD32.EXE

NETINFO.EXE

NETMON.EXE

NETSCANPRO.EXE

NETSPYHUNTER-1.2.EXE

NETSTAT.EXE

NETUTILS.EXE

NETWORKACTIVSNIFFERV1.4.EXE

NISSERV.EXE

NISUM.EXE

NMAIN.EXE

NOD32.EXE

NOD32CC.EXE

NOD32M2.EXE

NORMIST.EXE

NORTON_INTERNET_SECU_3.0_407.EXE

NOTSTART.EXE

NPF40_TW_98_NT_ME_2K.EXE

NPFMESSENGER.EXE

NPROTECT.EXE

NPSCHECK.EXE

NPSSVC.EXE

NSCHED32.EXE

NSSYS32.EXE

NSTASK32.EXE

NSUPDATE.EXE

NT.EXE

NTRTSCAN.EXE

NTVDM.EXE

NTXconfig.EXE

NUI.EXE

NUPGRADE.EXE

NVARCH16.EXE

NVC95.EXE

NVSVC32.EXE

NWINST4.EXE

NWSERVICE.EXE

NWTOOL16.EXE

OLLYDBG.EXE

ONSRVR.EXE

OPTIMIZE.EXE

OSTRONET.EXE

OTFIX.EXE

OUTPOST.EXE

OUTPOSTINSTALL.EXE

OUTPOSTPROINSTALL.EXE

PADMIN.EXE

PANIXK.EXE

PATCH.EXE

PAVCL.EXE

PAVPROXY.EXE

PAVSCHED.EXE

PAVW.EXE

PCC2002S902.EXE

PCC2K_76_1436.EXE

PCCIOMON.EXE

PCCNTMON.EXE

PCCWIN97.EXE

PCCWIN98.EXE

PCDSETUP.EXE

PCFWALLICON.EXE

PCIP10117_0.EXE

PCSCAN.EXE

PDSETUP.EXE

PEDASM.EXE

PENIS.EXE

PERISCOPE.EXE

PERSFW.EXE

PERSWF.EXE

PF2.EXE

PFWADMIN.EXE

PGMONITR.EXE

PINGSCAN.EXE

PLATIN.EXE

PMDUMP.EXE

PMON

POP3TRAP.EXE

POPROXY.EXE

POPSCAN.EXE

PORTDETECTIVE.EXE

PORTMONITOR.EXE

POWERSCAN.EXE

PPINUPDT.EXE

PPTBC.EXE

PPVSTOP.EXE

PRIZESURFER.EXE

PRMT.EXE

PRMVR.EXE

PROCDUMP.EXE

PROCESSMONITOR.EXE

PROCEXPLORERV1.0.EXE

PROGRAMAUDITOR.EXE

PROPORT.EXE

PROTECTX.EXE

PSPF.EXE

PURGE.EXE

*****.EXE

PVIEW95.EXE

QCONSOLE.EXE

QSERVER.EXE

RAPAPP.EXE

RAV7.EXE

RAV7WIN.EXE

RAV8WIN32ENG.EXE

RAY.EXE

RB32.EXE

RCSYNC.EXE

REALMON.EXE

REGCLEANER.EXE

REGED.EXE

REGEDIT.EXE

REGEDT32.EXE

RERGCLEANR.EXE

RESCUE.EXE

RESCUE32.EXE

RRGUARD.EXE

RSHELL.EXE

RTVSCAN.EXE

RTVSCN95.EXE

RULAUNCH.EXE

RUN32DLL.EXE

RUNDLL.EXE

RUNDLL16.EXE

RUXDLL32.EXE

SAFEWEB.EXE

SAHAGENT.EXE

SAVE.EXE

SAVENOW.EXE

SBSERV.EXE

SC.EXE

SCAM32.EXE

SCAN32.EXE

SCAN95.EXE

SCANPM.EXE

SCRSCAN.EXE

SCRSVR.EXE

SCVHOST.EXE

SD.EXE

SERV95.EXE

SERVICE.EXE

SERVLCE.EXE

SERVLCES.EXE

SETUP_FLOWPROTECTOR_US.EXE

SETUPVAMEEVAL.EXE

SFC.EXE

SGSSFW32.EXE

SH.EXE

SHELLSPYINSTALL.EXE

SHN.EXE

SHOWBEHIND.EXE

SMC.EXE

SMS.EXE

SMSS32.EXE

SOAP.EXE

SOFI.EXE

SPERM.EXE

SPF.EXE

SPHINX.EXE

SPOLER.EXE

SPOOLCV.EXE

SPOOLSV32.EXE

SPYXX.EXE

SREXE.EXE

SRIN.EXE

SRNG.EXE

SS3EDIT.EXE

SSG_4104.EXE

SSGRATE.EXE

ST2.EXE

START.EXE

STCLOADER.EXE

SUPFTRL.EXE

SUPPORT.EXE

SUPPORTER5.EXE

SVC.EXE

SVCHOSTC.EXE

SVCHOSTS.EXE

SVSHOST.EXE

SWEEP95.EXE

SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE

SYMPROXYSVC.EXE

SYMTRAY.EXE

SYSEDIT.EXE

SYSTEM.EXE

SYSTEM32.EXE

SYSUPD.EXE

TASKMG.EXE

TASKMO.EXE

TASKMON.EXE

TAUMON.EXE

TBSCAN.EXE

TC.EXE

TCA.EXE

TCM.EXE

TCPVIEW.EXE

TDS2-98.EXE

TDS2-NT.EXE

TDS-3.EXE

TEEKIDS.EXE

TEST.EXE

TFAK.EXE

TFAK5.EXE

TGBOB.EXE

TITANIN.EXE

TITANINXP.EXE

TRACERT.EXE

TRICKLER.EXE

TRJSCAN.EXE

TRJSETUP.EXE

TROJANTRAP3.EXE

TSADBOT.EXE

TVMD.EXE

TVTMD.EXE

UNDOBOOT.EXE

UPDAT.EXE

UPDATE.EXE

UPGRAD.EXE

UTPOST.EXE

VBCMSERV.EXE

VBCONS.EXE

VBUST.EXE

VBWIN9X.EXE

VBWINNTW.EXE

VCSETUP.EXE

VET32.EXE

VET95.EXE

VETTRAY.EXE

VFSETUP.EXE

VIR-HELP.EXE

VIRUSMDPERSONALFIREWALL.EXE

VNLAN300.EXE

VNPC3000.EXE

VPC32.EXE

VPC42.EXE

VPFW30S.EXE

VPTRAY.EXE

VSCAN40.EXE

VSCENU6.02D30.EXE

VSCHED.EXE

VSECOMR.EXE

VSHWIN32.EXE

VSISETUP.EXE

VSMAIN.EXE

VSMON.EXE

VSSTAT.EXE

VSWIN9XE.EXE

VSWINNTSE.EXE

VSWINPERSE.EXE

W32DSM89.EXE

W9X.EXE

WATCHDOG.EXE

WEBDAV.EXE

WEBSCANX.EXE

WEBTRAP.EXE

WFINDV32.EXE

WGFE95.EXE

WHOSWATCHINGME.EXE

WIMMUN32.EXE

WIN32.EXE

WIN32US.EXE

WINACTIVE.EXE

WIN-BUGSFIX.EXE

WINDBG.EXE

WINDOW.EXE

WINDOWS.EXE

WINDUMP.EXE

WININETD.EXE

WININIT.EXE

WININITX.EXE

WINLOGIN.EXE

WINMAIN.EXE

WINNET.EXE

WINPPR32.EXE

WINRECON.EXE

WINSERVN.EXE

WINSSK32.EXE

WINSTART.EXE

WINSTART001.EXE

WINTSK32.EXE

WINUPDATE.EXE

WKUFIND.EXE

WNAD.EXE

WNT.EXE

WRADMIN.EXE

WRCTRL.EXE

WSBGATE.EXE

WUPDATER.EXE

WUPDT.EXE

WYVERNWORKSFIREWALL.EXE

XPF202EN.EXE

ZAPRO.EXE

ZAPSETUP3001.EXE

ZATUTOR.EXE

ZONALM2601.EXE

ZONEALARM.EXE

Top of Page

Method Of Infection

This worm propagates via accessible or poorly secured network shares, and is intended to take advantage of high profile exploits.

When it attempts to spread through default administrative shares:

c

c$

d$

e$

admin$

print$

The worm contains a list of common user-names and passwords. This list contains typical poor username/password combinations. Users should avoid securing shares with passwords containing key sequences such as:

!@#$%^&*

!@#$%^&

!@#$%^

!@#$%

!@#$

000000

00000000

007

110

111

111111

11111111

12

121212

123

123123

1234

12345

123456

1234567

12345678

123456789

1234qwer

123abc

123asd

123qwe

1776

1778

2002

2004

23

2525

2600

42

54321

654321

666

69

88888888

aaa

abc

abc123

abcd

ACCESS

Admin

admin

admin123

administrador

Administrador

Administrateur

ADMINISTRATOR

administrator

Administrator

admins

alpha

ami

amie

anonymous

asdf

asdfgh

asdfghjkl

askaban

ASP

athlon

azerty

azkaban

baby

backdoor

BACKUP

backup

ball

beer

benutzer

Benutzer

biere

bill

black

blowjob

blue

bong

Box

BOX

box

buckbeak

calcolatore

carte

cauldron

cederom

changeme

child

clit

CNN

colin

computadora

computer

condom

Convidado

Coordinatore

copin

copine

crash

cum

data

database

Default

Dell

dementor

devil

dick

dope

drop

drugs

dude

dumbledore

ecran

enable

erik

fanny

feds

fish

foobar

fool

freak

f**k

f**ked

f**kyou

f**k-you

gast

Gast

gay

george

god

godblessyou

gryffindor

Guest

hagrid

harry

hax

hermine

hermione

hogwarts

hole

home

homework

idiot

ihavenopass

imprimeur

Internet

Inviter

iraq

jackdaniels

jim

kanri

kanri-sha

karl

kate

kids

kt

lab

leet

linux

LOCAL

Login

lol

love

madre

mark

mary

master

merde

metal

mgmt

mice

mike

mince

moonshine

mouse

mybaby

mybox

mygirl

myhole

mypass

mypc

mysql

newfie

newfy

nigger

noob

null

OEM

office

oil

opteron

oracle

ordinateur

Ospite

own

owned

OWNER

owner

Owner

pass

PASSWD

passwd

Password

password

password123

pat

patrick

pc

penis

peter

PHP

pink

poiut

poiuytrewq

poop

porn

pot

potter

private

purple

*****

pw

pwd

pwned

quidditch

qwer

qwerty

qwerty123

qwertyuiop

r00t

rain

rapeme

rat

red

red123

reseau

ROOT

root

rooted

sa

school

secret

secrets

semen

SERVER

server

sex

share

sistema

souris

sql

sqlagent

sql-server

stacey

stacy

Standard

stefan

steve

steven

student

super

superman

supersecret

switch

sybase

SYSTEM

system

teacher

TEMP

temp

tennessee

Tennessee

TEST

Test

test123

Texas

texas

tim

tom

UNIX

user

User

utente

Utente

utilisateur

Utilisateur

vagina

Verwalter

w33d

washington

Washington

web

webmaster

weed

werty

west

West

wet

wh0re

whiskey

whisky

whore

win

windows2k

windows98

windowsME

WindowsXP

windoze

wmd

work

workplace

wwwadmin

x

xp

xxx

xxyyzz

xyz

yellow

yxcv

z

zxcv

zxcvbnm

_____________________________________________________________________

En cuanto esté restablecido el foro habitual, subiremos la utilidad ELIRPCA v 4.4 que con el que ya lo controlamos y eliminamos.

saludos

ms, 29-04-2004