Mensaje
por msc hotline sat » 19 Sep 2005, 18:11
Bueno, su pantalla nos ha servido por lo menos para ver la descripcion de McAfee de este Backdoor AZV:
http://vil.nai.com/vil/content/v_100723.htm
[quote]
Trojan Name Risk Assessment
BackDoor-AZV Corporate User : Low
Home User : Low
Trojan Information
Discovery Date: 10/02/2003
Origin: Unknown
Length: Various
Type: Trojan
SubType: Remote Access
Minimum DAT: 4297 (10/08/2003)
Updated DAT: 4418 (01/05/2005)
Minimum Engine: 4.1.60
Description Added: 10/02/2003
Description Modified: 10/14/2004 5:39 AM (PT)
Description Menu
Trojan Characteristics
Symptoms
Method Of Infection
Removal Instructions
Variants / Aliases
Rate This page
Print This Page
Email This Page
Legend
Trojan Characteristics:
-- Update Oct. 14th 2004 --
AVERT has received several field samples with the following subject line: David Beckham Caught With Spanish Girl
The attachment within the email is already detected as BackDoor-AZV in the 4398 Dats. If successfully executed, the trojan will attempt to connect to IRC via port 6667 for remote commands.
-- Update Dec 11th 2003 --
An additional variant of this remote access trojan has been found in the field, which has been packed with the MoleBox packing application. Detection of this is included in the 4309 DAT files.
--
AVERT has identified a few incidents of this remote access trojan being spammed to newsgroups and recommend that users disallow scripts when viewing posts, and use a newsgroup reader which has this option. Alternatively this option can be set for the Internet Zone in the security settings of IE5. AVERT also recommends adding ".HTA" to the extension list for pre 4.5 products. The following URL was known to contain the worm:
http://home.attbi.com/(blocked)/ChristinaAguilera.scr
Since there are multiple versions of this trojan, the icon used may vary. The icon used will typically be misleading or enticing, for example:
Once executed, the trojan creates a mutex to ensure only one instance is running. The name of this mutex varies between variants, for example:
botsmutex
whatthefuck
VidCap32
judge
The trojan copies itself to %SysDir% as WIN32SERVER.SCR or WIN32SERVER.EXE ( variant dependent) and hooks the following Registry key to run itself at startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
Run "Winsock32driver" = win32server.scr / win32server.scr
(where %SYSDIR% is C:\windows\system, C:\winnt\system)
Once running, the trojan attempts to connect to an IRC server (using destination port 6666 or 6667). Subsequents commands may be received via IRC, and include the following:
download remote file
act as socks4 proxy
terminate process
read IRC log file
Top of Page
Symptoms
Existence of the abovementioned files and registry keys.
Firewall reports "Generic Host Process for Win32 Services" requesting for access to an unexpected domain (remote port 6666 or 6667), eg:
hackarmy.tk
packets.kicks-ass.org
Top of Page
Method Of Infection
Accessing URLs which leads the trojan to be downloaded onto the system.
Receiving this trojan in HTML emails from newsgroups.
Top of Page
Removal Instructions
All Users:
Use specified engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations
Top of Page
Variants
Name Type Sub Type Differences
Top of Page
Aliases
Name
Backdoor.Hackerarmy (kasp)
Troj/Hackarmy-A (Sophos)
W32/Rawbot.worm
[/quote]
Vea si en la carpeta de sistema tiene el fichero win32server.scr o con igual nombre pero extension EXE, y si es asi, envienoslo a zonavirus@satinfo.es con la referencia "REF BDAZV"
Tras ello, pruebe de arrancar en modo seguro, desactivar la restauracion de sistema si usa XP y lanzar el antivirus, que deberñia ser capaz de detectarlo y eliminarlo.
Independientemente con la muestra implementaremos en una de nuestras utikidades el contril y eliminacion automatica, posiblemente con el ELISTARA.EXE, en una proixima version que ya le informariamos cual, como respuesta de este Tema
saludos
ms, 19-09-2005
msc hotline sat Virus Research Engineer 