C�ch di?t : Rootkit.Win32.Agent.pp

Ng�y ph�t hi?n: 30 ? 11 ? 2007

Hi?m h?a: Rootkit

Chi ti?t k? thu?t : Trojan n�y che gi?u s? hi?n di?n c?a n� trong h? th?ng tr??c ng??i d�ng v� c�c ch??ng tr�nh kh�c. N� l� m?t file h? th?ng c?a Windows. Dung l??ng c?a n� l� 40960 byte v� kh�ng ???c ?�ng g�i. N� ???c vi?t b?ng C.



C�i ??t



Ch??ng tr�nh m� ??c n�y s? ???c c�i ??t tr�n m�y t�nh n?n nh�n c�ng v?i m?t s? ch??ng tr�nh ??c h?i kh�c. N� ??t ?n ho?t ??ng c?a c�c ch??ng tr�nh m� ??c kh�c trong h? th?ng.



Khi ???c kh?i ch?y, trojan s? copy ch�nh b?n th�n n� v�o th? m?c h? th?ng nh? "ctl_w32.sys":

%System%\drivers\ctl_w32.sys

?? ??m b?o Trojan t? ??ng ch?y m?i khi h? th?ng kh?i ??ng, n� t? th�m c�c d?ch v? sau v�o registry h? th?ng:

[HKLM\System\CurrentControlSet\Services\ctl_w32]

"Start" = "dword:0x00000003"

"Type" = "dword:0x00000001"

"ImagePath" = "%System%\drivers\ctl_w32.sys"

Ho?t ??ng



Trojan s? th? truy c?p to�n quy?n v�o driver \\.\Rntm2 n?u n� ???c c�i ??t tr�n h? th?ng. M?t khi ?� th�nh c�ng, Trojan s? t? ??ng x�a file g?c c?a ch�nh n�.



H??ng d?n g? b?



1. N?u m�y t�nh c?a b?n kh�ng c� m?t ch??ng tr�nh di?t virus t? ??ng c?p nh?t, ho?c kh�ng c� m?t gi?i ph�p di?t virus to�n v?n, h�y th?c hi?n theo c�c h??ng d?n sau ?? x�a b? m� ??c kh?i m�y t�nh:X�a kh�a registry h? th?ng sau:

[HKLM\System\CurrentControlSet\Services\ctl_w32]

2. Kh?i ??ng l?i m�y t�nh

3. X�a file sau:

%System%\drivers\ctl_w32.sys

4. C?p nh?t c? s? d? li?u virus v� th?c hi?n qu�t to�n b? m�y t�nh.

Submit Article :- Digg + Technorati + del.icio.us + Stumbleupon + Reddit + BlinkList + Furl + Yahoo+ Blogmarks + Ekstreme Socializer

|