Reply to thread

Message: <blockquote data-quote="Manojfdo" data-source="post: 4230393" data-attributes="member: 3576">Pinch VIRUS DETAILS:Conficker.CWin32/Conficker.CDate Published:11 Mar 2009Last Updated:11 Mar 2009Threat AssessmentOverall Risk: LowWild: LowDestructiveness: MediumPervasiveness: MediumCharacteristicsType : WormCategory : Win32Also known as: Worm:Win32/Conficker.D (MS OneCare), W32/Confick-G (Sophos), Trojan.Win32.Pakes.ngs (Kaspersky)Method of InfectionDevlishWhen executed, Win32/Conficker.C drops a copy of itself using a random filename in the %System% directory. It may also drop copies of itself in the following directories:%Program Files%\Windows NT%Program Files%\Windows Media Player%Program Files%\Internet Explorer%Program Files%\Movie MakerFor these and other dropped files, Win32/Conficker.C:* Sets Read Only, Hidden and System file attributes* Generates a file creation/access time-stamp based on that of "kernel32.dll"* Creates access control entries* Exclusively locks the file, thus restricting access and privilegesNote: %System% and %Program Files% are variable locations. The malware determines the locations of these folders by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95,98 and ME is C:\Windows\System; for XP and Vista is C:\Windows\System32. A typical location for the Program Files folder would be C:\Program Files.In order to automatically execute at each startup, it adds the registry entry below:HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<random string> = "rundll32.exe <worm executable>, <random string>"Conficker also registers a service with a random name created by combining a word from this list:AppAudioDMEREventhelpIasIrLanmanNetNtmsRasRemoteSecSRTapiTrkW32winWmdmWmiwscwuauxmlwith another word from this list:accessagentautologonmanmgmtmonprovservServerServiceSrvsrvsvcSvcSystemTimeThe worm also derives a display name for the service by combining two words from the list below:AuditBackupBootBrowserCenterComponentConfigControlDiscoveryDriverFrameworkHardwareHelperImageInstallerLogonMachineManagementManagerMicrosoftMonitorNetworkNotifyPolicyPowerSecurityShellStorageSupportSystemTaskTimeTrustedUniversalUpdateWindowsFor example, the worm may register a service with these registry entries:HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\DisplayName = "Component Task"HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\Type = 00000020HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\Start = 00000002HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\ErrorControl = 00000000HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\ImagePath = "%Root%\system32\svchost.exe -k netsvcs"HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\ObjectName = "LocalSystem"HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\Description = "<randomly copied from an existing service with a Startup Type of 2 >"HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\Parameters\ServiceDll = "%System%\<worm executable >"<img src="http://www.ca.com/us/securityadvisor/virusinfo/showimage.aspx?caid=77976&name=confickerc_newservice.gif" alt="" class="fr-fic fr-dii fr-draggable " style="" />Note: %Root% is a variable location. The malware determines the location of the current root drive by querying the operating system. A typical location for the root drive would be C:\.Additionally, Win32/Conficker.C checks for and tries to inject code into any processes executed with the commandline parameters "svchost.exe -k NetworkService".PayloadModifies Registry / Lowers Security SettingsWin32/Conficker.C deletes the following registry entry to deactivate Windows Security Center notifications:HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjects\{FD6905CE-952F-41F1-9A6F-135D9C6622CC}It deletes the registry entry below to prevent the operating system from starting in Safe Mode:HKLM\SYSTEM\CurrentControlSet\Control\SafeBootAdditionally, Win32/Conficker.C deletes the below registry entry to prevent "Windows Defender" from executing on system start:HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Windows DefenderDeletes Restore PointsConficker resets all system restore points and deletes any saved system restore points on the affected system.Disables ServicesWin32/Conficker.C looks for and disables the following services if running:wscsvc - Security CenterWinDefend &#150; Windows Defender (available in Vista)wuauserv - Automatic UpdatesBITS - Background Intelligent Transfer ServiceERSvc - Error Reporting ServiceWerSvc - Windows Error Reporting Service (available in Vista)[Image: showimage.aspx?caid=77976&name=c...rvices.gif]<img src="http://www.ca.com/us/securityadvisor/virusinfo/showimage.aspx?caid=77976&name=confickerc_services.gif" alt="" class="fr-fic fr-dii fr-draggable " style="" />Win32/Conficker.C terminates the following security-related processes in an attempt to prevent its removal from the system:autorunsavengerconfickdownadfilemongmerhotfixkb890kb958kidoklwkmbsa.mrt.mrtstubms08-06procexpprocmonregmonscct_syscleantcpviewunlockerwiresharkBlocks WebsitesWin32/Conficker.C hooks the following APIs to monitor and restrict access to security websites:Query_MainDnsQuery_WDnsQuery_UTF8DnsQuery_AsendtoIn its attempt to prevent access to security-related sites for information, help or software updates, the worm attempts to block running applications from accessing URLs containing any of the following strings:avg.avp.bit9.ca.cert.gmer.kav.llnw.llnwd.msdn.msft.nai.sans.vet.agnitumahnlabanti-antivirarcabitavastavgateavirabothuntercastlecopsccollombcentralcommandclamavcomodocomputerassociatesconfickercpsecurecyber-tadb networkassociatesdefenderdrwebdslreportsemsisoftesafeesetetrustewidof-protf-securefortinetfree-avfreeavgdatagrisofthackerwatchhacksofthauriikarusjottik7computingkasperskymalwaremcafeemicrosoftmiragemsftncsimsmvpsmtc.srinod32normannortononecarepandapctoolsprevxptsecurityquickhealremovalrisingrootkitsafety.livesecurecomputingsecureworkssophosspamhausspywaresunbeltsymantectechnetthreatthreatexperttrendmicrotrojanvirscanviruswilderssecuritywindowsupdateDownloads and Executes Arbitrary FilesIf the current system date is on or after 1 April 2009, the worm attempts to access pre-computed domain names to either download an updated copy of itself or download other malware. Below is a list of URL extensions used for pre-computed/generated URLs:vnvcustwtotntltjtcsuskshsgscruropsplpkpenonlnfmymwmumsmnmemdlylvlulilclakzknisirinimiehuhthnhkgygsgrgdfrfmesecdmdkdjczcxcom.vecom.uycom.uacom.twcom.ttcom.trcom.svcom.pycom.ptcom.prcom.pecom.pacom.nicom.ngcom.mxcom.mtcom.lccom.kicom.jmcom.hncom.gtcom.glcom.ghcom.fjcom.docom.cocom.bscom.brcom.bocom.arcom.aicom.agco.zaco.vico.ukco.ugco.nzco.krco.keco.ilco.idco.crcnclchcdcabzbobeatasamagaeac<img src="/styles/default/xenforo/smilies/default/no.gif"  class="smilie" loading="lazy" alt=":no:" title="No    :no:" data-shortname=":no:" /> <img src="/styles/default/xenforo/smilies/default/no.gif"  class="smilie" loading="lazy" alt=":no:" title="No    :no:" data-shortname=":no:" /> <img src="/styles/default/xenforo/smilies/default/no.gif"  class="smilie" loading="lazy" alt=":no:" title="No    :no:" data-shortname=":no:" /> <img src="/styles/default/xenforo/smilies/default/no.gif"  class="smilie" loading="lazy" alt=":no:" title="No    :no:" data-shortname=":no:" /> <img src="/styles/default/xenforo/smilies/default/no.gif"  class="smilie" loading="lazy" alt=":no:" title="No    :no:" data-shortname=":no:" /> <img src="/styles/default/xenforo/smilies/default/no.gif"  class="smilie" loading="lazy" alt=":no:" title="No    :no:" data-shortname=":no:" /> <img src="/styles/default/xenforo/smilies/default/no.gif"  class="smilie" loading="lazy" alt=":no:" title="No    :no:" data-shortname=":no:" /> <img src="/styles/default/xenforo/smilies/default/no.gif"  class="smilie" loading="lazy" alt=":no:" title="No    :no:" data-shortname=":no:" /></blockquote>

Verification: Haya warak paha keeyada? (haya wadi kireema paha)

Top Bottom