live casino online

±õ²Ô²õ³Ù²¹±ô²¹³¦¾±¨®²Ô

Agrega las carpetas siguientes:

• %Windows%\PCHEALTH\AutoClean

(Nota: %Windows% es la carpeta de Windows, que suele estar en C:\Windows o C:\WINNT).

Agrega los procesos siguientes:

• explorer.exe

T¨¦cnica de inicio autom¨¢tico

Agrega las siguientes entradas de registro para permitir su ejecuci¨®n autom¨¢tica cada vez que se inicia el sistema:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
AutoProtect = %Windows%\pchealth\AutoClean\AutoProtect.vbs

Rutina de infiltraci¨®n

Infiltra los archivos siguientes:

• %Windows%\pchealth\AutoClean\AutoProtect.vbs - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\autorun.inf - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\call.bat - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\ComboKill.bat - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\invis.vbs - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\Replicate.vbs - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\shh.bat - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\Patch\PatchIt.bat - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\Patch\update003.bat - also detected as TROJ_SCARECROW.A

(Nota: %Windows% es la carpeta de Windows, que suele estar en C:\Windows o C:\WINNT).

Este malware define los atributos del/de los archivo(s) infiltrado(s) de la siguiente manera:

• Read-Only, Hidden, and System

Otros detalles

Seg¨²n el an¨¢lisis de los c¨®digos, tiene las siguientes capacidades:

• Drops the following files in the root directory of the drive where it was executed: autorun.inf - also detected as TROJ_SCARECROW.A ComboKill.bat - also detected as TROJ_SCARECROW.A AutoClean\AutoProtect.vbs - also detected as TROJ_SCARECROW.A AutoClean\ComboKill.bat - also detected as TROJ_SCARECROW.A AutoClean\Replicate.vbs - also detected as TROJ_SCARECROW.A AutoClean\shh.bat - also detected as TROJ_SCARECROW.A It checks if the following files exist, most of which are related to other malware:
  
  • %Windows%\System\lsas.exe
  • %User Profile%\lsass.exe
  • %Windows%\Tasks\Scvhost.exe
  • {drive letter}\RECYCLER {drive letter}\New.exe
  • {drive letter}\start.exe

  If it finds matches, it terminates the process, remove the attributes, Read-only, Hidden, and System of the file, then deletes the associated files and registries. Below is the list of files:
  

  • %Windows%\System\lsas.exe
  • C:\Documents and Settings\Administrator\lsass.exe
  • %User Profile%\lsass.exe %Windows%\Tasks\Scvhost.exe
  • C:\New.exe %Windows%\Tasks\Scvhost.exe %Windows%\System\bs.pif
  • {drive letter}\RECYCLER {drive letter}\autorun.inf
  • {drive letter}\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Desktop.ini
  • {drive letter}\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Autorunme.exe
  • {drive letter}\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213
  • {drive letter}\RECYCLER {drive letter}\New.exe {drive letter}\start.exe

  Below is the list of registry entries:
  

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  Windows Logistics=

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  LSA Shellu=

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  Load=

  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar
  BackBitmapIE5=

  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar
  BackBitmapShell=

(Nota: %User Profile% es la carpeta de perfil del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Profiles\{nombre de usuario}, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario} y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}).