 |
|
 |
|
DizzyX
Administrator
Data inscrierii: 16/Iul/2008
Mesaje: 48
|
|
 |
|
 |
|
 Trimis: 16/07/2008 02:32 Titlul subiectului: Backdoor.Poisonivy.CV |
 |
|
Backdoor.Poisonivy.CV
( Backdoor:W32/PoisonIvy.JT )
Raspandire : scazut
Dauna : mediu
Size: ~12k
Descoperit : 2008 Apr 21
SYMPTOMS:
- The presence of a file named systio.exe in %SYSDIR% and the following registry key:
HKLM\Software\Microsoft\ActiveSetup\Installed Components\{2E811653-4F55-1574-0104-010302040505}\StubPath
value -> %SYSDIR%\systio.exe...
- An instance of Firefox running in background even after Firefox is closed
TECHNICAL DESCRIPTION:
When first run, this malware will make a copy of itself in %SYSDIR%, named systio.exe and then deletes the autentic file. It will also create a file named systio, where it will save information about user's activity. In order to bypass firewall or router protection, it injects its code in the memory space of explorer.exe and firefox.exe (sometimes in the memory space of lsass.exe) and then executes this code. In order to mark its presence in the system it creates a mutex named " )!VoqA.I4 ". It modifies the following registry key in order to run at every system startup:
HKLM\Software\Microsoft\ActiveSetup\Installed Components\{2E811653-4F55-1574-0104-010302040505}\StubPath
value -> %SYSDIR%\systio.exe...
This malware gives access to monitoring user's activity on an infected computer. |
|
FAQ 
Mesaje private 
