• ͺ
Ʈ
ȱǰ
 ̷
Ǽڵ
ϱ
 Ȱ溸
Level3 :
ֽ Ʈ Ȳ   document.write("2017.10.20.0");
̷ Űϱ
̷
   
 μ  
Trojan-W32/Dropper.1593248
̷ Trojan ȯ
߰ 01010101
Ȯ Ʈũ
̷ ũ 167765 ÷
Ŭ̾Ʈ .
ġ ͺ ǰ /ġ մϴ.
ͺ IS ü  ͺ IS
󼼼

Ŭ̾Ʈ .

Ʈũ ̿ õ.

ڵ ̿ ̷ Ư .

ȭ Ͽ Ʈ Ȱ Ʈ .

Ư URL IP ּ .

Autorun ̷ (autorun.inf )

 

%system%dfeohcg.dll

 

/ Ʈ

( Ű )
[HKEY_LOCAL_MACHINE\

 SOFTWARE\Microsoft\

  Windows NT\

    CurrentVersion\

      SvcHost]

Netsvcs= kogvea

 

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  ControlSet001\

   Enum\

    Root\

     LEGACY_KOGVEA]

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  ControlSet002\

   Enum\

    Root\

     LEGACY_KOGVEA]

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  ControlSet003\

   Enum\

    Root\

     LEGACY_KOGVEA]

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  CurrentControlSet\

   Enum\

    Root\

     LEGACY_KOGVEA]

 

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  CurrentControlSet\

   Services\

    kogvea]

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  ControlSet002\

   Services\

    kogvea]

[HKEY_LOCAL_MACHINE\

 SYSTEM\

  ControlSet003\

   Services\

    kogvea]

 

  ġ

ġ ֽ .


 



1)     ó ̷ dfeohcg.dll ǽ Ͽϴ.


2)     ó Windows XP ϴ.


3)     Ǵ Ʈ Ű Ͻñ ٶϴ.


4)     ĸȭ ׸ ٸ ֽϴ.


 


 


1.    ̷ Ȯ


1)     Ʈ մϴ.


([]-[] [cmd] )


 


2)     ý Ӽ dll Ȯ մϴ.


(%system% dir/ah)



 


3)     Gmerα׷ ̿ ƮŶ ̷ Ȯմϴ.


(www.gmer.com ٿε, ϸ Ʒ Ȯ մϴ.


Ʒ ׸ ̷ ٸϴ)





 


 


2.    ̷ ó


1)     Ʈ ⸦ մϴ.


([]-[] [regedit] )


 


2)     Svhost ش մϴ.


(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost netsvcsȿ kogvea )



 


3)     ش Ʈ մϴ.


(Ʈ ڰ ߰Ͽ ٲ ش Ʈ


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kogvea]


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\kogvea]


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\kogvea]


Start = 2  -> Start = 4)


 



         


             4)     մϴ.


 


5)     ý ̻ Ӽ մϴ.


(%system%attrib –s –r –h dfeohcg.dll


%system%del dfeohcg.dll)


 




 


6)     Ʈ մϴ.


([]-[] [services.msc]


Automactic Updates Background Intelligent Transfer Service )



 



 


 


7)     ǻ͸ մϴ. 


8)     Ʈ մϴ.


 


 

Ϻ
- 긮 ϴ ۱ 긮 ̸ ù ȣ ޽ϴ.
- 긮 㰡 긮 , Ǿ ֽϴ.
- ̸ ϴ ع Ǵ . Ҽ ֽϴ.
* 긮 ̿ : greenking@everyzone.com