
jueves 16 junio de 2005, 16:41
|
 | Doctor Lemon NC3L: Miembro | | Miembro desde: 04 agosto 2004 Ubicación: Belgrano Edad: 30 | |
| Re: Un Gusano borra archivos MP3 Batman muy buen la info... hay q tener cuidado en que se bajan!
Aca les amplio un poco la info W32/Nopir-B is a worm for the Windows platform.
W32/Nopir-B will display an anti-piracy image on the screen when run, as seen here: The image displayed by the Nopir-B worm. The worm will then delete all COM and MP3 files from the computer. The worm will also disable taskmanager, registry tools, and access to the control panel. W32/Nopir-B will also check for debuggers and may attempt to disable any such software that it finds.
Este Worm, se copia en los siguientes carpetas y entradas de registro: W32/Nopir-B copies itself to <Program Files>\Projects Visual Studio.NET\Nctrup.exe, <Program Files>\Restore\<random name>.exe, <Program Files>\eMule\Incoming\AnyDVD 5.1.0.1 Crack+Keygen By Razor.exe.
W32/Nopir-B will create the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Verif
<Program Files>\Restore\<random name>.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
securw
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\exefile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\batfile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\comfile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\scrfile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\piffile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\vbsfile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCR\vbefile\Shell\open\command
<Program Files>\Projects Visual Studio.NET\Nctrup.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\Explorer
NoControlPanel
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System
DisableTaskMgr
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System
DisableRegistryTools
__________________ ::: contact::: pablo.sonder@gmail.com
Úlima edición por PabliTTus fecha: jueves 16 junio de 2005 a las 17:19.
|