Trojans: trojan.Win32.Buzus.a
Risk level: Medium
virus symptoms
The sample is a Trojan developed use “Delphi”, the size of the “97,792″ bytes, the icon for the “
“, use the “exe” extension, through the file bundle, page Trojan, download tools to download, etc. to spread. The main purpose of the virus is to control the user’s computer.
After the user’s computer was infected, computer network speed and the system appears Slow, the camera was open for no reason, etc.
Infection of the operating system
Windows 2000/Windows XP / Windows 2003/Windows Vista / Windows 7
Transmission
File bundle, page trojan, download tools to download
Manual Solution:
1. To end the following processes:
csrsc.exe
Manually delete the following files:
% SystemRoot% \ csrsc.exe
2. Manually delete the following Registry:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon
Key: shell explorer data:% SystemRoot% \ csrsc.exe
Variable declaration:
% SystemDriver% the partition of system, typically “C: \”
% SystemRoot% WINDODWS directory, usually “C: \ Windows”
% Documents and Settings% user documentation directory, usually “C: \ Documents and Settings”
% Temp% temp folder, usually “C: \ Documents and Settings \ current user name \ Local Settings \ Temp”
% ProgramFiles% system program default installation directory, typically: “C: \ ProgramFiles”
Virus analysis:
1. It creates “SnowDownVip2010″ mutex to prevent multiple runs.
2.% Documents and Settings% \ current user name is generated lumgm.drv (random name), then call rundll32 and running lumgm.drv
3. Connect the designated site, open the back door
4. Create a service egxnuq, to achieve the automatic start Trojan
5. In Lumgm.drv, End of the process out of security software
The virus creates files:
% Documents and Settings% \ current user name \ lumgm.drv (random name)
% ProgramFiles% \ Common Files \ safedrv.exe
% Temp% \ ~ egxnuq.txt
Virus to create the registry:
HKEY_LOCAL_MACHINE \ SYSTEM \ ControlSet001 \ Services \ egxnuq
Virus access to the network:
http://www .******. com/d1/Count.asp
We’re a group of volunteers and starting a brand new scheme in our community. Your website provided us with valuable information to paintings on. You’ve performed an impressive job and our entire community shall be thankful to you.
Attractive section of content. I simply stumbled upon your web site and in accession capital to assert that I get actually loved account your blog posts. Anyway I will be subscribing for your augment or even I success you access persistently quickly.
Pretty nice post. I simply stumbled upon your blog and wished to mention that I have truly enjoyed browsing your weblog posts. In any case I will be subscribing for your feed and I hope you write once more very soon!
Really quite informative entry, I really was in fact glad to come across your blog using the web. I decide to put a web page link in my personal blogging site for that reason my visitors might arrive at your internet-site. Don’t hesitate to take a look.
Made me want to read more…
I believe people will need to read lots on this….
Spawned further interest…
I guess you will need to think lots on this….
Someone to lean on…
I really do look forward to these thoughts, thanks a lot!…
Mantel Clocks…
I found your blog website on google and check a few of one’s early posts. Carry on to maintain up the very good function. I just additional up your RSS feed to my MSN Information Reader. Looking for forward to reading more from you later on!…
Bass Fishing Boats…
I loved as much as you’ll receive carried out right here. The sketch is attractive, your authored material stylish. nonetheless, you command get bought an impatience over that you wish be delivering the following. unwell unquestionably come more forme…
New Macbook Review…
Hello, i think that i saw you visited my site so i came to “return the favor”.I’m attempting to find things to improve my web site!I suppose its ok to use a few of your ideas!!…
Online Directories…
…If you are conscious when working at your projects you will do more than if you don’t have much skills…..
2011…
Hi, I do believe this is an excellent blog. I stumbled upon it on Yahoo , i will come back once again. Money and freedom is the best way to change, may you be rich and help other people….
Digg…
While checking out DIGG yesterday I noticed this…
Just Browsing…
While I was browsing today I noticed a great article about…
Digg…
While checking out DIGG today I found this…
News info…
I was reading the news and I saw this really interesting topic…
Websites worth visiting…
[...]here are some links to sites that we link to because we think they are worth visiting[...]……
Trackback for a Great Article…
Left you a trackback for your readers to get more info….
Another Title…
I saw this really good post today….
I’ve found it a little difficult to find computer parts without having to buy whole computers and tearing them apart myself. . I want to start my own business using the computer parts, but where can I get the computer parts (the small parts)? I have…
How long can my computer keep running with an outdated browser?…
historia aa sverige…
[...]p I am visiting this place for the first time. I have come to know a lot of i nn[...]…
konstutställningar…
[...]k I own a similar site to this one and I was just curious if you get a lot of jg[...]…
Trackback Link…
[...]Here are some of the sites we recommend for our visitors[...]…
Get your horse tack!…
Not sure if this is the right place (I’m not really good with computers), but left you a trackback for your readers, if they ever need some information about horse tack….
stockholm gymnasium…
[...]u Hmmm that was weird, my comment seems to have been eaten. Anyway I wanted t ge[...]…
Triumfbågen okända soldatens grav…
[...]n Just added this site to my favorites. I enjoy reading your blogs and hope y sk[...]…
aa 12 steg…
[...]b Very few blogs that happen to be detailed below, from our point of view are m0[...]…
Bartenderkurs…
[...]r I am visiting this land for the first time. I have come to know a lot of in ce[...]…
casamento…
http://buffetmariliasp.com.br/site/buffet-marilia-o-servico-de-buffet/…
acne under graviditeten…
[...]x I am visiting this place for the first time. I have come to know a lot of i zt[...]…
shanghai djurpark panda…
[...]n I need to set up wordpess through a webhost. I know i have to download word 01[...]…