To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
----------
cheers
andrej
nserve.exe
[ General information ]
* **Locates window "NULL [class mIRC]" on desktop.
* File length: 78760 bytes.
* MD5 hash: 5bf4a948a1e4a91a5304bc4b36cff593.
[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM32\serve.exe.
* Deletes file 1.
[ Changes to registry ]
* Creates value "AdobeReaderPro"="serve.exe" in key "HKLM
\Software\Microsoft\Windows\CurrentVersion\Run".
* Creates value "AdobeReaderPro"="serve.exe" in key "HKLM
\Software\Microsoft\Windows\CurrentVersion\RunServices".
* Creates key "HKCU\Software\Microsoft\OLE".
* Sets value "AdobeReaderPro"="serve.exe" in key "HKCU\Software
\Microsoft\OLE".
[ Network services ]
* Looks for an Internet connection.
* Connects to "212.18.63.23 " on port 6667 (TCP).
* Connects to IRC server.
* IRC: Uses nickname sayan-803400.
* IRC: Uses username ezkieyac.
* IRC: Joins channel #irc-party with password pass.
* IRC: Sets the usermode for user sayan-803400 to +xB.
[ Process/window information ]
* Creates a mutex rx10B.
* Will automatically restart after boot (I'll be back...).
[ Signature Scanning ]
* C:\WINDOWS\SYSTEM32\serve.exe (78760 bytes) : W32/
Suspicious_U.gen.
_______________________________________________
To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
All list and server information are public and available to law enforcement
upon request.
http://www.whitestar.linuxbox.org/mailman/listinfo/botnets
