- Mitglied seit
- 11 Okt 2006
- Beiträge
- 128
- Punkte für Reaktionen
- 4
- Punkte
- 18
Hallo,
seit neusten meckert bei mir mein Norton Virenschutz,
wenn ich hier auf die Seite gehe und warnt vor 35 Gefährdungen.
http://safeweb.norton.com/report/show?url=ip-phone-forum.de
Inhalt:
HTTP Trojan Mebroot Activity 2
Severity: High
This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.
Description
This signature detects an attempt to download malicious files related to Trojan.Mebroot which may compromise the target host.
Additional Information
Trojan.Mebroot is a Trojan horse that overwrites the Master Boot Record of the hard disk and uses rootkit techniques to hide itself. <BR><BR>It has been reported that this threat may be installed from the following location using browser exploits:<BR>[http://]gfeptwe.com[REMOVED]<BR><BR>When the Trojan is executed, it creates the following mutex so that only one instance of it is running on the compromised computer at any time:<BR>Global\7BC8413E-DEF5-4BF6-9530-9EAD7F45338B<BR><BR>It then reads the Master Boot Record (MBR) and then scans the partition table to find the active boot partition of the computer.<BR><BR>The Trojan infects the MBR, copying the original MBR to sector 62 on the hard disk.<BR><BR>It then installs its own kernel loader to sectors 60 and 61 of the hard disk.<BR><BR>Next, it copies a rootkit driver near the end of the active boot partition. The Trojan overwrites around 1149 sectors (467 KB) when copying the driver.<BR><BR>Next, the Trojan creates a .dll file in the current folder where it is executed and then runs the following command:<BR>regsvr32 /s [TROJAN FILE NAME].dll<BR><BR>Note: It has been reported that the file name could be mat[RANDOM NUMBER].dll.<BR><BR>It may then restart the compromised computer or display the following message:<BR>Some updates require you to restart your computer to complete the update process. Be sure to save any work prior to the scheduled time.<BR><BR>When the computer restarts, the infected MBR will start the kernel loader located in sectors 60 and 61, which patches the Windows Kernel in memory to load the rootkit driver.<BR><BR>The rootkit driver then hooks the following kernel routines:<BR><BR> * IRP_MJ_READ<BR> * IRP_MJ_WRITE<BR><BR><BR><BR>If sector 0 is read from hard disk, the Trojan will return the original MBR backup stored at sector 62. It will also try to block writing to sector 0, in order to prevent removal.<BR><BR>The Trojan also opens a back door, which attempts to bypass the local firewall and connect to the following location,allowing an attacker to control the compromised computer:<BR>[http://]dkfhchkb.com/ser[REMOVED]<BR><BR>The Trojan may also inject additional code into usermode processes.
Affected
* Windows 2000, Windows Server 2003, Windows Vista, Windows XP
Response
1. Restart the computer using the Windows Recovery Console.<BR>2. Disable System Restore (Windows Me/XP).<BR>3. Update the virus definitions.<BR>4. Run a full system scan.
Was ist daran wahr?
Nixwiss
seit neusten meckert bei mir mein Norton Virenschutz,
wenn ich hier auf die Seite gehe und warnt vor 35 Gefährdungen.
http://safeweb.norton.com/report/show?url=ip-phone-forum.de
Inhalt:
HTTP Trojan Mebroot Activity 2
Severity: High
This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.
Description
This signature detects an attempt to download malicious files related to Trojan.Mebroot which may compromise the target host.
Additional Information
Trojan.Mebroot is a Trojan horse that overwrites the Master Boot Record of the hard disk and uses rootkit techniques to hide itself. <BR><BR>It has been reported that this threat may be installed from the following location using browser exploits:<BR>[http://]gfeptwe.com[REMOVED]<BR><BR>When the Trojan is executed, it creates the following mutex so that only one instance of it is running on the compromised computer at any time:<BR>Global\7BC8413E-DEF5-4BF6-9530-9EAD7F45338B<BR><BR>It then reads the Master Boot Record (MBR) and then scans the partition table to find the active boot partition of the computer.<BR><BR>The Trojan infects the MBR, copying the original MBR to sector 62 on the hard disk.<BR><BR>It then installs its own kernel loader to sectors 60 and 61 of the hard disk.<BR><BR>Next, it copies a rootkit driver near the end of the active boot partition. The Trojan overwrites around 1149 sectors (467 KB) when copying the driver.<BR><BR>Next, the Trojan creates a .dll file in the current folder where it is executed and then runs the following command:<BR>regsvr32 /s [TROJAN FILE NAME].dll<BR><BR>Note: It has been reported that the file name could be mat[RANDOM NUMBER].dll.<BR><BR>It may then restart the compromised computer or display the following message:<BR>Some updates require you to restart your computer to complete the update process. Be sure to save any work prior to the scheduled time.<BR><BR>When the computer restarts, the infected MBR will start the kernel loader located in sectors 60 and 61, which patches the Windows Kernel in memory to load the rootkit driver.<BR><BR>The rootkit driver then hooks the following kernel routines:<BR><BR> * IRP_MJ_READ<BR> * IRP_MJ_WRITE<BR><BR><BR><BR>If sector 0 is read from hard disk, the Trojan will return the original MBR backup stored at sector 62. It will also try to block writing to sector 0, in order to prevent removal.<BR><BR>The Trojan also opens a back door, which attempts to bypass the local firewall and connect to the following location,allowing an attacker to control the compromised computer:<BR>[http://]dkfhchkb.com/ser[REMOVED]<BR><BR>The Trojan may also inject additional code into usermode processes.
Affected
* Windows 2000, Windows Server 2003, Windows Vista, Windows XP
Response
1. Restart the computer using the Windows Recovery Console.<BR>2. Disable System Restore (Windows Me/XP).<BR>3. Update the virus definitions.<BR>4. Run a full system scan.
Was ist daran wahr?
Nixwiss
