Virus Myths! 어리버리 어리버리 http://blog.daum.net/virusmyths Daum blog (blogmaster@daum.net) tag:blog.daum.net,2009:virusmyths 2009-11-07T22:18:28Z [주의] 곰플레이어로 위장한 악성코드 유포 tag:blog.daum.net,2009:virusmyths.6042166 어리버리 2009-11-07T22:18:28Z 2009-11-07T22:18:28Z <P>동영상 재생 프로그램으로 널리 알려진 곰플레이어 프로그램으로 위장한 악성코드가</P> <P>국내에서 아직까지(?) 유포되고 있어, 곰플레이어를 이용하는 사용자들은 각별한 주의가 필요하다.</P> <P>&nbsp;</P> <P>이것이.. 지난 8월말에서 9월초 사이에 발견되어 소멸(?)된 줄 알았더니...</P> <P>특정 사이트에 악성 파일들을 올려놓고.. 아직까지 살아있네... 끊진길 생명력이어라~</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>1. 정상적인 곰플레이어가 사용하는 파일명</P> <P>&nbsp;</P> <P>&nbsp;- 실행 파일 : GOM.exe, GomWiz.exe, GrLauncher.exe 등</P> <P>&nbsp;</P> <P>&nbsp;- dll 파일 : GomTVStrm.dll, GomWeb3.dll, GomX.dll</P> <P>&nbsp;</P> <P>2. 곰플레이어로 위장한 악성 파일들</P> <P>&nbsp;</P> <P style="TEXT-ALIGN: center"><img src="http://cfile236.uf.daum.net/image/113C7D284AF576A12FBC77" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="479" hspace="1" width="479" vspace="1" border="0" />&nbsp;</P> <P>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 150%">&nbsp;- </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 150%">Gom.dll</SPAN></FONT><SPAN style="LINE-HEIGHT: 150%"> (466,944 바이트, MD5 :&nbsp;57239c7bc77bc20cc67e8421ac368edf)</SPAN></P> <P>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 150%">&nbsp;-</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 150%"> GomPlay.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 150%"> (257,536 바이트, MD5 :&nbsp;e15a6e68509a3dcfb05bb1f791c21ef0)</SPAN></P> <P>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 150%">&nbsp;- </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 150%">LiveInstall.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 150%"> (182,784 바이트, MD5 :&nbsp;68709510c4486b3f70a75696a14f27f5)</SPAN></P> <P>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 150%">&nbsp;- </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 150%">wflb.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 150%"> (407,440 바이트, MD5 : e4911e39ffe282685c63f40445a3da3b)</SPAN></P> <P>&nbsp;</P> <P style="TEXT-ALIGN: center"></P> <P>&nbsp;</P> <P style="TEXT-ALIGN: center"></P> <P>&nbsp;</P> <P>3. 각 파일들의 진단명 (기준 : 2009-11-07)</P> <P>&nbsp;</P> <P>1) <FONT color=#c5016c><SPAN style="LINE-HEIGHT: 150%">Gom.dll</SPAN></FONT><SPAN style="LINE-HEIGHT: 150%"> (466,944 바이트, MD5 :&nbsp;57239c7bc77bc20cc67e8421ac368edf) </SPAN>파일에 대한 진단 여부</P> <P>&nbsp;</P> <P> <TABLE cellSpacing=0 borderColorDark=white width=540 align=center borderColorLight=black border=1> <TBODY> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">안티바이러스</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">엔진 버전</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">정의 날짜</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">검사 결과</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">a-squared</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.5.0.41</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan-Dropper.Delf!IK</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AhnLab-V3</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AntiVir</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.9.1.61</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Antiy-AVL</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2.0.3.7</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Authentium</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.2.0.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Avast</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.8.1351.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Win32:Delf-MTM</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AVG</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">8.5.0.423</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">BitDefender</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">CAT-QuickHeal</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ClamAV</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">0.94.1</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Comodo</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2872</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">DrWeb</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.12182</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">eTrust-Vet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">35.1.7108</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Prot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.5.1.85</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Secure</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">9.0.15370.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.04</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Fortinet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.120.0.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">GData</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">19</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Win32:Delf-MTM</SPAN> </TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Ikarus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">T3.1.1.74.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan-Dropper.Delf</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Jiangmin</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">11.0.800</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">K7AntiVirus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.10.890</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Kaspersky</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.0.125</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5794</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee+Artemis</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5794</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee-GW-Edition</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.8.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Microsoft</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.5202</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">NOD32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4580</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Norman</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.03.02</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">nProtect</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.1.8.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Panda</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.0.2.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">PCTools</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.3.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Prevx</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Rising</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">21.54.52.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sophos</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.47.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sunbelt</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.2.1858.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Symantec</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.4.4.12</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TheHacker</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.5.0.2.063</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TrendMicro</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">9.0.0.1003</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VBA32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.12.10.11</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ViRobot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.11.6.2025</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VirusBuster</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.6.5.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">추가 정보</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">File size: 466944 bytes</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">MD5...: 57239c7bc77bc20cc67e8421ac368edf</SPAN></TD></TR></TBODY></TABLE></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>2) <FONT color=#c5016c>GomPlay.exe</FONT><SPAN style="LINE-HEIGHT: 150%"> (257,536 바이트, MD5 :&nbsp;e15a6e68509a3dcfb05bb1f791c21ef0) 파일에 대한 진단 여부</SPAN></P> <P>&nbsp;</P> <P> <TABLE cellSpacing=0 borderColorDark=white width=540 align=center borderColorLight=black border=1> <TBODY> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">안티바이러스</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">엔진 버전</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">정의 날짜</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">검사 결과</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">a-squared</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.5.0.41</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan-Dropper.Delf!IK</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AhnLab-V3</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AntiVir</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.9.1.61</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">TR/Dldr.Delf.wwk</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Antiy-AVL</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2.0.3.7</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Authentium</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.2.0.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Avast</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.8.1351.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Win32:Delf-MTM</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AVG</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">8.5.0.423</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">SHeur2.BCIP</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">BitDefender</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.Generic.2378489</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">CAT-QuickHeal</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ClamAV</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">0.94.1</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Comodo</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2872</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">DrWeb</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.12182</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">DLOADER.Trojan</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">eSafe</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.17.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Suspicious File</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">eTrust-Vet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">35.1.7108</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Prot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.5.1.85</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Secure</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">9.0.15370.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.04</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.Generic.2378489</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Fortinet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.120.0.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">GData</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">19</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.Generic.2378489</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Ikarus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">T3.1.1.74.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan-Dropper.Delf</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Jiangmin</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">11.0.800</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">K7AntiVirus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.10.890</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.Win32.Malware.1</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Kaspersky</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.0.125</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan-Downloader.Win32.Delf.wwk</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5794</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee+Artemis</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5794</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Artemis!E15A6E68509A</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee-GW-Edition</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.8.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Heuristic.LooksLike.Win32.Suspicious.C</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Microsoft</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.5202</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">NOD32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4580</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">probably unknown NewHeur_PE</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Norman</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.03.02</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">W32/DLoader.WHKX</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">nProtect</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.1.8.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan/W32.Agent.257536.Z</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Panda</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.0.2.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trj/CI.A</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">PCTools</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.3.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Downloader.Generic</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Prevx</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">High Risk Cloaked Malware</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Rising</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">21.54.52.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sophos</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.47.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Mal/Generic-A</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sunbelt</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.2.1858.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Symantec</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.4.4.12</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Downloader</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TheHacker</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.5.0.2.063</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TrendMicro</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">9.0.0.1003</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VBA32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.12.10.11</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ViRobot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.11.6.2025</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VirusBuster</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.6.5.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">추가 정보</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">File size: 257536 bytes</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">MD5 : e15a6e68509a3dcfb05bb1f791c21ef0</SPAN></TD></TR></TBODY></TABLE></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>3) <SPAN style="LINE-HEIGHT: 150%"><FONT color=#c5016c>LiveInstall.exe</FONT></SPAN><SPAN style="LINE-HEIGHT: 150%"> (182,784 바이트, MD5 :&nbsp;68709510c4486b3f70a75696a14f27f5) </SPAN>에 대한 진단여부</P> <P>&nbsp;</P> <P> <TABLE cellSpacing=0 borderColorDark=white width=540 align=center borderColorLight=black border=1> <TBODY> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">안티바이러스</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">엔진 버전</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">정의 날짜</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">검사 결과</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">a-squared</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.5.0.41</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">BehavesLike!IK</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AhnLab-V3</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AntiVir</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.9.1.61</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">TR/Dldr.Agent.245</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Antiy-AVL</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2.0.3.7</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan/Win32.Genome.gen</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Authentium</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.2.0.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">W32/Downldr2.HSEB</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Avast</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.8.1351.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Win32:Genome-BX</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AVG</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">8.5.0.423</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Downloader.Generic8.BPTD</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">BitDefender</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">BehavesLike:Trojan.Downloader</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">CAT-QuickHeal</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.Agent.ATV</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ClamAV</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">0.94.1</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Comodo</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2872</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Heur.Packed.Unknown</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">DrWeb</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.12182</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">eTrust-Vet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">35.1.7108</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Prot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.5.1.85</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">W32/Downldr2.HSEB</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Secure</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">9.0.15370.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.04</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">BehavesLike:Trojan.Downloader</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Fortinet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.120.0.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">GData</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">19</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">BehavesLike:Trojan.Downloader</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Ikarus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">T3.1.1.74.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">BehavesLike</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Jiangmin</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">11.0.800</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">TrojanDownloader.Genome.bif</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">K7AntiVirus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.10.890</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.Win32.Malware.1</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Kaspersky</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.0.125</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan-Downloader.Win32.Genome.quy</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5794</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Generic Downloader.x!bgu</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee+Artemis</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5794</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Generic Downloader.x!bgu</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee-GW-Edition</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.8.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.Dldr.Agent.245</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Microsoft</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.5202</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan:Win32/Malat</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">NOD32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4580</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Norman</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.03.02</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">W32/DLoader.WHLA</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">nProtect</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.1.8.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan/W32.Agent.182784.U</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Panda</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.0.2.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trj/CI.A</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">PCTools</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.3.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Downloader.Generic</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Prevx</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">High Risk Cloaked Malware</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Rising</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">21.54.52.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sophos</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.47.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Mal/Generic-A</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sunbelt</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.2.1858.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Symantec</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.4.4.12</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Downloader</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TheHacker</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.5.0.2.063</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan/Downloader.Genome.quy</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TrendMicro</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">9.0.0.1003</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VBA32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.12.10.11</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan-Downloader.Win32.Genome.qvr</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ViRobot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.11.6.2025</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VirusBuster</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.6.5.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">추가 정보</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">File size: 182784 bytes</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">MD5 : 68709510c4486b3f70a75696a14f27f5</SPAN></TD></TR></TBODY></TABLE></P> <P>&nbsp;</P> <P>4) [<A href="http://blog.daum.net/virusmyths/4818109" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>무료백신</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]&nbsp;[<A href="http://blog.daum.net/virusmyths/6041705" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>V3 Lite</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]와 </SPAN>[<A href="http://blog.daum.net/virusmyths/5052942" target=_blank><U><FONT color=#0000ff>알약</FONT></U></A>]을 이용한 진단</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;1) [<A href="http://blog.daum.net/virusmyths/4818109" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>무료백신</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]&nbsp;[</SPAN><A href="http://blog.daum.net/virusmyths/6041705" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>V3 Lite</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]를 이용한 제거</SPAN></SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center"><img src="http://cfile215.uf.daum.net/image/110858244AF5750B70A7A7" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="540" hspace="1" width="540" vspace="1" border="0" /></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P>&nbsp;<SPAN style="LINE-HEIGHT: 200%">&nbsp;2) [</SPAN><A href="http://blog.daum.net/virusmyths/4818109" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>무료백신</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]&nbsp;[<A href="http://blog.daum.net/virusmyths/5052942" target=_blank><U><FONT color=#0000ff>알약</FONT></U></A>]을 이용한 진단/제거</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center"><img src="http://cfile207.uf.daum.net/image/114C37284AF575181C9E0D" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="460" hspace="1" width="460" vspace="1" border="0" /></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P>&nbsp;</P> <P align=left><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=곰플레이어" rel="tag" target="_blank">곰플레이어</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=gom.dll" rel="tag" target="_blank">gom.dll</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=gomplay.exe" rel="tag" target="_blank">gomplay.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=liveinstall.exe" rel="tag" target="_blank">liveinstall.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=wflb.exe" rel="tag" target="_blank">wflb.exe</a> f3c74e3fa248.exe 와 Trojan-GameThief.Win32.OnLineGames.vuku 정보 tag:blog.daum.net,2009:virusmyths.6042162 어리버리 2009-11-07T02:02:13Z 2009-11-07T02:02:13Z <P> <TABLE borderColor=#5980ae cellSpacing=0 borderColorDark=#5980ae width=540 align=center borderColorLight=white border=1> <TBODY> <TR> <TD style="FONT-SIZE: 12pt; COLOR: white; FONT-FAMILY: 'Times New Roman'; TEXT-ALIGN: center" width=668 bgColor=#5980ae borderColorDark=#5980ae height=29> <P><B>Trojan-GameThief.Win32.OnLineGames.vuku</B></P></TD></TR> <TR> <TD style="FONT-SIZE: 9pt; COLOR: black; LINE-HEIGHT: 100%; FONT-FAMILY: 돋움체" vAlign=top borderColorLight=white align=left width=674 bgColor=white borderColorDark=#5980ae height=247> <P><SPAN style="FONT-SIZE: 9pt; LINE-HEIGHT: 200%; FONT-FAMILY: 돋움체">1. 요약 : 윈도우 기반의 </SPAN><SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/4441847" target=_blank><U><FONT color=#0000ff>온라인 게임 로그인 정보 유출</FONT></U></A>]</SPAN><SPAN style="FONT-SIZE: 9pt; LINE-HEIGHT: 200%; FONT-FAMILY: 돋움체"> </SPAN><SPAN style="LINE-HEIGHT: 200%">[</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385693" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>트로이목마</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="FONT-SIZE: 9pt; LINE-HEIGHT: 200%; FONT-FAMILY: 돋움체">&nbsp;- 코드명 : </SPAN><SPAN style="LINE-HEIGHT: 200%">Trojan-GameThief.Win32.OnLineGames.vuku (</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385594" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>명명</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%"> :</SPAN><SPAN style="LINE-HEIGHT: 200%"> </SPAN><SPAN style="LINE-HEIGHT: 200%"><A href="http://www.kaspersky.co.kr/" target=_blank><U><FONT color=#0000ff>Kaspersky</FONT></U></A></SPAN><SPAN style="LINE-HEIGHT: 200%">, 2009-11-07)</SPAN></P> <P><SPAN style="FONT-SIZE: 9pt; LINE-HEIGHT: 200%; FONT-FAMILY: 돋움체">&nbsp;- 다른 이름 : 알려지지 않음</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 감염 경로 : [<A href="http://blog.daum.net/virusmyths/4697202" target=_blank><U><FONT color=#0000ff>알려진 윈도우 보안 취약점</FONT></U></A>]을 이용하여 악의적 웹 사이트나 </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;다른 악성코드에 의해 다운로드</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 크기 : 89,348 바이트 (MD5 : e3a939bcda4f99480ffef40bea79f7bd)</SPAN></P> <P><SPAN style="FONT-SIZE: 9pt; LINE-HEIGHT: 200%; FONT-FAMILY: 돋움체">2. 생성 파일 </SPAN><SPAN style="LINE-HEIGHT: 200%">(%시스템% 란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385610" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>클릭</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- %윈도우% 폴더 아래</SPAN> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;./Help\</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">f3c74e3fa248.dll</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (68,356 바이트, MD5 : 4711d2c7260d99e7a1444c5806d6cc99)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;./Help\</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">f3c74e3fa248.exe </SPAN></FONT><SPAN style="LINE-HEIGHT: 200%">// 트로이목마 복사본</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">3. 감염 예방 및 관련 정보</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 온라인 게임 패스워드 탈취 트로이목마 종류, 감염 예방 및 대응 요령 : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4441847" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>상세정보</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]&nbsp;</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 개인 정보 보호와 명의 도용 예방법 : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385699" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 중국발 서버 해킹을 통한 악성코드 감염 예방 : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4441842" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="FONT-SIZE: 9pt; LINE-HEIGHT: 200%; FONT-FAMILY: 돋움체">4. 주요 증상 : 특정 온라인 게임의 로그인 패스워드 탈취 후 전송</SPAN></P> <P><SPAN style="FONT-SIZE: 9pt; LINE-HEIGHT: 200%; FONT-FAMILY: 돋움체">&nbsp;&nbsp;- 생성된 dll 파일은 </SPAN><SPAN style="LINE-HEIGHT: 200%">[</SPAN><SPAN style="FONT-SIZE: 9pt; LINE-HEIGHT: 200%; FONT-FAMILY: 돋움체"><A href="http://blog.daum.net/virusmyths/5018698" target=_blank><U><FONT color=#0000ff>explorer.exe</FONT></U></A></SPAN><SPAN style="LINE-HEIGHT: 200%">], [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4953064" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>iexplore.exe</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">] 등에 삽입되어 실행</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">5. 레지스트리 추가/변경 </SPAN><SPAN style="LINE-HEIGHT: 200%">(HKLM 이란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385619" target=_blank><U><FONT color=#0000ff><SPAN style="LINE-HEIGHT: 200%">클릭</SPAN></FONT></U></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKLM -> SOFTWARE -> Classes -> CLSID -> {</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">1DBD6574-D6D0-4782-94C3-69619E719765</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%">} </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKLM -> SOFTWARE -> Microsoft -> Windows -> CurrentVersion -> Explorer -></SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;ShellExecuteHooks, {1DBD6574-D6D0-4782-94C3-69619E719765} = "" </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">6. 진단/치료&nbsp;(일부 <FONT color=#c5016c>통하기</FONT> 공개)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 온라인 게임 트로이목마 전용 제거 도구 : [<A href="http://blog.daum.net/virusmyths/5784731" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 자주 감염되는 악성코드 전용 제거/치료 도구 (80 종류) : [<A href="http://blog.daum.net/virusmyths/4818101" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인/오프라인 악성코드 검사/치료 도구 모음 : </SPAN><SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/4818109" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인 검사 도구 모음 (국내 6개 제품) : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4654549" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>바로가기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">7. 본 문서의 이용에 관한 조건 : [</SPAN><A class=con_link href="http://creativecommons.org/licenses/by-nc-nd/2.0/kr/" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P></TD></TR></TBODY></TABLE></P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=온라인게임" rel="tag" target="_blank">온라인게임</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=f3c74e3fa248.dll" rel="tag" target="_blank">f3c74e3fa248.dll</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=f3c74e3fa248.exe" rel="tag" target="_blank">f3c74e3fa248.exe</a> 네이버가 가짜 백신을 만든다? tag:blog.daum.net,2009:virusmyths.6042161 어리버리 2009-11-07T02:02:04Z 2009-11-07T02:02:04Z <P><SPAN style="LINE-HEIGHT: 200%"></SPAN>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%">네이버 툴바 프로그램으로 위장한 악성코드가 돌고 있다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">국내에서 제작되었으며, 이 악성코드는 </SPAN><SPAN style="LINE-HEIGHT: 200%">[</SPAN><A href="http://blog.daum.net/virusmyths/6042142" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>Trojan-Downloader.Win32.Genome.vqf</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">] 로 </SPAN><SPAN style="LINE-HEIGHT: 200%">[</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385594" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>명명</FONT></U></SPAN></A><A class=con_link><SPAN style="LINE-HEIGHT: 200%">]되었으며, </SPAN></A><SPAN style="LINE-HEIGHT: 200%"></SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">[</SPAN><A href="http://blog.daum.net/virusmyths/4916981" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>가짜 백신</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]&nbsp;</SPAN><A href="http://blog.daum.net/virusmyths/6042158" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>디도스클린</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]을 내려받아 설치한다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%"></SPAN>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%">1. 악성 파일 정보</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">nhn.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (237,056 바이트, MD5: &nbsp;db013cccf2d3c53d14bc8f63e1203fd0)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">nhn3.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (1170,861 바이트, MD5 : f9ef2efd9cbf2f6da170d11bc6378482)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">nhnsetup.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (182,784 바이트, MD5 : a6b5934ed1f2e7babe80159e03acfdcf)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%"></SPAN>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%">2. 각 파일에 대한 진단 여부</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">1) </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">nhn.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (237,056 바이트, MD5: &nbsp;db013cccf2d3c53d14bc8f63e1203fd0)</SPAN></P> <P style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 200%"> <TABLE cellSpacing=0 borderColorDark=white width=540 align=center borderColorLight=black border=1> <TBODY> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">안티바이러스</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">엔진 버전</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">정의 날짜</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">검사 결과</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">a-squared</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.5.0.41</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan-Downloader.Win32.Delf!IK</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AhnLab-V3</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AntiVir</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.9.1.59</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">TR/Dldr.Delf.wwk.2</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Antiy-AVL</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2.0.3.7</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Authentium</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.2.0.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Avast</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.8.1351.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Win32:Malware-gen</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AVG</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">8.5.0.423</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Generic15.APEY</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">BitDefender</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">CAT-QuickHeal</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ClamAV</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">0.94.1</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Comodo</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2860</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">DrWeb</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.12182</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">DLOADER.Trojan</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">eTrust-Vet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">35.1.7107</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Prot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.5.1.85</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Secure</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">9.0.15370.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.04</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Fortinet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.120.0.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">GData</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">19</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Win32:Malware-gen</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Ikarus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">T3.1.1.74.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan-Downloader.Win32.Delf</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Jiangmin</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">11.0.800</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">K7AntiVirus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.10.890</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.Win32.Malware.1</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Kaspersky</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.0.125</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan-Downloader.Win32.Delf.wwk</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5793</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee+Artemis</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5793</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Artemis!DB013CCCF2D3</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee-GW-Edition</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.8.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Heuristic.LooksLike.Trojan.Crypt.C</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Microsoft</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.5202</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">NOD32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4579</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">probably unknown NewHeur_PE</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Norman</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.03.02</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">W32/Malware.JSKQ</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">nProtect</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.1.8.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Panda</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.0.2.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trj/CI.A</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">PCTools</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.3.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Downloader.Generic</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Prevx</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Rising</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">21.54.44.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sophos</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.47.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Mal/Generic-A</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sunbelt</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.2.1858.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Symantec</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.4.4.12</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Downloader</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TheHacker</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.5.0.2.062</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TrendMicro</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">9.0.0.1003</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VBA32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.12.10.11</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ViRobot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.11.6.2025</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VirusBuster</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.6.5.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">추가 정보</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">File&nbsp;size: 237056 bytes</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">MD5&nbsp;&nbsp;&nbsp;: db013cccf2d3c53d14bc8f63e1203fd0</SPAN></TD></TR></TBODY></TABLE></SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%"></SPAN>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%"></SPAN>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%">2) </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">nhn3.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (1170,861 바이트, MD5 : f9ef2efd9cbf2f6da170d11bc6378482)</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</P> <P> <TABLE cellSpacing=0 borderColorDark=white width=540 align=center borderColorLight=black border=1> <TBODY> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">안티바이러스</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">엔진 버전</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">정의 날짜</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">검사 결과</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AhnLab-V3</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AntiVir</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.9.1.61</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">DR/Agent.rqq</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Antiy-AVL</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2.0.3.7</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Authentium</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.2.0.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Avast</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.8.1351.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AVG</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">8.5.0.423</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">SHeur2.BCTK</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">BitDefender</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">CAT-QuickHeal</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ClamAV</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">0.94.1</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Comodo</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2872</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">DrWeb</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.12182</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">eTrust-Vet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">35.1.7108</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Prot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.5.1.85</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Secure</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">9.0.15370.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.04</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Fortinet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.120.0.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">GData</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">19</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Ikarus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">T3.1.1.74.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.VB</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Jiangmin</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">11.0.800</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">K7AntiVirus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.10.891</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Kaspersky</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.0.125</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5794</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee+Artemis</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5794</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Artemis!F9EF2EFD9CBF</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee-GW-Edition</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.8.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.Dropper.Agent.rqq</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Microsoft</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.5202</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">NOD32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4580</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Norman</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.03.02</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Malware.JSJZ</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">nProtect</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.1.8.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Panda</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.0.2.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Suspicious file</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">PCTools</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.3.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Rising</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">21.54.52.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sophos</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.47.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sunbelt</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.2.1858.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Symantec</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.4.4.12</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TheHacker</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.5.0.2.063</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TrendMicro</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">9.0.0.1003</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VBA32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.12.10.11</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ViRobot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.11.6.2025</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VirusBuster</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.6.5.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">추가 정보</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">File size: 1170861 bytes</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">MD5...: f9ef2efd9cbf2f6da170d11bc6378482</SPAN></TD></TR></TBODY></TABLE></P></SPAN> <P><SPAN style="LINE-HEIGHT: 200%"></SPAN>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%">3) </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">nhnsetup.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (182,784 바이트, MD5 : a6b5934ed1f2e7babe80159e03acfdcf)</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp; <TABLE cellSpacing=0 borderColorDark=white width=540 align=center borderColorLight=black border=1> <TBODY> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">안티바이러스</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">엔진 버전</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">정의 날짜</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">검사 결과</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">a-squared</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.5.0.41</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan-Dropper.Delf!IK</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AhnLab-V3</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AntiVir</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.9.1.61</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">TR/Dldr.Agent.ctrw.1</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Antiy-AVL</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2.0.3.7</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Authentium</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.2.0.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Avast</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.8.1351.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Win32:Malware-gen</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AVG</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">8.5.0.423</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">BitDefender</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">CAT-QuickHeal</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ClamAV</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">0.94.1</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Comodo</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2872</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Heur.Packed.Unknown</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">DrWeb</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.12182</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">eTrust-Vet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">35.1.7108</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Prot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.5.1.85</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Secure</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">9.0.15370.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.04</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Fortinet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.120.0.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">W32/Agent.CTRW!tr.dldr</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">GData</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">19</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Win32:Malware-gen</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Ikarus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">T3.1.1.74.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan-Dropper.Delf</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Jiangmin</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">11.0.800</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">TrojanDownloader.Delf.kgf</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">K7AntiVirus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.10.891</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.Win32.Malware.1</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Kaspersky</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.0.125</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan-Downloader.Win32.Agent.ctrw</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5794</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee+Artemis</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5794</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Artemis!A6B5934ED1F2</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee-GW-Edition</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.8.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.Dldr.Agent.ctrw.1</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Microsoft</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.5202</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">NOD32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4580</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Norman</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.03.02</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">nProtect</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.1.8.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Panda</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.0.2.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">PCTools</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.3.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Downloader.Generic</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Prevx</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">High Risk Cloaked Malware</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Rising</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">21.54.52.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sophos</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.47.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Mal/Generic-A</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sunbelt</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.2.1858.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.Win32.Generic!SB.0</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Symantec</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.4.4.12</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Downloader</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TheHacker</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.5.0.2.063</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TrendMicro</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">9.0.0.1003</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VBA32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.12.10.11</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ViRobot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.11.6.2025</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.06</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VirusBuster</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.6.5.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.11.07</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 120%">Trojan.DL.Agent.PKLA</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">추가 정보</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">File size: 182784 bytes</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">MD5...: a6b5934ed1f2e7babe80159e03acfdcf</SPAN></TD></TR></TBODY></TABLE></SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%"></SPAN>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%">3. 기타 자세한 정보는 해당 링크를 참고하기 바란다.</SPAN></P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=네이버" rel="tag" target="_blank">네이버</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=nhn.exe" rel="tag" target="_blank">nhn.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=nhn3.exe" rel="tag" target="_blank">nhn3.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=nhnsetup.exe" rel="tag" target="_blank">nhnsetup.exe</a> [주의] 국산 가짜 백신 디도스클린 정보 및 제거 tag:blog.daum.net,2009:virusmyths.6042158 어리버리 2009-11-06T00:48:08Z 2009-11-06T00:48:08Z <P> <TABLE borderColor=#5980ae cellSpacing=0 borderColorDark=#5980ae width=540 align=center borderColorLight=white border=1> <TBODY> <TR> <TD style="FONT-SIZE: 12pt; COLOR: white; FONT-FAMILY: 'Times New Roman'; TEXT-ALIGN: center" width=668 bgColor=#5980ae height=29> <P><B>Win-Adware/Rogue.DDOSClean.763360</B> </P></TD></TR> <TR> <TD style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: 돋움체" vAlign=top borderColorLight=white align=left width=674 bgColor=white borderColorDark=#8092bb height=247> <P><SPAN style="LINE-HEIGHT: 200%">1. 요약 : </SPAN><SPAN style="FONT-SIZE: 9pt; LINE-HEIGHT: 200%; FONT-FAMILY: 돋움체">허위 또는 과장된&nbsp;진단 결과를 출력하고 사용자의 불안 심리를 조장하는</SPAN></P> <P><SPAN style="FONT-SIZE: 9pt; LINE-HEIGHT: 200%; FONT-FAMILY: 돋움체">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;가짜 백신 프로그램</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 코드명 : Win-Adware/Rogue.DDOSClean.763360 (</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385594" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>명명</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%"> : <A href="http://home.ahnlab.com/" target=_blank><U><FONT color=#0000ff>AhnLab</FONT></U></A>, </SPAN><SPAN style="LINE-HEIGHT: 200%">2009-11-05, GMT+9)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 다른 이름 : Trojan-Downloader.Win32.Genome.vqf, TrojanDownloader.Lastad.r</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 1건의 문의 메일을 받았다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">2. 감염 경로 : 특정 웹 사이트에서 수동으로 설치 </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ 다른 악성코드에 의해 다운로드 예) [</SPAN><A href="http://blog.daum.net/virusmyths/6042142" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>Trojan-Downloader.Win32.Genome.vqf</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center" align=center><img src="http://cfile233.uf.daum.net/image/163AD1224AF2F6BA31B4EB" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="540" hspace="1" width="540" vspace="1" border="0" /></P> <P align=center><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">3. 파일정보</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">1) 설치 파일 정보&nbsp;</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 파일명 :<FONT color=#c5016c> </FONT></SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">ddoscleansetup.exe</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 크기 : 218,392 바이트 (MD5 : 364d58e13a2a9afc1de2f52e7d331ff3)</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center" align=center><img src="http://cfile209.uf.daum.net/image/181A6B204AF2F6C9867E4D" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="540" hspace="1" width="540" vspace="1" border="0" /></P> <P align=center><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">2) 생성 파일 (%시스템% 란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385610" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>클릭</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp; - </SPAN><SPAN style="LINE-HEIGHT: 200%">[Program Files] 폴더 아래 [</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">ddosclean</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%">] 폴더 생성 후 파일 생성</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">ddosclean.dll</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (377,857 바이트, MD5 : d486191684b3f650b651f17f7f4efc81)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">&nbsp;ddosclean.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (763,360 바이트, MD5 : d8e4b2faa6738f0a30f5f006566da1d0)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">ddoscleanbk.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (229,856 바이트, MD5 : aa1e41297ca168eb0b0456fb484ffe34)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">ddoscleanu.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (108,000 바이트, MD5 : 634f725308a1081f7e015e302eda7c54)</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center" align=center><img src="http://cfile233.uf.daum.net/image/1217131F4AF2F6D50D3258" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="283" hspace="1" width="283" vspace="1" border="0" /></P> <P align=center><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P align=left><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 기타 : 임시 인터넷 파일 폴더 안에 설치 파일들 다운로드</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">4. 주요 증상 : 테스트 결과 실제 허위 결과를 출력하고 치료를 위해 결제를 요구했다.</SPAN></P> <P align=center><SPAN style="LINE-HEIGHT: 200%">&nbsp;<IMG class=tx-daum-image style="CLEAR: none; FLOAT: none; CURSOR: pointer" hspace=1 src="http://cfile239.uf.daum.net/image/13520D204AF2F33435F241" width=540 vspace=1 border=0 actualwidth="540" isset="true"></SPAN></P> <P align=center><SPAN style="LINE-HEIGHT: 200%"><IMG class=tx-daum-image style="CLEAR: none; FLOAT: none; CURSOR: pointer" hspace=1 src="http://cfile214.uf.daum.net/image/14520D204AF2F3343666AB" width=412 vspace=1 border=0 actualwidth="412" isset="true"></SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN> <P><SPAN style="LINE-HEIGHT: 200%">5. 레지스트리 추가/변경 (HKLM 이란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385619" target=_blank><U><FONT color=#0000ff><SPAN style="LINE-HEIGHT: 200%">클릭</SPAN></FONT></U></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKLM -> SOFTWARE -> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">ddosclean</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- </SPAN><SPAN style="LINE-HEIGHT: 200%">HKCU -> Software -> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">isnap </SPAN></FONT> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKCU -> Software -> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">nhn </SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKCU -> Software -></SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%"> nhn3 </SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKCU -> Software -> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">nhnsetup</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKLM -> SOFTWARE -> Microsoft -> Windows -> CurrentVersion -> Uninstall -> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">ddosclean </SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">6. 진단/제거 (기준 : 2009-11-06)</SPAN></P> <P align=left><SPAN style="LINE-HEIGHT: 200%">&nbsp;1) [</SPAN><A href="http://blog.daum.net/virusmyths/4818109" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>무료백신</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]&nbsp;[</SPAN><A href="http://blog.daum.net/virusmyths/6041705" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>V3 Lite</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]를 이용한 제거 (<FONT color=#c5016c>추천</FONT>)</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center" align=center><img src="http://cfile228.uf.daum.net/image/170761204AF2F6E701A6C3" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="540" hspace="1" width="540" vspace="1" border="0" /></P> <P align=center></P> <P align=left><SPAN style="LINE-HEIGHT: 200%"></SPAN>&nbsp;</P> <P align=left><SPAN style="LINE-HEIGHT: 200%">&nbsp;2) [</SPAN><A href="http://blog.daum.net/virusmyths/4818109" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>무료백신</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]&nbsp;[<A href="http://blog.daum.net/virusmyths/5052942" target=_blank><U><FONT color=#0000ff>알약</FONT></U></A>]을 이용한 진단/제거 : <FONT color=#c5016c>진단하지 못함&nbsp;</FONT></SPAN></P> <P align=left>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%">7. 진단/치료 (일부 <FONT color=#c5016c>통하기</FONT> 공개)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 가짜 백신 전용 제거 도구 : </SPAN><SPAN style="LINE-HEIGHT: 200%">[</SPAN><A href="http://blog.daum.net/virusmyths/6041992" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>다운로드</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 가자 백신 변경된 법률을 악용하다. : [<A href="http://blog.daum.net/virusmyths/5488683" target=_blank><U><FONT color=#0000ff>보기</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 아직도 스파이웨어, 애드웨어를 V3로 치료하는 사람들 : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4853558" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 자주 감염되는 악성코드 전용 제거/치료 도구 (80 종류) : [<A href="http://blog.daum.net/virusmyths/4818101" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인/오프라인 악성코드 검사/치료 도구 모음 : </SPAN><SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/4818109" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인 검사 도구 모음 (국내 6개 제품) : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4654549" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>바로가기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">8. 유사 가짜 백신 (2009-2006)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;[</SPAN><SPAN style="LINE-HEIGHT: 200%"><A href="http://blog.daum.net/virusmyths/6042094" target=_blank><U><FONT color=#0000ff>Total&nbsp;Security</FONT></U></A>], </SPAN><SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/6041812" target=_blank><U><FONT color=#0000ff>SysAntivirus 2009</FONT></U></A>], [</SPAN><A href="http://blog.daum.net/virusmyths/6041744" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>Express Antivirus 2009</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">], [<A href="http://blog.daum.net/virusmyths/6041725" target=_blank><U><FONT color=#0000ff>Spyware Expert</FONT></U></A>], </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;[<A href="http://blog.daum.net/virusmyths/6042017" target=_blank><U><FONT color=#0000ff>Virus Bye</FONT></U></A>], [<A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/6041718" target=_blank><U><FONT color=#0000ff>Antivirus 360</FONT></U></A>], [<A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/6041703" target=_blank><U><FONT color=#0000ff>Perfect Defender 2009</FONT></U></A>], [<A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5901721" target=_blank><U><FONT color=#0000ff>Antispyware XP 2009</FONT></U></A>], </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;[</SPAN><A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5886332" target=_blank><U><FONT color=#0000ff><SPAN style="LINE-HEIGHT: 200%">PC Defender 2008</SPAN></FONT></U></A><SPAN style="LINE-HEIGHT: 200%">],&nbsp;[<A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5681004" target=_blank><U><FONT color=#0000ff>Xp Protector 2009</FONT></U></A>], [</SPAN><A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5697177" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>Antispyware Pro XP</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">],</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp; [<A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5623631" target=_blank><U><FONT color=#0000ff>Total Secure2009</FONT></U></A>], [</SPAN><A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5393506" target=_blank><SPAN style="LINE-HEIGHT: 200%"><FONT color=#800080><U>AntiVirus XP 2008</U></FONT></SPAN></A><SPAN style="LINE-HEIGHT: 200%">], [</SPAN><A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5775698" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>eAntivirus Pro</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">],&nbsp;[<A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5542170" target=_blank><U><FONT color=#0000ff>Virus Remover 2008</FONT></U></A>], </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;[<A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5525754" target=_blank><U><FONT color=#0000ff>Win AntiSpyware</FONT></U></A>], [<A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5398847" target=_blank><U><FONT color=#0000ff>AntiSpy Check</FONT></U></A>], [</SPAN><A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5555737" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>Antivirus Doc</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">], [<A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5431935" target=_blank><U><FONT color=#0000ff>Antivirus Master</FONT></U></A>], </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;[<A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5484617" target=_blank><U><FONT color=#0000ff>Power AntiVirus 2009</FONT></U></A>], [</SPAN><A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5484617" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>PyroAntiSpy</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">], [</SPAN><A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5106925" target=_blank><SPAN style="LINE-HEIGHT: 200%"><FONT color=#0000ff><U>AntiSpy Boss</U></FONT></SPAN></A><SPAN style="LINE-HEIGHT: 200%">], [</SPAN><A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5094770" target=_blank><SPAN style="LINE-HEIGHT: 200%"><FONT color=#0000ff><U>AntiSpy Zone</U></FONT></SPAN></A><SPAN style="LINE-HEIGHT: 200%">], </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;[<A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5004582" target=_blank><FONT color=#0000ff><U>Spy Spotter</U></FONT></A>], [<A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5092902" target=_blank><FONT color=#0000ff><U>System Defender</U></FONT></A>], [<A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/5661524" target=_blank><U><FONT color=#0000ff>Smart Antivirus 2009</FONT></U></A>],</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;[<A href="http://blog.daum.net/virusmyths/6041833" target=_blank><U><FONT color=#0000ff>XP Police Antivirus</FONT></U></A>], [<A href="http://blog.daum.net/virusmyths/6041944" target=_blank><U><FONT color=#0000ff>Virus Trigger</FONT></U></A>], [<A href="http://blog.daum.net/virusmyths/6041973" target=_blank><U><FONT color=#0000ff>System Security</FONT></U></A>], [</SPAN><A style="COLOR: #666666" href="http://blog.daum.net/virusmyths/4916981" target=_blank><FONT color=#0000ff><SPAN style="LINE-HEIGHT: 200%"><U>더 보기</U></SPAN></FONT></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">9. 본 문서의 이용에 관한 조건 : [</SPAN><A class=con_link href="http://creativecommons.org/licenses/by-nc-nd/2.0/kr/" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%"><SPAN style="LINE-HEIGHT: 200%"><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;불법 펌질은 도둑질이자 명백한 범죄 행위이며, 창작성이 인정되는 게시물을 허락없이 </SPAN></SPAN></SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%"><SPAN style="LINE-HEIGHT: 200%"><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;무단으로 스크랩&nbsp;하거나 원 저작자가 허락한 스크랩 범위를 넘어&nbsp;게시할 경우, </SPAN></SPAN></SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%"><SPAN style="LINE-HEIGHT: 200%"><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;발생할 수 있는 모든 문제와 법적 책임은 스크랩을 수행한&nbsp;사람에게 있습니다.</SPAN></SPAN></SPAN></P></TD></TR></TBODY></TABLE></P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=가짜백신" rel="tag" target="_blank">가짜백신</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=디도스클린" rel="tag" target="_blank">디도스클린</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=ddosclean.dll" rel="tag" target="_blank">ddosclean.dll</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=ddosclean.exe" rel="tag" target="_blank">ddosclean.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=ddoscleanbk.exe" rel="tag" target="_blank">ddoscleanbk.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=ddoscleanu.exe" rel="tag" target="_blank">ddoscleanu.exe</a> [주의] sdra64.exe, proquota.exe 와 Backdoor.Win32.Bredolab.atb 정보 tag:blog.daum.net,2009:virusmyths.6042155 어리버리 2009-11-04T23:00:34Z 2009-11-04T23:00:34Z <P> <TABLE borderColor=#5980ae cellSpacing=0 borderColorDark=#5980ae width=540 align=center borderColorLight=white border=1> <TBODY> <TR> <TD style="FONT-SIZE: 12pt; COLOR: white; FONT-FAMILY: 'Times New Roman'; TEXT-ALIGN: center" width=668 bgColor=#5980ae height=29><B>Backdoor.Win32.Bredolab.atb</B></TD></TR> <TR> <TD style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: 돋움체" vAlign=top borderColorLight=white align=left width=674 bgColor=white borderColorDark=#8092bb height=247> <P><SPAN style="LINE-HEIGHT: 200%">1. 요약 : 윈도우 기반의 [<A href="http://blog.daum.net/virusmyths/4750273" target=_blank><U><FONT color=#0000ff>백도어</FONT></U></A>] </SPAN><SPAN style="LINE-HEIGHT: 200%">[</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385693" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>트로이목마</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 코드명 : </SPAN><SPAN style="LINE-HEIGHT: 200%">Backdoor.Win32.Bredolab.atb </SPAN><SPAN style="LINE-HEIGHT: 200%">(</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385594" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>명명</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%"> : <A href="http://www.kaspersky.co.kr/" target=_blank><U><FONT color=#0000ff>Kaspersky</FONT></U></A></SPAN><SPAN style="LINE-HEIGHT: 200%">, 2009-11-02, GMT+1)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 다른 이름 : Trojan.Win32.Bredolab, Bredolab.gen.a</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 크기 : 32,768 바이트 (MD5 : fe67524de8553ce7b756d65994e9d006)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 감염 경로 : 자체 전파 기능은 없으며, 정확한 경로는 알려지지 않았다.</SPAN> <P><SPAN style="LINE-HEIGHT: 200%">2.&nbsp;관련 포스트</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- [주의] Facebook 웜 :&nbsp;[<A href="http://blog.daum.net/virusmyths/6042138" target=_blank><U><FONT color=#810081>보기</FONT></U></A>] (09/10/29)</P> <P></SPAN><SPAN style="LINE-HEIGHT: 200%">3. 생성 파일 (%시스템% 란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385610" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>클릭</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- </SPAN><SPAN style="LINE-HEIGHT: 200%">[시작 프로그램] 폴더 아래</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">isqsys32.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (32,768 바이트, MD5 : fe67524de8553ce7b756d65994e9d006)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- %시스템% 폴더 아래</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">beghgro.dll</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (319,936 바이트, MD5 : a45d717c5fee0a9d37d99836a1cf8315)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">sdra64.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (396,288 바이트, MD5 : fab7dc9afea163f56f556a5b4988d4af)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;./wbem\</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">proquota.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%">&nbsp;(40,960 바이트, MD5 : 359325b1ad1b7c603afd56855a8f74ab)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- %윈도우% 폴더 아래</SPAN> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">qenav1.dll</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (50,688 바이트, MD5 : 378e97e9c14ba8af3323af35343739bf)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;-----> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">Trojan.Win32.Hiloti</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> 로 진단 // </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">4. 주요 증상 : [<A href="http://blog.daum.net/virusmyths/4750273" target=_blank><U><FONT color=#0000ff>백도어</FONT></U></A>] 생성 후 악의적 명령 수행</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 금융 정보 탈취, 민감한 정보의 외부 유출</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 윈도우 방화벽을 우회하여 특정 사이트로부터 또 다른 악성코드 다운로드</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 자체 샌드박스를 이용한 은폐 기능 // [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4727618" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>루트킷</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 생성된 dll 파일은 [</SPAN><SPAN style="FONT-SIZE: 9pt; LINE-HEIGHT: 200%; FONT-FAMILY: 돋움체"><A href="http://blog.daum.net/virusmyths/5018698" target=_blank><U><FONT color=#0000ff>explorer.exe</FONT></U></A></SPAN><SPAN style="LINE-HEIGHT: 200%">]에 삽입되어 실행</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">5. 레지스트리 추가/변경 (HKLM 이란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385619" target=_blank><U><FONT color=#0000ff><SPAN style="LINE-HEIGHT: 200%">클릭</SPAN></FONT></U></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN><SPAN style="LINE-HEIGHT: 200%"> </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKLM -> SOFTWARE -> Microsoft -> Windows -> CurrentVersion -> Explorer -> </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;Browser Helper Objects -> {</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">5B7068B8-3B8D-479D-AE9F-93CDA5DEC048</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%">} // [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4390004" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>BHO</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKLM -> SOFTWARE -> Classes -> CLSID -> {5B7068B8-3B8D-479D-AE9F-93CDA5DEC048}</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKLM -> SOFTWARE -> Microsoft -> Windows -> CurrentVersion -> Phuxobab</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKEY_USERS -> .DEFAULT -> Software -> Microsoft -> Windows -> CurrentVersion -></SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;Explorer -> {</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">19127AD2-394B-70F5-C650-B97867BAA1F7</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%">}</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKEY_USERS -> .DEFAULT -> Software -> Microsoft -> Windows -> CurrentVersion -></SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;Explorer -> {</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%">} </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKEY_USERS -> .DEFAULT -> Software -> Microsoft -> Windows -> CurrentVersion -></SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;Internet Settings, ProxyEnable = 0</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">6. 진단/치료 (일부 <FONT color=#c5016c>통하기</FONT> 공개)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 루트킷 진단 도구 9개 : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4697200" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>다운로드</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">] </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 열려진 포트의 위험성과 포트 점검 요령 : [</SPAN><A href="http://blog.daum.net/virusmyths/4896495" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 자주 감염되는 악성코드 전용 제거/치료 도구 (80 종류) : [<A href="http://blog.daum.net/virusmyths/4818101" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인/오프라인 악성코드 검사/치료 도구 모음 : </SPAN><SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/4818109" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인 검사 도구 모음 (국내 6개 제품) : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4654549" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>바로가기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">7. 본 문서의 이용에 관한 조건 : [</SPAN><A class=con_link href="http://creativecommons.org/licenses/by-nc-nd/2.0/kr/" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>내용보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P></TD></TR></TBODY></TABLE></P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=explorer.exe" rel="tag" target="_blank">explorer.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=sdra64.exe" rel="tag" target="_blank">sdra64.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=proquota.exe" rel="tag" target="_blank">proquota.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=qenav1.dll" rel="tag" target="_blank">qenav1.dll</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=beghgro.dll" rel="tag" target="_blank">beghgro.dll</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=isqsys32.exe" rel="tag" target="_blank">isqsys32.exe</a> intel.exe, amd.exe 와 Trojan-Downloader.Win32.Genome.wfo 정보 tag:blog.daum.net,2009:virusmyths.6042152 어리버리 2009-11-04T23:00:07Z 2009-11-04T23:00:07Z <P> <TABLE borderColor=#5980ae cellSpacing=0 borderColorDark=#5980ae width=540 align=center borderColorLight=white border=1> <TBODY> <TR> <TD style="FONT-SIZE: 12pt; COLOR: white; FONT-FAMILY: 'Times New Roman'; TEXT-ALIGN: center" width=668 bgColor=#5980ae height=29> <P><B>Trojan-Downloader.Win32.Genome.wfo</B></P></TD></TR> <TR> <TD style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: 돋움체" vAlign=top borderColorLight=white align=left width=674 bgColor=white borderColorDark=#8092bb height=247> <P><SPAN style="LINE-HEIGHT: 200%">1. 요약 : 윈도우 기반의 [<A href="http://blog.daum.net/virusmyths/4853558" target=_blank><U><FONT color=#0000ff>다운로드형</FONT></U></A>] </SPAN><SPAN style="LINE-HEIGHT: 200%">[</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385693" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>트로이목마</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 코드명 : </SPAN><SPAN style="LINE-HEIGHT: 200%">Trojan-Downloader.Win32.Genome.wfo </SPAN><SPAN style="LINE-HEIGHT: 200%">(</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385594" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>명명</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%"> : <A href="http://www.kaspersky.co.kr/" target=_blank><U><FONT color=#0000ff>Kaspersky</FONT></U></A></SPAN><SPAN style="LINE-HEIGHT: 200%">, 2009-11-02, GMT+1)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 다른 이름 : 알려지지 않음</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 감염 경로 : 자체 전파 기능은 없으며, 정확한 경로는 알려지지 않았다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 크기 : 331,776 바이트 (MD5 : 4e3a21d65e9c87eeb59c0deffdbae450)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">2. 생성 파일 (%시스템% 란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385610" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>클릭</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- %시스템% 폴더 아래 : <FONT color=#c5016c>ie.exe</FONT>, </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">txS0S0.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%">, </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">tvX0X0.exe</SPAN></FONT> </P> <P><SPAN style="LINE-HEIGHT: 200%">3. 주요 증상 : 또 다른 악성코드 다운로드, [<A href="http://blog.daum.net/virusmyths/4750273" target=_blank><U><FONT color=#0000ff>백도어</FONT></U></A>] 생성 후 악의적 명령 수행</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 특정 사이트로부터 또 다른 악성코드 다운로드</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://70.[삭제].96.135/.icons/.servlet/</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">intel.exe</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;(91,532,928 바이트, MD5 : 45dfa98d5eb5dea2d7e33d80e3b504a4)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;-----> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">Trojan-Banker.Win32.Banker.apaa</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> 로 진단</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://70.[삭제].96.135/.icons/.servlet/</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">amd.exe</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;(244,224 바이트, MD5 : 8976f9868bec96e095de1c61a90d93bf)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;-----> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">Trojan-Downloader.Win32.Banload.aksc</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> 로 진단</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">4. 레지스트리 추가/변경 (HKLM 이란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385619" target=_blank><U><FONT color=#0000ff><SPAN style="LINE-HEIGHT: 200%">클릭</SPAN></FONT></U></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN><SPAN style="LINE-HEIGHT: 200%"> </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- </SPAN><SPAN style="LINE-HEIGHT: 200%">HKLM -> SOFTWARE -> Microsoft -> Windows -> CurrentVersion -> Run</SPAN> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">MyProgram</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> = %시스템%tvX0X0.exe</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">5. 진단/치료 (일부 통하기 공개)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 아직도 스파이웨어, 애드웨어를 V3로 치료하는 사람들 : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4853558" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 자주 감염되는 악성코드 전용 제거/치료 도구 (80 종류) : [<A href="http://blog.daum.net/virusmyths/4818101" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인/오프라인 악성코드 검사/치료 도구 모음 : </SPAN><SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/4818109" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인 검사 도구 모음 (국내 6개 제품) : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4654549" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>바로가기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">6. 본 문서의 이용에 관한 조건 : [</SPAN><A class=con_link href="http://creativecommons.org/licenses/by-nc-nd/2.0/kr/" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P></TD></TR></TBODY></TABLE></P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=intel.exe" rel="tag" target="_blank">intel.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=ie.exe" rel="tag" target="_blank">ie.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=txS0S0.exe" rel="tag" target="_blank">txS0S0.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=tvX0X0.exe" rel="tag" target="_blank">tvX0X0.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=amd.exe" rel="tag" target="_blank">amd.exe</a> [주의] nhn.exe 와 Trojan-Downloader.Win32.Genome.vqf 정보 tag:blog.daum.net,2009:virusmyths.6042142 어리버리 2009-11-01T19:40:28Z 2009-11-01T19:40:28Z <P> <TABLE borderColor=#5980ae cellSpacing=0 borderColorDark=#5980ae width=540 align=center borderColorLight=white border=1> <TBODY> <TR> <TD style="FONT-SIZE: 12pt; COLOR: white; FONT-FAMILY: 'Times New Roman'; TEXT-ALIGN: center" width=668 bgColor=#5980ae height=29><B>Trojan-Downloader.Win32.Genome.vqf</B> </TD></TR> <TR> <TD style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: 돋움체" vAlign=top borderColorLight=white align=left width=674 bgColor=white borderColorDark=#8092bb height=247> <P style="TEXT-ALIGN: right"><SPAN style="LINE-HEIGHT: 200%">[최종 업데이트 : 2009-11-06]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">1. 요약 : 윈도우 기반의 [<A href="http://blog.daum.net/virusmyths/4853558" target=_blank><U><FONT color=#0000ff>다운로드형</FONT></U></A>] </SPAN><SPAN style="LINE-HEIGHT: 200%">[</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385693" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>트로이목마</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 코드명 : </SPAN><SPAN style="LINE-HEIGHT: 200%">Trojan-Downloader.Win32.Genome.vqf </SPAN><SPAN style="LINE-HEIGHT: 200%">(</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385594" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>명명</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%"> : <A href="http://www.kaspersky.co.kr/" target=_blank><U><FONT color=#0000ff>Kaspersky</FONT></U></A></SPAN><SPAN style="LINE-HEIGHT: 200%">, 2009-10-29, GMT+1)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 다른 이름 : </SPAN><SPAN style="LINE-HEIGHT: 200%">Trojan-Dropper.Delf, Mal/Generic-A</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 감염 경로 : 자체 전파 기능은 없으며, 정확한 경로는 알려지지 않았다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 크기 : 244,736 바이트 (MD5 : 81ea97e7efaafa963435c4ae006c09b1)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">2. 생성 파일 (%시스템% 란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385610" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>클릭</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- %시스템% 폴더 아래 :<FONT color=#c5016c> </FONT></SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">isnap.exe</SPAN></FONT> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- %윈도우% 폴더 아래</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;./msapps\msinfo\</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">nhn.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (237,056 바이트, MD5 : d28d6d97915498566954562101f99c39)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">3. 주요 증상 : </SPAN><SPAN style="LINE-HEIGHT: 200%">[</SPAN><A href="http://blog.daum.net/virusmyths/4916981" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>가짜 백신</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]&nbsp;<SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/6042158" target=_blank><U><FONT color=#0000ff>디도스클린</FONT></U></A>] 다운로드 및 설치</SPAN></P></SPAN> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 사용자의 동의없이 특정 사이트로부터 가짜 백신 다운로드 및 설치하고 허위 진단결과를</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp; 출력한 후 치료를 위해 제품 결제를 유도, 일부 생성 파일들은 네이버 툴바의 에이전트</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp; 파일명과 동일한 파일명을 가졌다. 네이버가 한국에서는 유명한(?) 모양이다.</SPAN><SPAN style="LINE-HEIGHT: 200%"><SPAN style="LINE-HEIGHT: 200%"><SPAN style="LINE-HEIGHT: 200%"></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://[삭제].207.112.169/nhn/1000</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">/nhn.exe </SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;(237,056 바이트, MD5 : db013cccf2d3c53d14bc8f63e1203fd0)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://[삭제].ddosclean.com/<FONT color=#c5016c>nhn3.exe</FONT></SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;(1,170,861 바이트, MD5 : f9ef2efd9cbf2f6da170d11bc6378482)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://[삭제].207.112.169/nhn/1000/</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">nhnsetup.exe </SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;(182,784 바이트, MD5 : a6b5934ed1f2e7babe80159e03acfdcf)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://[삭제].207.112.169/nhn/1000/nhn.sys </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://[삭제].ddosclean.com/version/version</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://[삭제].ddosclean.com/version/[삭제]/<FONT color=#c5016c>ddoscleanu.exe</FONT></SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://[삭제].ddosclean.com/version/[삭제]/<FONT color=#c5016c>ddosclean.exe</FONT></SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://[삭제].ddosclean.com/version/[삭제]/ddosclean.dll</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://[삭제].ddosclean.com/version/[삭제]/<FONT color=#c5016c>uninst_ddosclean.exe</FONT></SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;(182,752 바이트, MD5 : 6edbbe2e6eaf45a77b39c5b9f8eca2ce)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://[삭제].ddosclean.com/version/bina/ddoscleanbk.exe</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://[삭제].ddosclean.com/version/bina/ddoscleandata</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://www.muh[삭제].net/sdclean_m.php</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://www.tab[삭제].com/isnap/1005/<FONT color=#c5016c>xpu.dll</FONT></SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;(167,936 바이트, MD5 : c8d4b575ca567a237446b6dc920febba)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;[http]://www.tab[삭제].com/isnap/1005/isnap.sys</SPAN> </P></SPAN></SPAN></SPAN> <P style="TEXT-ALIGN: center"><img src="http://cfile239.uf.daum.net/image/13520D204AF2F33435F241" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="540" hspace="1" width="540" vspace="1" border="0" /></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center"><img src="http://cfile214.uf.daum.net/image/14520D204AF2F3343666AB" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="412" hspace="1" width="412" vspace="1" border="0" /><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%">4. 레지스트리 추가/변경 (HKLM 이란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385619" target=_blank><U><FONT color=#0000ff><SPAN style="LINE-HEIGHT: 200%">클릭</SPAN></FONT></U></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN><SPAN style="LINE-HEIGHT: 200%"> </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- </SPAN><SPAN style="LINE-HEIGHT: 200%">HKCU -> Software -> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">isnap </SPAN></FONT> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKCU -> Software -> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">nhn </SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKCU -> Software -></SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%"> nhn3 </SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKCU -> Software -> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">nhnsetup</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">5. nhn.exe 파일에 대한 진단 여부 (기준 : 2009-11-06)</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp; <TABLE cellSpacing=0 borderColorDark=white width=540 align=center borderColorLight=black border=1> <TBODY> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">안티바이러스</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">엔진 버전</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">정의 날짜</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">검사 결과</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">a-squared</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">4.5.0.41</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 115%">Trojan-Downloader.Win32.Delf!IK</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">AhnLab-V3</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">5.0.0.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">AntiVir</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">7.9.1.53</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Antiy-AVL</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">2.0.3.7</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Authentium</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">5.2.0.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Avast</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">4.8.1351.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">AVG</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">8.5.0.423</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 115%">Generic15.APEY</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">BitDefender</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">7.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">CAT-QuickHeal</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">10.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">ClamAV</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">0.94.1</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Comodo</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">2850</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">DrWeb</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">5.0.0.12182</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 115%">DLOADER.Trojan</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">eSafe</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">7.0.17.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 115%">Suspicious File</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">eTrust-Vet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">35.1.7105</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">F-Prot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">4.5.1.85</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">F-Secure</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">9.0.15370.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.04</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Fortinet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">3.120.0.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">GData</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">19</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Ikarus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">T3.1.1.74.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 115%">Trojan-Downloader.Win32.Delf</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Jiangmin</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">11.0.800</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">K7AntiVirus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">7.10.889</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Kaspersky</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">7.0.0.125</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 115%">Heur.Trojan.Generic</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">McAfee</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">5792</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.04</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">McAfee+Artemis</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">5793</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 115%">Artemis!DB013CCCF2D3</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">McAfee-GW-Edition</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">6.8.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 115%">Heuristic.LooksLike.Trojan.Crypt.C</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Microsoft</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">1.5202</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">NOD32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">4576</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 115%">probably unknown NewHeur_PE</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Norman</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">6.03.02</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 115%">W32/Malware.JSKQ</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">nProtect</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">2009.1.8.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Panda</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">10.0.2.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.04</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">PCTools</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">7.0.3.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 115%">Downloader.Generic</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Prevx</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">3.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Rising</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">21.54.34.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Sophos</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">4.47.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 115%">Mal/Generic-A</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Sunbelt</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">3.2.1858.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">Symantec</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">1.4.4.12</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD style="COLOR: red"><SPAN style="LINE-HEIGHT: 115%">Downloader</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">TheHacker</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">6.5.0.2.061</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">TrendMicro</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">9.0.0.1003</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">VBA32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">3.12.10.11</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.04</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">ViRobot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">2009.11.5.2023</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 115%">VirusBuster</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">4.6.5.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 115%">2009.11.05</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 115%">-</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 115%">추가 정보</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 115%">File size: 237056 bytes</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 115%">MD5...: db013cccf2d3c53d14bc8f63e1203fd0</SPAN></TD></TR></TBODY></TABLE></SPAN></P> <P>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%">6. 기타 다운로드 된 파일들 진단 (기준 : Kaspersky)</SPAN></P><SPAN style="LINE-HEIGHT: 200%"> <P>&nbsp;- 각 생성 파일에 대한 보안 제품별 진단 여부 : [<A href="http://blog.daum.net/virusmyths/6042161" target=_blank><U><FONT color=#0000ff>보기</FONT></U></A>]</P></SPAN> <P style="TEXT-ALIGN: center"><img src="http://cfile238.uf.daum.net/image/1621D2164AF45D1507E61A" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="540" hspace="1" width="540" vspace="1" border="0" /></P> <P><SPAN style="LINE-HEIGHT: 200%"></SPAN>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%">7. 진단/치료 (일부 통하기 공개)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 아직도 스파이웨어, 애드웨어를 V3로 치료하는 사람들 : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4853558" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 자주 감염되는 악성코드 전용 제거/치료 도구 (80 종류) : [<A href="http://blog.daum.net/virusmyths/4818101" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인/오프라인 악성코드 검사/치료 도구 모음 : </SPAN><SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/4818109" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인 검사 도구 모음 (국내 6개 제품) : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4654549" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>바로가기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">8. 본 문서의 이용에 관한 조건 : [</SPAN><A class=con_link href="http://creativecommons.org/licenses/by-nc-nd/2.0/kr/" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P></TD></TR></TBODY></TABLE></P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=가짜백신" rel="tag" target="_blank">가짜백신</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=isnap.exe" rel="tag" target="_blank">isnap.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=nhn.exe" rel="tag" target="_blank">nhn.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=디도스클린" rel="tag" target="_blank">디도스클린</a> [주의] 페이스북 악성코드, 동영상으로 유포 tag:blog.daum.net,2009:virusmyths.6042141 어리버리 2009-10-31T01:23:32Z 2009-10-31T01:23:32Z <P>지난 26일 새벽부터 보고되기 시작한&nbsp; [<A href="http://blog.daum.net/virusmyths/6042138" target=_blank><U><FONT color=#0000ff>페이스북에서 전송한 E-mail 로 위장한 악성코드</FONT></U></A>(2009/10/29)]가</P> <P>&nbsp;</P> <P>유포 방식을&nbsp;변경하고 있어 각별한 주의가 요망된다.</P> <P>&nbsp;</P> <P>이번에는 E-mail 이 아닌 동영상 파일로 위장하여 유포되고 있으며,</P> <P>&nbsp;</P> <P>해당 동영상을 클릭할 경우 특정 악성 파일을 다운로드 하라는 메시지 창이 출력된다.&nbsp;</P> <P style="TEXT-ALIGN: center">&nbsp;</P> <P style="TEXT-ALIGN: center"><img src="http://cfile208.uf.daum.net/image/161302164AEB129B04B4EB" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="540" hspace="1" width="540" vspace="1" border="0" /></P> <P style="TEXT-ALIGN: center">&nbsp;</P> <P style="TEXT-ALIGN: center"><img src="http://cfile202.uf.daum.net/image/171302164AEB129B05B384" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="470" hspace="1" width="470" vspace="1" border="0" /></P> <P style="TEXT-ALIGN: center">&nbsp;</P> <P style="TEXT-ALIGN: left">다운로드 된 파일은 현재 분석 중이며, 국내 보안 제품들이 진단하지 못하고 있어 특정 업체 2곳으로</P> <P style="TEXT-ALIGN: left">보냈다. 회신을 기다리는 중... </P> <P style="TEXT-ALIGN: left">참고로 exe.exe 파일이 실행할 경우, 아래 허위 에러 메시지가 출력되고,</P> <P style="TEXT-ALIGN: left">&nbsp;</P> <P style="TEXT-ALIGN: center"><img src="http://cfile224.uf.daum.net/image/1231D6184AEB1A7F6ECB92" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="401" hspace="1" width="401" vspace="1" border="0" /></P> <P style="TEXT-ALIGN: left">&nbsp;</P> <P style="TEXT-ALIGN: left">특정 사이트로부터 [<A href="http://blog.daum.net/virusmyths/4916981" target=_blank><U><FONT color=#0000ff>가짜백신</FONT></U></A>]&nbsp;[Advanced Virus Remover]&nbsp;등을&nbsp;내려받아 설치한다.&nbsp;</P> <P style="TEXT-ALIGN: left">&nbsp;</P> <P style="TEXT-ALIGN: left">&nbsp;</P> <P style="TEXT-ALIGN: left">참고로 다운로드된 exe.exe 파일에 대한 각 보안 제품별 진단 여부는 아래와 같다. (기준 : 2009-10-30)</P> <P style="TEXT-ALIGN: left">&nbsp;</P> <P style="TEXT-ALIGN: left">&nbsp;[파일정보]</P> <P style="TEXT-ALIGN: left">&nbsp;- 파일명 : exe.exe<BR>&nbsp;- 크기 : 27,648 바이트 (MD5:&nbsp; df5004de958796a3e8d632833bfd68b1)</P> <P style="TEXT-ALIGN: left">&nbsp; <TABLE cellSpacing=0 borderColorDark=white width=540 align=center borderColorLight=black border=1> <TBODY> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">안티바이러스</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">엔진 버전</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">정의 날짜</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">검사 결과</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">a-squared</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.5.0.41</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AhnLab-V3</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AntiVir</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.9.1.50</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Antiy-AVL</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2.0.3.7</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Authentium</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.1.2.4</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Avast</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.8.1351.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.29</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">AVG</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">8.5.0.423</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">BitDefender</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">CAT-QuickHeal</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ClamAV</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">0.94.1</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Comodo</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2780</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">DrWeb</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5.0.0.12182</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">eSafe</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.17.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.29</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">eTrust-Vet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">35.1.7093</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Prot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.5.1.85</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">F-Secure</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">9.0.15370.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.27</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Fortinet</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.120.0.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">GData</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">19</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Ikarus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">T3.1.1.72.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Jiangmin</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">11.0.800</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">K7AntiVirus</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.10.884</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Kaspersky</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.0.125</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5786</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.29</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee+Artemis</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">5786</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.29</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">McAfee-GW-Edition</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.8.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Microsoft</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.5202</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">NOD32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4558</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Norman</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.03.02</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">nProtect</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.1.8.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Panda</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">10.0.2.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">PCTools</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">7.0.3.5</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Prevx</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Rising</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">21.53.43.00</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sophos</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.47.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Sunbelt</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.2.1858.2</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">Symantec</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">1.4.4.12</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TheHacker</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">6.5.0.2.056</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.28</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">TrendMicro</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">8.950.0.1094</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VBA32</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">3.12.10.11</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.29</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">ViRobot</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">2009.10.30.2013</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.30</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD><SPAN style="LINE-HEIGHT: 120%">VirusBuster</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">4.6.5.0</SPAN></TD> <TD style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 120%">2009.10.29</SPAN></TD> <TD><SPAN style="LINE-HEIGHT: 120%">-</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">추가 정보</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">File size: 27648 bytes</SPAN></TD></TR> <TR> <TD colSpan=4><SPAN style="LINE-HEIGHT: 120%">MD5...: df5004de958796a3e8d632833bfd68b1</SPAN></TD></TR></TBODY></TABLE></P> <P style="TEXT-ALIGN: center">&nbsp;</P> <P>&nbsp;</P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=페이스북" rel="tag" target="_blank">페이스북</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=facebook" rel="tag" target="_blank">facebook</a> windows7addon.exe 와 Win-Trojan/Genome.3584.L 정보 tag:blog.daum.net,2009:virusmyths.6042139 어리버리 2009-10-31T00:51:14Z 2009-10-31T00:51:14Z <P> <TABLE borderColor=#5980ae cellSpacing=0 borderColorDark=#5980ae width=540 align=center borderColorLight=white border=1> <TBODY> <TR> <TD style="FONT-SIZE: 12pt; COLOR: white; FONT-FAMILY: 'Times New Roman'; TEXT-ALIGN: center" width=668 bgColor=#5980ae borderColorDark=#5980ae height=29><B>Win-Trojan/Genome.3584.L</B> </TD></TR> <TR> <TD style="FONT-SIZE: 9pt; COLOR: black; LINE-HEIGHT: 100%; FONT-FAMILY: 돋움체" vAlign=top borderColorLight=white align=left width=674 bgColor=white borderColorDark=#5980ae height=247> <P><SPAN style="LINE-HEIGHT: 200%">1. 요약 : <SPAN style="LINE-HEIGHT: 200%">윈도우 기반의 [<A href="http://blog.daum.net/virusmyths/4853558" target=_blank><U><FONT color=#0000ff>다운로드형</FONT></U></A>] </SPAN><SPAN style="LINE-HEIGHT: 200%">[</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385693" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>트로이목마</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 코드명 : Win-Trojan/Genome.3584.L (</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385594" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>명명</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%"> : </SPAN><SPAN style="LINE-HEIGHT: 200%"><A href="http://home.ahnlab.com/" target=_blank><U><FONT color=#0000ff>AhnLab</FONT></U></A></SPAN><SPAN style="LINE-HEIGHT: 200%">, </SPAN><SPAN style="LINE-HEIGHT: 200%">2009-10-30, GMT+1)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 다른 이름 : Trojan-Downloader.Win32.Genome.vjn</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 감염 경로 : [</SPAN><A href="http://blog.daum.net/virusmyths/4787921" target=_blank><FONT color=#0000ff><SPAN style="LINE-HEIGHT: 200%"><U>이동식 저장 장치</U></SPAN></FONT></A><SPAN style="LINE-HEIGHT: 200%">] 예) USB, Mp3 플레이어 등 + [<A href="http://blog.daum.net/virusmyths/5892223" target=_blank><U><FONT color=#0000ff>MS08-067</FONT></U></A>] 보안 취약점</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">2. 감염 예방 </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- USB & Autorun 웜 감염 예방 도구 2개 : [<A href="http://blog.daum.net/virusmyths/6041883" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- </SPAN><SPAN style="LINE-HEIGHT: 200%">USB로 감염되는 악성코드 분석 및 감염 예방 : [</SPAN><A href="http://blog.daum.net/virusmyths/5542173" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%"><SPAN style="LINE-HEIGHT: 200%"><SPAN style="LINE-HEIGHT: 200%">&nbsp;- Autorun.inf 파일은 악성코드가 아니다. : [<A href="http://blog.daum.net/virusmyths/4787921" target=_blank><U><FONT color=#0000ff>보기</FONT></U></A>]</SPAN></SPAN></SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%"><SPAN style="LINE-HEIGHT: 200%"><SPAN style="LINE-HEIGHT: 200%">&nbsp;- </SPAN></SPAN></SPAN><SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/5892223" target=_blank><U><FONT color=#0000ff>MS08-067</FONT></U></A>] 보안 취약점 패치 설치 : [<A href="http://blog.daum.net/virusmyths/4697202" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">3. 생성 파일 </SPAN><SPAN style="LINE-HEIGHT: 200%">(%시스템% 란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385610" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>클릭</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- %윈도우% 폴더 : </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">windows7addon.exe</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- %시스템% 폴더 : </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">temp32.bat </SPAN></FONT> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 시스템 드라이브 : ./recycler\s-1-5-21-[임의의 숫자] 폴더 아래 :</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%"> mwau.exe</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 이동식 디스크 루트 : [<A class=con_link href="http://blog.daum.net/virusmyths/4787921" target=_blank><U><FONT color=#0000ff>autorun.inf</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 이동식 디스크 : </SPAN><SPAN style="LINE-HEIGHT: 200%">./s-1-5-21-[임의의 숫자]\</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">sysmngr32.exe &nbsp;</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 이동식 디스크 : ./empty 폴더 아래 : </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">autorun.exe</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">3. 주요 증상 : 특정 사이트에서 또 다른 악성코드 다운로드</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">4. 레지스트리 추가/변경 </SPAN><SPAN style="LINE-HEIGHT: 200%">(HKLM 이란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385619" target=_blank><U><FONT color=#0000ff><SPAN style="LINE-HEIGHT: 200%">클릭</SPAN></FONT></U></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKLM -> SOFTWARE -> Microsoft -> Windows -> CurrentVersion -> Run</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">Microsoft Driver Setup</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> = %윈도우%windows7addon.exe</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- </SPAN><SPAN style="LINE-HEIGHT: 200%">HKLM -> SOFTWARE -> Microsoft -> Windows -> CurrentVersion -> policies -> </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;Explorer -> Run, Microsoft Driver Setup = %윈도우%windows7addon.exe</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKLM -> SOFTWARE -> Microsoft -> Windows NT -> CurrentVersion -> Winlogon </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">Taskman </SPAN></FONT><SPAN style="LINE-HEIGHT: 200%">= 시스템 루트\recycler\s-1-5-21-[임의의 숫자]\mwau.exe</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">5. 진단/치료 (일부 통하기 공개)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- Autorun 웜 전용 제거 도구 : [<A href="http://blog.daum.net/virusmyths/5431933" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>] </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 아직도 스파이웨어, 애드웨어를 V3로 치료하는 사람들 : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4853558" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>내용보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 자주 감염되는 악성코드 전용 제거/치료 도구 (80 종류) : [<A href="http://blog.daum.net/virusmyths/4818101" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인/오프라인 악성코드 검사/치료 도구 모음 : </SPAN><SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/4818109" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인 검사 도구 모음 (국내 6개 제품) : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4654549" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>바로가기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">6. 본 문서의 이용에 관한 조건 : [</SPAN><A class=con_link href="http://creativecommons.org/licenses/by-nc-nd/2.0/kr/" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P></TD></TR></TBODY></TABLE></P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=autorun.inf" rel="tag" target="_blank">autorun.inf</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=autorun.exe" rel="tag" target="_blank">autorun.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=windows7addon.exe" rel="tag" target="_blank">windows7addon.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=temp32.bat" rel="tag" target="_blank">temp32.bat</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=sysmngr32.exe" rel="tag" target="_blank">sysmngr32.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=mwau.exe" rel="tag" target="_blank">mwau.exe</a> [주의] Facebook 웜 tag:blog.daum.net,2009:virusmyths.6042138 어리버리 2009-10-29T23:57:36Z 2009-10-29T23:57:36Z <P>소셜 네트워킹의 하나인 '페이스북'에서 보낸 E-mail 로 위장한 악성코드가 해외에서 어제(28일)부터</P> <P>&nbsp;</P> <P>대량으로 유포되고 있어 페이스북 이용자들은 각별한 주의가 요망된다.</P> <P>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%">1. 전송된 E-mail 정보</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;- 편지 제목 :&nbsp; </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">Facebook Password Reset Confirmation</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;- 알려진 첨부 파일명 :<FONT color=#c5016c> Facebook_Password_401ff.zip</FONT></SPAN>&nbsp;</P> <P>&nbsp;</P> <P style="TEXT-ALIGN: center"><img src="http://cfile232.uf.daum.net/image/1232271A4AEB0DC9210BE3" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="536" hspace="1" width="536" vspace="1" border="0" /></P> <P style="TEXT-ALIGN: center">&nbsp;</P> <P style="TEXT-ALIGN: left"></P> <P><SPAN style="LINE-HEIGHT: 200%">3. 주요 증상 및 특이점</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp; 윈도우의 정상 프로세스인 [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/5041733" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>svchost.exe</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">] 와 [</SPAN><SPAN style="FONT-SIZE: 9pt; LINE-HEIGHT: 200%; FONT-FAMILY: 돋움체"><A href="http://blog.daum.net/virusmyths/5018698" target=_blank><U><FONT color=#0000ff>explorer.exe</FONT></U></A></SPAN><SPAN style="LINE-HEIGHT: 200%">]에&nbsp; 코드를 삽입하여</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp; 방화벽을 우회하고 특정 사이트로부터 [</SPAN><A href="http://blog.daum.net/virusmyths/4916981" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>가짜백신</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]을 다운로드 하고 실행한다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp; 또한 80번 포트를&nbsp;통해 특정 호스트 202.39.17.* 에 접속을 시도한다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp; 특이한 점은 자체 샌드박스 코드를 가지고 있어 외부에서 진단을 하려고 하면</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp; 실행을 스스로 멈추고 봇넷&nbsp;활동도 중지하는&nbsp;특징을 가졌다. 재미있네...</SPAN></P> <P>&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%">4. 관련 포스트</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</P> <P>&nbsp;&nbsp; - [주의] 페이북 악성코드 유포 방식 변경 : [<A href="http://blog.daum.net/virusmyths/6042141" target=_blank><U><FONT color=#0000ff>보기</FONT></U></A>] (2009/10/31)</P></SPAN> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp; - 악성코드 ‘브레도랩’ 확산...이메일 첨부파일 주의! : [<A href="http://www.boannews.com/media/view.asp?idx=18333&kind=&sub_kind=" target=_blank><U><FONT color=#810081>보안뉴스</FONT></U></A>] (09/10/29)</SPAN></P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=페이스북" rel="tag" target="_blank">페이스북</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=facebook" rel="tag" target="_blank">facebook</a> winsock2.dll 와 Dropper/Malware.88576.E 정보 tag:blog.daum.net,2009:virusmyths.6042137 어리버리 2009-10-29T23:57:27Z 2009-10-29T23:57:27Z <P> <TABLE borderColor=#5980ae cellSpacing=0 borderColorDark=#5980ae width=540 align=center borderColorLight=white border=1> <TBODY> <TR> <TD style="FONT-SIZE: 12pt; COLOR: white; FONT-FAMILY: 'Times New Roman'; TEXT-ALIGN: center" width=668 bgColor=#5980ae height=29> <P><B>Dropper/Malware.88576.E</B></P></TD></TR> <TR> <TD style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: 돋움체" vAlign=top borderColorLight=white align=left width=674 bgColor=white borderColorDark=#8092bb height=247> <P><SPAN style="LINE-HEIGHT: 200%">1. 요약 : 윈도우 기반의 [<A href="http://blog.daum.net/virusmyths/4853558" target=_blank><U><FONT color=#0000ff>다운로드형</FONT></U></A>] </SPAN><SPAN style="LINE-HEIGHT: 200%">[</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385693" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>트로이목마</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 코드명 : </SPAN><SPAN style="LINE-HEIGHT: 200%">Dropper/Malware.88576.E </SPAN><SPAN style="LINE-HEIGHT: 200%">(</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385594" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>명명</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%"> : <A href="http://home.ahnlab.com/" target=_blank><U><FONT color=#0000ff>AhnLab</FONT></U></A></SPAN><SPAN style="LINE-HEIGHT: 200%">, 2009-10-29, GMT+9)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 다른 이름 : </SPAN><SPAN style="LINE-HEIGHT: 200%">Trojan.Rincux.AW, Trojan.Rincux </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 감염 경로 : 자체 전파 기능은 없으며, 정확한 경로는 알려지지 않았다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 크기 : 88,576 바이트 (MD5 : 719ea5905b5abdece02d9672593fcf0a)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 1건의 문의를 받았다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">2. 생성 파일 (%시스템% 란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385610" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>클릭</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- %시스템% 폴더 아래</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">winsock2.dll</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (7,168 바이트, MD5 : 45abf75bfda12acb313135a94cf303c1)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;./drivers\</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">tcpip4.sys</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (74,240 바이트, MD5 : 1653ab9616953520095d1de1a920ab46)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">3. 주요 증상 : 다른 악성 파일 생성 및 설치, 은폐 기능</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 생성된 dll 파일은 [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/5041733" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>svchost.exe</FONT></U></SPAN></A><A class=con_link><SPAN style="LINE-HEIGHT: 200%">]에 삽입되어 실행</SPAN></A></P> <P><SPAN style="LINE-HEIGHT: 200%">4. 레지스트리 추가/변경 (HKLM 이란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385619" target=_blank><U><FONT color=#0000ff><SPAN style="LINE-HEIGHT: 200%">클릭</SPAN></FONT></U></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN><SPAN style="LINE-HEIGHT: 200%"> </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- </SPAN><SPAN style="LINE-HEIGHT: 200%">HKLM -> SYSTEM -> ControlSet001 -> Control -> MediaResources -> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">msvideo</SPAN></FONT> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKLM -> SYSTEM -> ControlSet001 -> Enum -> Root -> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">LEGACY_IAS</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKLM -> SYSTEM -> ControlSet001 -> Services -> </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">Ias </SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">5. 진단/치료 (일부 통하기 공개)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 루트킷 진단 도구 9개 : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4697200" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>다운로드</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 아직도 스파이웨어, 애드웨어를 V3로 치료하는 사람들 : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4853558" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 자주 감염되는 악성코드 전용 제거/치료 도구 (80 종류) : [<A href="http://blog.daum.net/virusmyths/4818101" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인/오프라인 악성코드 검사/치료 도구 모음 : </SPAN><SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/4818109" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인 검사 도구 모음 (국내 6개 제품) : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4654549" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>바로가기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">6. 본 문서의 이용에 관한 조건 : [</SPAN><A class=con_link href="http://creativecommons.org/licenses/by-nc-nd/2.0/kr/" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P></TD></TR></TBODY></TABLE></P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=svchost.exe" rel="tag" target="_blank">svchost.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=winsock2.dll" rel="tag" target="_blank">winsock2.dll</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=tcpip4.sys" rel="tag" target="_blank">tcpip4.sys</a> 윈도우7, 빠른 실행 사용하기 tag:blog.daum.net,2009:virusmyths.6042132 어리버리 2009-10-28T01:09:08Z 2009-10-28T01:09:08Z <P> <TABLE borderColor=#5980ae cellSpacing=0 borderColorDark=#5980ae width=540 align=center borderColorLight=white border=1> <TBODY> <TR> <TD style="FONT-SIZE: 12pt; COLOR: white; FONT-FAMILY: 'Times New Roman'; TEXT-ALIGN: center" width=668 bgColor=#5980ae height=29><B>윈도우7에서 빠른 실행 메뉴 사용하기</B> </TD></TR> <TR> <TD style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: 돋움체" vAlign=top borderColorLight=white align=left width=674 bgColor=white borderColorDark=#8092bb height=247> <P><SPAN style="LINE-HEIGHT: 200%">1. 개요</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;윈도우7을 처음 접하고 불편했던 것이 몇가지 있었다. 그 중에서도 즐겨 사용해오던</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;빠른 실행 기능을 어떻게 윈도우7에서도 사용해야 할지 몰라 무척 불편했던 것 같다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN><SPAN style="LINE-HEIGHT: 200%">아래 글들이 윈도우7을 접하고 당황할지도 모를 초보 유저들에게 도움이 되었으면 좋겠다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">2. 빠른 실행 메뉴 윈도우7에서도 사용하기</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;1단계) 작업표시줄에서 오른쪽 마우스를 클릭하여 먼저 '작업 표시줄 작금(L)' 해제</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center"><img src="http://cfile201.uf.daum.net/image/1811131E4AF53E3A2797B5" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="233" hspace="1" width="233" vspace="1" border="0" /></P> <P style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P align=center></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;2단계) 작업표시줄에서 오른쪽 마우스를 클릭하여 [도구 모음(T)] -> '<FONT color=#c5016c>새 도구 모음(N)</FONT>' 클릭</SPAN></P> <P style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 200%"><img src="http://cfile235.uf.daum.net/image/134D791C4AF53E4D263959" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="410" hspace="1" width="410" vspace="1" border="0" /></SPAN></P> <P align=center></P> <P align=left>&nbsp;</P> <P align=left><SPAN style="LINE-HEIGHT: 200%">&nbsp;3단계) 폴더: 입력 하는 부분에 아래 내용을 입력 [첨부 파일] 다운로드 후 복사/붙여넣기 </SPAN></P> <P align=left><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;한 후,</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center"><A href="http://cfile206.uf.daum.net/attach/1401571B4AF53EC5705288" target="_blank"><img src="http://icon.daum-img.net/editor/p_txt_s.gif"/> Quick_Launch_cmd.txt</a><SPAN style="LINE-HEIGHT: 200%"></SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">%userprofile%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch</SPAN></FONT></P> <P align=left><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'폴더 선택'을 클릭한다. (아무런 변화는 없다.)</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center"><img src="http://cfile240.uf.daum.net/image/1948DB1A4AF53E641C7BFE" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="540" hspace="1" width="540" vspace="1" border="0" /></P> <P style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P align=center></P> <P align=left><SPAN style="LINE-HEIGHT: 200%">&nbsp;4단계) 작업표시줄 우측에 빠른 실행 항목, '<FONT color=#c5016c>Quick Launch</FONT>' 가 생겼다.</SPAN>&nbsp;</P> <P style="TEXT-ALIGN: center"><img src="http://cfile207.uf.daum.net/image/2057021C4AF53E7404C3EA" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="435" hspace="1" width="435" vspace="1" border="0" /></P> <P style="TEXT-ALIGN: center">&nbsp;</P> <P align=center></P> <P align=left><SPAN style="LINE-HEIGHT: 200%">&nbsp;5단계) '<FONT color=#c5016c>Quick Launch</FONT>'에서 오른쪽 마우스를 클릭하여, '<FONT color=#c5016c>텍스트 표시(X)</FONT>' 항목과 </SPAN></P> <P align=left><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'<FONT color=#c5016c>제목 표시(W)</FONT>' 항목을 <FONT color=#c5016c>체크 해제</FONT> 한다.</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center"><img src="http://cfile215.uf.daum.net/image/1856221A4AF53E7E060E64" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="304" hspace="1" width="304" vspace="1" border="0" /></P> <P style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P align=center></P> <P align=left><SPAN style="LINE-HEIGHT: 200%">&nbsp;6단계) 이제 빠른 실행 메뉴가 보인다. 윈도우XP 처럼 왼쪽으로 쭈욱~ 드래그하여 위치를 </SPAN></P> <P align=left><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;조정하고, XP에서 그랬던 것처럼 필요한 프로그램들을 등록해서 사용하면 된다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">4. 윈도우7 관련 설정 팁</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 윈도우7, 탐색기 시작 위치 설정 및 메뉴 항상 보이기&nbsp;: [<A href="http://blog.daum.net/virusmyths/6042128" target=_blank><U><FONT color=#810081>보기</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">5. 본 문서의 이용에 관한 조건 : [</SPAN><A class=con_link href="http://creativecommons.org/licenses/by-nc-nd/2.0/kr/" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P></TD></TR></TBODY></TABLE></P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=윈도우7" rel="tag" target="_blank">윈도우7</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=빠른실행" rel="tag" target="_blank">빠른실행</a> zhido.exe 와 Trojan-GameThief.Win32.Magania 정보 tag:blog.daum.net,2009:virusmyths.6042131 어리버리 2009-10-28T01:08:59Z 2009-10-28T01:08:59Z <P> <TABLE borderColor=#5980ae cellSpacing=0 borderColorDark=#5980ae width=540 align=center borderColorLight=white border=1> <TBODY> <TR> <TD style="FONT-SIZE: 12pt; COLOR: white; FONT-FAMILY: 'Times New Roman'; TEXT-ALIGN: center" width=668 bgColor=#5980ae height=29> <P><B>Trojan-GameThief.Win32.Magania</B></P></TD></TR> <TR> <TD style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: 돋움체" vAlign=top borderColorLight=white align=left width=674 bgColor=white borderColorDark=#8092bb height=247> <P><SPAN style="LINE-HEIGHT: 200%">1. 요약 : 윈도우 기반의 정보 유출형 </SPAN><SPAN style="LINE-HEIGHT: 200%">[</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385693" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>트로이목마</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 코드명 : </SPAN><SPAN style="LINE-HEIGHT: 200%">Trojan-GameThief.Win32.Magania </SPAN><SPAN style="LINE-HEIGHT: 200%">(</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385594" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>명명</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%"> : </SPAN><A href="http://www.ikarussoftware.com/" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>Ikarus</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">, 2009-10-28, GMT+1)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 다른 이름 : Trojan-GameThief.Win32.Magania</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 크기 : 276,480 바이트 (MD5 : 29f85a0c52411773aa2bb948ecdc4d76)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 감염 경로 : 자체 전파 기능은 없으며, 정확한 경로는 알려지지 않았다.</SPAN> <P><SPAN style="LINE-HEIGHT: 200%">2. 생성 파일 (%시스템% 란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385610" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>클릭</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- %시스템% 폴더 아래</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">cao110.dll</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> 또는 </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">cao111.dll</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (55,296 바이트, MD5 : 34e9fe75d59053fcddc92b88ab1cc012)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">zhido.exe</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> (276,480 바이트, MD5 : 29f85a0c52411773aa2bb948ecdc4d76)</SPAN> <P><SPAN style="LINE-HEIGHT: 200%">3. 주요 증상 : </SPAN><SPAN style="LINE-HEIGHT: 200%">특정 온라인 게임의 로그인 패스워드 탈취 후 전송</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">4. 레지스트리 추가/변경 (HKLM 이란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385619" target=_blank><U><FONT color=#0000ff><SPAN style="LINE-HEIGHT: 200%">클릭</SPAN></FONT></U></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN><SPAN style="LINE-HEIGHT: 200%"> </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKCU -> Software -> Microsoft -> Windows -> CurrentVersion -> Run</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">zhido</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> = %시스템%zhido.exe</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">5. 진단/치료 (일부 <FONT color=#c5016c>통하기</FONT> 공개)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 온라인 게임 트로이목마 전용 제거 도구 : [<A href="http://blog.daum.net/virusmyths/5784731" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 자주 감염되는 악성코드 전용 제거/치료 도구 (80 종류) : [<A href="http://blog.daum.net/virusmyths/4818101" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인/오프라인 악성코드 검사/치료 도구 모음 : </SPAN><SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/4818109" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인 검사 도구 모음 (국내 6개 제품) : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4654549" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>바로가기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">6. 본 문서의 이용에 관한 조건 : [</SPAN><A class=con_link href="http://creativecommons.org/licenses/by-nc-nd/2.0/kr/" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>내용보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P></TD></TR></TBODY></TABLE></P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=온라인게임" rel="tag" target="_blank">온라인게임</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=zhido.exe" rel="tag" target="_blank">zhido.exe</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=cao110.dll" rel="tag" target="_blank">cao110.dll</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=cao111.dll" rel="tag" target="_blank">cao111.dll</a> 윈도우7 탐색기 시작 위치 설정 및 메뉴 나타내기 tag:blog.daum.net,2009:virusmyths.6042128 어리버리 2009-10-24T14:53:04Z 2009-10-24T14:53:04Z <TABLE borderColor=#5980ae cellSpacing=0 borderColorDark=#5980ae width=540 align=center borderColorLight=white border=1> <TBODY> <TR> <TD style="FONT-SIZE: 12pt; COLOR: white; FONT-FAMILY: 'Times New Roman'; TEXT-ALIGN: center" width=668 bgColor=#5980ae height=29><B>윈도우7 탐색기 메뉴보이기와 시작위치 설정</B> </TD></TR> <TR> <TD style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: 돋움체" vAlign=top borderColorLight=white align=left width=674 bgColor=white borderColorDark=#8092bb height=247> <P><SPAN style="LINE-HEIGHT: 200%">1. 개요</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;처음 윈도우7을 접하고 불편했던 것이 기존 탐색기 주소표시줄 밑에 나오는</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;전체 메뉴가 보이지 않았던 것과 윈도우XP가 나왔을때 처럼&nbsp;탐색기를 시작했을 때</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;특정 드라이브나 폴더를 여는 방법을 몰라 불편한 적이 있었다. 마찬가지로</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;윈도우7이 출시된 지금 본인은 XP와 윈7을 동시에 사용하고는 있지만 일반 유저들이 </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;윈도우7으로 완전히 갈아타기 위해서는 약간의 적응(?) 시간이 필요할 듯 하다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;아래 글들이 윈도우7을 접하고 당황할지도 모를 초보 유저들에게 도움이 되었으면 좋겠다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">2. </SPAN><FONT color=#c5016c><B><SPAN style="LINE-HEIGHT: 200%">탐색기의 모든 메뉴 나타내기</SPAN></B></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;1단계) 탐색기 실행하기 -> [구성] -> [폴더] 및 검색 옵션 클릭</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center"><img src="http://cfile204.uf.daum.net/image/16591A1C4AF53A5174E050" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="413" hspace="1" width="413" vspace="1" border="0" /></P> <P style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P align=center></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;2단계) 폴더 옵션 창 실행 후 [보기] -> '</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">메뉴 항상 표시</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%">'에 체크</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center"><img src="http://cfile233.uf.daum.net/image/173DB61A4AF53A5E27CD18" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="458" hspace="1" width="458" vspace="1" border="0" /></P> <P style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P align=center></P> <P align=left><SPAN style="LINE-HEIGHT: 200%">&nbsp;3단계) 이제 항상 보였던&nbsp;모든 메뉴가 나왔다.</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center"><img src="http://cfile234.uf.daum.net/image/1847001D4AF53A6C4D9A75" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="540" hspace="1" width="540" vspace="1" border="0" /></P> <P style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P align=left></P> <P><SPAN style="LINE-HEIGHT: 200%">3. </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">탐색기를 실행할 때 특정 드라이브로 열기 (실행 시 시작 위치 지정)</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;윈도우XP와 동일하다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;1단계) 작업표시줄의 탐색기 클릭 후, (속성) 클릭</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P style="TEXT-ALIGN: center"><img src="http://cfile214.uf.daum.net/image/115CB51B4AF53A8C015FD4" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="381" hspace="1" width="381" vspace="1" border="0" /></P> <P style="TEXT-ALIGN: center"><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></P> <P align=center></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;2단계) 아래 대상 부분에 %Windir%\explorer.exe 뒤에 한칸을 띄운듸 아래 옵션을 추가한다.</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;추가할 옵션 : </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">/n,/e,c:\</SPAN></FONT><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></FONT></P> <P style="TEXT-ALIGN: center"><img src="http://cfile223.uf.daum.net/image/1246431A4AF53A9B2E03EE" class="tx-daum-image" style="CLEAR: none; FLOAT: none" actualwidth="435" hspace="1" width="435" vspace="1" border="0" /><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">&nbsp;</SPAN></FONT></P> <P align=center></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;</P> <P><SPAN style="LINE-HEIGHT: 200%">4. 윈도우7 관련 설정 팁</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 윈도우7, 빠른 실행 메뉴 사용하기 :&nbsp;[<A href="http://blog.daum.net/virusmyths/6042132" target=_blank><U><FONT color=#0000ff>보기</FONT></U></A>]</P></SPAN> <P><SPAN style="LINE-HEIGHT: 200%">5. 본 문서의 이용에 관한 조건 : [</SPAN><A class=con_link href="http://creativecommons.org/licenses/by-nc-nd/2.0/kr/" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P></SPAN></TD></TR></TBODY></TABLE> <P>&nbsp;</P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=탐색기" rel="tag" target="_blank">탐색기</a>,&nbsp;<a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=윈도우7" rel="tag" target="_blank">윈도우7</a> restorer64_a.exe 와 Backdoor.Win32.HareBot.rl 정보 tag:blog.daum.net,2009:virusmyths.6042127 어리버리 2009-10-24T14:52:57Z 2009-10-24T14:52:57Z <P> <TABLE borderColor=#5980ae cellSpacing=0 borderColorDark=#5980ae width=540 align=center borderColorLight=white border=1> <TBODY> <TR> <TD style="FONT-SIZE: 12pt; COLOR: white; FONT-FAMILY: 'Times New Roman'; TEXT-ALIGN: center" width=668 bgColor=#5980ae height=29> <P><B>Backdoor.Win32.HareBot.rl</B></P></TD></TR> <TR> <TD style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: 돋움체" vAlign=top borderColorLight=white align=left width=674 bgColor=white borderColorDark=#8092bb height=247> <P><SPAN style="LINE-HEIGHT: 200%">1. 요약 : 윈도우 기반의 [<A href="http://blog.daum.net/virusmyths/4750273" target=_blank><U><FONT color=#0000ff>백도어</FONT></U></A>] </SPAN><SPAN style="LINE-HEIGHT: 200%">[</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385693" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>트로이목마</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 코드명 : </SPAN><SPAN style="LINE-HEIGHT: 200%">Backdoor.Win32.HareBot.rl </SPAN><SPAN style="LINE-HEIGHT: 200%">(</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385594" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>명명</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%"> : <A href="http://www.kaspersky.co.kr/" target=_blank><U><FONT color=#0000ff>Kaspersky</FONT></U></A></SPAN><SPAN style="LINE-HEIGHT: 200%">, 2009-10-22, GMT+1)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 다른 이름 : 알려지지 않음</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 크기 : 26,988 바이트 (MD5 : 2945fcfdfaba14e7b1b062fcab846131)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 감염 경로 : 자체 전파 기능은 없으며, 정확한 경로는 알려지지 않았다.</SPAN> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- </SPAN><SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/4896495" target=_blank><U><FONT color=#0000ff>포트</FONT></U></A>]</SPAN><SPAN style="LINE-HEIGHT: 200%">&nbsp;: 25(TCP), 80(TCP)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">2. 생성 파일 (%시스템% 란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385610" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>클릭</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN> </P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- %시스템% 폴더 아래 : </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">restorer64_a.exe </SPAN></FONT><FONT color=black><SPAN style="LINE-HEIGHT: 200%">(27,136 바이트)</SPAN></FONT></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- </SPAN><SPAN style="LINE-HEIGHT: 200%">%UserProfile% 폴더 아래 : </SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">restorer64_a.exe</SPAN></FONT> <P><SPAN style="LINE-HEIGHT: 200%">3. 주요 증상 : [<A href="http://blog.daum.net/virusmyths/4750273" target=_blank><U><FONT color=#0000ff>백도어</FONT></U></A>] 생성 후 악의적 명령 수행</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 스팸 메일 발송, 특정 주소로 연결 시도</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">4. 레지스트리 추가/변경 (HKLM 이란? : </SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4385619" target=_blank><U><FONT color=#0000ff><SPAN style="LINE-HEIGHT: 200%">클릭</SPAN></FONT></U></A><SPAN style="LINE-HEIGHT: 200%">)</SPAN><SPAN style="LINE-HEIGHT: 200%"> </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKLM -> SOFTWARE -> Microsoft -> Windows -> CurrentVersion -> Run</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">restorer64_a</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> = %시스템%restorer64_a.exe</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKCU -> Software -> Microsoft -> Windows -> CurrentVersion -> Run</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;&nbsp;&nbsp;</SPAN><FONT color=#c5016c><SPAN style="LINE-HEIGHT: 200%">restorer64_a</SPAN></FONT><SPAN style="LINE-HEIGHT: 200%"> = %UserProfile%\restorer64_a.exe </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- HKCU -> Software -> Microsoft, OSVersion = 4001679 </SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">5. 진단/치료 (일부 <FONT color=#c5016c>통하기</FONT> 공개)</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 열려진 포트의 위험성과 포트 점검 요령 : [</SPAN><A href="http://blog.daum.net/virusmyths/4896495" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 자주 감염되는 악성코드 전용 제거/치료 도구 (80 종류) : [<A href="http://blog.daum.net/virusmyths/4818101" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인/오프라인 악성코드 검사/치료 도구 모음 : </SPAN><SPAN style="LINE-HEIGHT: 200%">[<A href="http://blog.daum.net/virusmyths/4818109" target=_blank><U><FONT color=#0000ff>다운로드</FONT></U></A>]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">&nbsp;- 무료 온라인 검사 도구 모음 (국내 6개 제품) : [</SPAN><A class=con_link href="http://blog.daum.net/virusmyths/4654549" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>바로가기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P> <P><SPAN style="LINE-HEIGHT: 200%">6. 본 문서의 이용에 관한 조건 : [</SPAN><A class=con_link href="http://creativecommons.org/licenses/by-nc-nd/2.0/kr/" target=_blank><SPAN style="LINE-HEIGHT: 200%"><U><FONT color=#0000ff>내용보기</FONT></U></SPAN></A><SPAN style="LINE-HEIGHT: 200%">]</SPAN></P></TD></TR></TBODY></TABLE></P><br><br>tag : <a href="/_blog/tagArticleList.do?BLOGID=0HKjx&amp;tagName=restorer64_a.exe" rel="tag" target="_blank">restorer64_a.exe</a>