доверие по еще некоторым причинам упало
Изображения
Сообщение от :
никого не узнаёшь на этой фотке? гг))
_http://rolef.ru/img/foto18.gif
Сообщение от Stelam:
никого не узнаёшь на этой фотке? гг))
http://rolef.ru/img/foto18.gif
ЕСЛИ ВАМ ПРИХОДИТ ТАКОЕ СООБЩЕНИЕ - НИ В КОЕМ СЛУЧАЕ НЕ ЗАХОДИТЕ ПО ССЫЛКЕ. СИСТЕМА СЛЕТАЕТ, СДЕЛАТЬ НИЧЕГО НЕЛЬЗЯ. НЕСКОЛЬКО ЗНАКОМЫХ УЖЕ ПОСТРАДАЛО. ПРОСТО ИГНОРИРУЙТЕ ЭТО СООБЩЕНИЕ И ПРЕДУПРЕЖДАЙТЕ ОСТАЛЬНЫХ ПОЛЬЗОВАТЕЛЕЙ.
Сообщение от Flaming:
Всё довольно просто, на самом деле там не gif-файл, а *.scr - файл хранителя экрана.
Сообщение от Байт:
И нихера она уже не новая... кстати
Сообщение от :
Name: rolef.ru
IP: 62.109.1.33
Domain: rolef.ru
Querying whois.ripn.ru for rolef.ru...
% By submitting a query to RIPN's Whois Service
% you agree to abide by the following terms of use:
% http://www.ripn.net/about/servpol.html#3.2 (in Russian)
% http://www.ripn.net/about/en/servpol.html#3.2 (in English).
domain: ROLEF.RU
type: CORPORATE
nserver: ns1.firstvds.ru.
nserver: ns2.firstvds.ru.
state: REGISTERED, DELEGATED
person: Roman L Fertikov
phone: +7 9226918038
e-mail: mailto:[email protected]
registrar: REGTIME-REG-RIPN
created: 2008.11.15
paid-till: 2009.11.15
source: TC-RIPN
Last updated on 2009.09.12 17:06:05 MSK/MSD
Querying whois.arin.net for 62.109.1.33...
OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL
ReferralServer: whois://whois.ripe.net:43
NetRange: 62.0.0.0 - 62.255.255.255
CIDR: 62.0.0.0/8
NetName: RIPE-C3
NetHandle: NET-62-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: NS3.NIC.FR
NameServer: SUNIC.SUNET.SE
NameServer: SNS-PB.ISC.ORG
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: TINNIE.ARIN.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate: 1997-04-25
Updated: 2009-03-25
# ARIN WHOIS database, last updated 2009-09-11 20:00
# Enter ? for additional hints on searching ARIN's WHOIS database.
Querying whois.ripe.net:43 for 62.109.1.33...
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf
% Note: This output has been filtered.
% To receive output for a database update, use the "-B" flag.
% Information related to '62.109.0.0 - 62.109.7.255'
inetnum: 62.109.0.0 - 62.109.7.255
netname: ISPSYSTEM
descr: ISPsystem at MSM
country: RU
admin-c: PAS28-RIPE
tech-c: AB11726-RIPE
status: ASSIGNED PA
mnt-by: ISPSYSTEM-MNT
source: RIPE # Filtered
person: Peter A Svistunov
address: ISPsystem, Raduzhny 34a
address: Irkutsk, 664017, Russian Federation
phone: +7 3952 525789
abuse-mailbox: mailto:[email protected]
nic-hdl: PAS28-RIPE
source: RIPE # Filtered
person: Alexandr Brukhanov
address: PoBox30, 664017, Irkutsk, Russia
phone: +7 495 727 38 79
nic-hdl: AB11726-RIPE
source: RIPE # Filtered
% Information related to '62.109.0.0/21AS29182'
route: 62.109.0.0/21
descr: ISPsystem-RU
origin: AS29182
mnt-by: ISPSYSTEM-MNT
remarks: **************************************
remarks: * For spamming or other abuse issues *
remarks: * please send your requests to *
remarks: * mailto:[email protected] *
remarks: **************************************
source: RIPE # Filtered
% Information related to '62.109.0.0/20AS29182'
route: 62.109.0.0/20
descr: ISPsystem-RU
origin: AS29182
mnt-by: ISPSYSTEM-MNT
remarks: **************************************
remarks: * For spamming or other abuse issues *
remarks: * please send your requests to *
remarks: * mailto:[email protected] *
remarks: **************************************
source: RIPE # Filtered
Сообщение от :
What's been found Severity Level
Capability to steal information such personal financial data (credit card numbers, online banking login details), user profiles, software registration keys, passwords.
Attempts to compromise security settings/rules of security products by emulating mouse clicks on the dialog windows. For example, when a security product pops up a dialog box asking for user permission to block suspicious activity, a threat may click Allow button to enable its malicious payload.
Contains characteristics a trojan that can steals passwords from multiple popular email, ICQ and FTP client applications, such as Mirabilis ICQ, Miranda, Trillian, Microsoft Outlook, CuteFTP, Thunderbird, FileZilla, FlashFXP, The Bat!, etc.
Modifies some system settings that may have negative impact on overall system security state.
Contains characteristics of an identified security risk.
Technical Details:
The new window was created, as shown below:
Possible Security Risk
Attention! The following threat categories were identified:
Threat Category Description
A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
File System Modifications
The following files were created in the system:
# Filename(s) File Size File Hash
1 %Windir%\43.jpg 8,006 bytes MD5: 0xF47FC21D7592AA546AB8C2A33BEF6137
SHA-1: 0x7F0F6FB272243C8E835B410C502732A15ECAAB31
2 %Windir%\exxplorer.exe 24,576 bytes MD5: 0x2C29E5BD09EC1D76CC495310F28BE112
SHA-1: 0x44CC83595C435B4135AFDE2F97E0CA7A2FD0A650
3 %Windir%\svccost.exe 70,144 bytes MD5: 0xF2E7D03C52B390C012F9E91BF6E6D0E9
SHA-1: 0x458BCAB95CF21907D74F497CD8BB99497F0BDE47
4 %System%\154.bat 90 bytes MD5: 0xBCDFFB24E094009252C94D3258C98F02
SHA-1: 0x27BBEA3BDF4A6AB2C8DCCBA9B343E69F986DB2D2
5 [file and pathname of the sample #1] 118,272 bytes MD5: 0x24649E740985C45F3D76CC1E2A7F1259
SHA-1: 0xAAC157D8B29E7883346E25A0A9E36A989F8A1F9E
6 %Windir%\xFoLOOOSErs.txt 25 bytes MD5: 0x268736C2B0448195738018AFF3ED1174
SHA-1: 0x30C2B0424160CDE3F371B3DCB31CB262671A2B64
Notes:
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Memory Modifications
There were new processes created in the system:
Process Name Process Filename Main Module Size
svccost.exe %Windir%\svccost.exe 73,728 bytes
[filename of the sample #1] [file and pathname of the sample #1] 118,784 bytes
exxplorer.exe %Windir%\exxplorer.exe 253,952 bytes
Registry Modifications
The following Registry Keys were created:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Sa feBoot\Network_
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Sa feBoot\Network_\AFD
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Network_
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Network_\AFD
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\system
The newly created Registry Value is:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\system]
DisableTaskMgr = 0x00000001
to prevent users from starting Task Manager (Taskmgr.exe)
The following Registry Value was modified:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Shell =
Other details
Analysis of the file resources indicate the following possible country of origin:
Russian Federation
To mark the presence in the system, the following Mutex objects were created:
FNmzogqWXhHligvECDBZCu
ALLOK
The following Host Names were requested from a host database:
ya.ru
www.ch-mz.ru
There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
%Windir%\svccost.exe
Сообщение от Flaming:
Pharmaci$t, ещё раз повторяю, что может придти от кого угодно.
Сообщение от solid1974:
Pharmaci$t, ты не прав.
Отруби в аське урлу автоматом, что бы по приходу сцылы автоматом не перекидывало на фейк сервак. Вообще мессаги от всех юзеров с сцылкми отруби.
Сообщение от solid1974:
QIP - это ацтой полный
Сообщение от Stelam:
ЕСЛИ ВАМ ПРИХОДИТ ТАКОЕ СООБЩЕНИЕ - НИ В КОЕМ СЛУЧАЕ НЕ ЗАХОДИТЕ ПО ССЫЛКЕ. СИСТЕМА СЛЕТАЕТ, СДЕЛАТЬ НИЧЕГО НЕЛЬЗЯ. НЕСКОЛЬКО ЗНАКОМЫХ УЖЕ ПОСТРАДАЛО. ПРОСТО ИГНОРИРУЙТЕ ЭТО СООБЩЕНИЕ И ПРЕДУПРЕЖДАЙТЕ ОСТАЛЬНЫХ ПОЛЬЗОВАТЕЛЕЙ.
