 | VL-╧εΦ±Ω |
 |
| ╨σµΦ∞√ ∩≡εc∞ε≥≡α |
|
|
|
| ┬Φ≡≤±φ√Θ ΩαδσφΣα≡ⁿ - 15, ╚■φⁿ |
┬φΦ∞αφΦσ!
└Ω≥ΦΓφ√⌡ ΓΦ≡≤±εΓ: 21
|
|
1.
|
MtE, ±σ∞σΘ±≥Γε
├σφσ≡α≥ε≡√ ∩εδΦ∞ε≡⌠ΦΩ-ΓΦ≡≤±εΓ (ΓΦ≡≤±√ φα Φ⌡ ε±φεΓσ)
MtE (MuTation Engine) Γδ σ≥± ∩σ≡Γ√∞ ΦτΓσ±≥φ√∞ ∩εδΦ∞ε≡⌠ΦΩ-πσφσ≡α≥ε≡ε∞.
┬√∩≤∙σφ Γ 1991 πεΣ≤ Φ ∩ε ≥σ∞ Γ≡σ∞σφα∞ Γδ δ± φαΦßεδσσ ±δεµφ√∞
∩εδΦ∞ε≡⌠ΦΩ-ΓΦ≡≤±ε∞. ┬ ≡στ≤δⁿ≥α≥σ ≡αßε≥√ ∩εδΦ∞ε≡⌠ΦΩ-αδπε≡Φ≥∞α
Γ ≡α±°Φ⌠≡εΓ∙ΦΩσ ΓΦ≡≤±α ∞επ≤≥ Γ±≥≡σ≥Φ≥ⁿ± ε∩σ≡α÷ΦΦ SUB, ADD, XOR, ROR, ROL Γ
∩≡εΦτΓεδⁿφε∞...
|
|
|
2.
|
Kot
╟απ≡≤τε≈φ√σ ΓΦ≡≤±√
╬∩α±φ√Θ ≡στΦΣσφ≥φ√Θ ταπ≡≤τε≈φ√Θ ΓΦ≡≤±. ╧σ≡σ⌡Γα≥√Γασ≥ INT 13h Φ τα∩Φ±√Γασ≥±
Γ BOOT ±σΩ≥ε≡α ΣΦ±Ωσ≥ Φ MBR ±σΩ≥ε≡ µσ±≥Ωεπε ΣΦ±Ωα ∩≡Φ εß≡α∙σφΦΦ Ω φΦ∞. 15
≈Φ±δα δ■ßεπε ∞σ± ÷α ΓΦ≡≤± ßδεΩΦ≡≤σ≥ ταπ≡≤τΩ≤ Ωε∞∩ⁿ■≥σ≡α. ╤εΣσ≡µΦ≥ ≥σΩ±≥εΓ≤■...
|
|
|
3.
|
Macro.Excel.Emperor
╠αΩ≡ε-ΓΦ≡≤±√ (MS-Word, Excel, Access, PowerPoint, AmiPro Φ Visio)
╟α≡αµα■≥ ²δσΩ≥≡εφφ√σ ≥αßδΦ÷√ Excel (XLS-⌠αΘδ√). ╤ε±≥ε ≥ Φτ εΣφεπε ∞αΩ≡ε±α
(∞εΣ≤δ ) ± Φ∞σφσ∞ Emperor<≈Φ±δε>, Ωε≥ε≡√Θ ±εΣσ≡µΦ≥ ∩ ≥ⁿ ⌠≤φΩ÷ΦΘ:
"Emperor.a": Auto_Open, keyplus, check_file, write_virus, run_virus.
"Emperor.b": Auto_Close, CheckFile, WriteVirus, ScreenTool,...
|
|
|
4.
|
Macro.Excel.Uedasun
╠αΩ≡ε-ΓΦ≡≤±√ (MS-Word, Excel, Access, PowerPoint, AmiPro Φ Visio)
╟α≡αµασ≥ ≥αßδΦ÷√ Excel. ╤εΣσ≡µΦ≥ Γε±σ∞ⁿ ∩≡ε÷σΣ≤≡ Γ ∞εΣ≤δσ "A-TDK": Save,
auto_open, scan, Status, DO_EVERYTHING, DO_SOMETHING, nexts, check.
╟α≡αµσφΦσ ≥αßδΦ÷ ∩≡εΦ±⌡εΣΦ≥ ∩≡Φ ε≥Ω≡√≥ΦΦ τα≡αµσφφεΘ ≥αßδΦ÷√ ΦδΦ
αΩ≥ΦΓΦ≡εΓαφΦΦ δ■ßεπε Φτ δΦ±≥εΓ ΩφΦπ. ┬Φ≡≤± ±ετΣασ≥ τα≡αµσφφ≤■ ΩφΦπ≤ Γ
Ωα≥αδεπσ...
|
|
|
6.
|
Macro.Word.Zero
╠αΩ≡ε-ΓΦ≡≤±√ (MS-Word, Excel, Access, PowerPoint, AmiPro Φ Visio)
╟α°Φ⌠≡εΓαφ, ≡αßε≥ασ≥ ≥εδⁿΩε ∩εΣ φσ∞σ÷ΩεΘ Γσ≡±ΦσΘ Word. ╤εΣσ≡µΦ≥ 9 ∞αΩ≡ε±εΓ:
dateischlie#en, dokumentschlie#en, dok, dsu, wrd, extrasmakro,
dateispeichern, dateidokvorlagen, dateispeichernunter
┬ Φ■φσ Γ√ΓεΣΦ≥ MessageBox ± ≥σΩ±≥ε∞:
Lisa, ich liebe...
|
|
|
7.
|
Macro.Word97.AutoDestructor
╠αΩ≡ε-ΓΦ≡≤±√ (MS-Word, Excel, Access, PowerPoint, AmiPro Φ Visio)
╤εΣσ≡µΦ≥ ±σ∞ⁿ ∞αΩ≡ε±εΓ Γ ∞εΣ≤δσ "AutoDestructor98": AutoExec, AutoOpen,
CpteAReb, FileSaveAs, FileTemplates, ToolsMacro, ViewVBCode. ╟α≡αµσφΦσ
πδεßαδⁿφεΘ εßδα±≥Φ ∞αΩ≡ε±εΓ ∩≡εΦ±⌡εΣΦ≥ ∩≡Φ ε≥Ω≡√≥ΦΦ ΣεΩ≤∞σφ≥α, Σ≡≤πΦσ
ΣεΩ≤∞σφ≥√ τα≡αµα■≥± ∩≡Φ Φ⌡ ±ε⌡≡αφσφΦΦ ± Σ≡≤πΦ∞ Φ∞σφσ∞.
╤≡ατ≤ ∩ε±δσ...
|
|
|
8.
|
Macro.Word97.Calendar
╠αΩ≡ε-ΓΦ≡≤±√ (MS-Word, Excel, Access, PowerPoint, AmiPro Φ Visio)
╤εΣσ≡µΦ≥ 7 ∞αΩ≡ε±εΓ: AutoOpen, AutoClose, ToolsMacro, FileSaveAs, FileTemplates, Calendar, ViewVBCode.
╧≡Φ ε≥Ω≡√≥ΦΦ ⌠αΘδα Γ√Ωδ■≈ασ≥ ε∩÷Φ■ VirusProtection, τα≡αµσφΦσ ∩≡εΦ±⌡εΣΦ≥
∩≡Φ ε≥Ω≡√≥ΦΦ, ταΩ≡√≥ΦΦ Φ ±ε⌡≡αφσφΦΦ ± Σ≡≤πΦ∞ Φ∞σφσ∞ ΣεΩ≤∞σφ≥εΓ (AutoOpen,
FileClose, FileSaveAs).
╧≡Φ Γ√τεΓσ ∞σφ■...
|
|
|
9.
|
Macro.Word97.Satan
╠αΩ≡ε-ΓΦ≡≤±√ (MS-Word, Excel, Access, PowerPoint, AmiPro Φ Visio)
CεΣσ≡µΦ≥ 14 ∞αΩ≡ε±εΓ Γ ∞εΣ≤δσ "Satan666": Satan666, FileOpen, FileClose,
FileSaveAs, FileSave, FileNew, AutoExec, AutoNew, AutoSave, AutoClose,
AutoOpen, ToolsOptions, ViewVBCode, ToolsMacro. ╟α≡αµσφΦσ ±Φ±≥σ∞√ Φ ΣεΩ≤∞σφ≥εΓ ∩≡εΦ±⌡εΣΦ≥ ∩≡Φ τα∩≤±Ωσ δ■ßεπε Φτ ∞αΩ≡ε±εΓ.
╧≡ε±∞ε≥≡ ΩεΣα ΓΦ≡≤±α...
|
|
|
10.
|
WinScript.Rabbit
╤Ω≡Φ∩≥-ΓΦ≡≤±√ (ΓΦ≡≤±√ φα Ωε∞αφΣφ√⌡ τ√Ωα⌡)
╤σ∞σΘ±≥Γε ΓΦ≡≤±εΓ, φα∩Φ±αφφ√⌡ φα Ωε∞αφΣφε∞ τ√Ωσ Windows. ▀Γδ ■≥± ∩σ≡Γ√∞Φ
ΦτΓσ±≥φ√∞Φ ΓΦ≡≤±α∞Φ ²≥επε Ωδα±±α, εßφα≡≤µσφ√ Γ εΩ≥ ß≡σ 1998. ─ε±≥α≥ε≈φε
∩≡Φ∞Φ≥ΦΓφ√ Φ ±εΣσ≡µα≥ εΩεδε 10 Ωε∞αφΣ φα Visual Basic. ╧≡Φ αΩ≥ΦΓΦτα÷ΦΦ Φ∙≤≥
Σ≡≤πΦσ ±Ω≡Φ∩≥-⌠αΘδ√ Γ ≥σΩ≤∙σ∞ Ωα≥αδεπσ Φ τα∩Φ±√Γα■≥± Γ∞σ±≥ε...
|
|
|
11.
|
3tunes.1784
╘αΘδεΓ√σ ΓΦ≡≤±√, DOS
═σε∩α±φ√Θ ≡στΦΣσφ≥φ√Θ ∩εδΦ∞ε≡⌠ΦΩ
-ΓΦ≡≤±. ╧σ≡σ⌡Γα≥√Γασ≥ INT 21h Φ
τα∩Φ±√Γασ≥± Γ Ωεφσ÷ COM- Φ EXE-⌠αΘδεΓ ∩≡Φ Φ⌡ τα∩≤±Ωσ ΦδΦ ε≥Ω≡√≥ΦΦ. ┬ Φ■φσ
∩σ≡σ⌡Γα≥√Γασ≥ INT 1Ch Φ ∩≡εΦπ≡√Γασ≥ ≥≡Φ...
|
|
|
12.
|
Arcv, ±σ∞σΘ±≥Γε
╘αΘδεΓ√σ ΓΦ≡≤±√, DOS
═σε∩α±φ√σ ΓΦ≡≤±√, φσΩε≥ε≡√σ Φτ φΦ⌡ τα°Φ⌠≡εΓαφφ√. ╚∙≤≥ COM- Φ EXE-⌠αΘδ√ Φ
τα∩Φ±√Γασ≥± Γ Φ⌡ Ωεφσ÷. ═σΩε≥ε≡√σ ∩≡σΣ±≥αΓΦ≥σδΦ ±σ∞σΘ±≥Γα Φ±∩εδⁿτ≤■≥ ∩εδΦ∞ε≡⌠ΦΩ
-αδπε≡Φ≥∞√. ╤εΣσ≡µα≥ ≥σΩ±≥εΓ√σ ±≥≡εΩΦ:
"Arcv.335": [ARCV-6] Apache *.com
"Arcv.839": [ARCV-5] Apache Warrior, ARCV....
|
|
|
13.
|
Aref family
╘αΘδεΓ√σ ΓΦ≡≤±√, DOS
╨στΦΣσφ≥φ√σ ΓΦ≡≤±√, ∩σ≡σ⌡Γα≥√Γα■≥ INT 21h Φ τα∩Φ±√Γα■≥± Γ Ωεφσ÷
τα∩≤±Ωασ∞√⌡ ⌠αΘδεΓ. "Aref.533,670" τα≡αµα■≥ ≥εδⁿΩε COM-⌠αΘδ√, "Aref.890"
τα≡αµασ≥ COM Φ EXE.
"Aref.533" ±εΣσ≡µΦ≥ Γ ±Γεσ∞ ΩεΣσ ∩≡ε÷σΣ≤≡≤ τα≡αµσφΦ EXE-⌠αΘδεΓ, εΣφαΩε ²≥α
∩≡ε÷σΣ≤≡α φΦΩεπΣα φσ Γ√τ√Γασ≥± Φ ßεδσσ ≥επε - ≈α±≥Φ≈φε...
|
|
|
14.
|
Detic.1514
╘αΘδεΓ√σ ΓΦ≡≤±√, DOS
═σε∩α±φ√Θ ≡στΦΣσφ≥φ√Θ τα°Φ⌠≡εΓαφφ√Θ ΓΦ≡≤±. ╧σ≡σ⌡Γα≥√Γασ≥ INT 21h Φ τα∩Φ±√Γασ≥± Γ Ωεφσ÷ .COM- Φ .EXE-⌠αΘδεΓ ∩≡Φ Φ⌡ τα∩≤±Ωσ, ∩σ≡σΦ∞σφεΓαφΦΦ
ΦδΦ ε≥Ω≡√≥ΦΦ. ╧ε±δσ ≤±∩σ°φεπε τα≡αµσφΦ ±ετΣασ≥ Ωα≥αδεπ C:\(_FREE_D.) Φ ∩√≥ασ≥± (ßστ≤±∩σ°φε) ≤±≥αφεΓΦ≥ⁿ ±Φ±≥σ∞φ≤■ Σα≥≤ Γ 1977,∞α≡≥,23.
╤ 13-πε Σε 15-πε...
|
|
|
15.
|
Galeocerdo.600
╘αΘδεΓ√σ ΓΦ≡≤±√, DOS
═σε∩α±φ√Θ φσ≡στΦΣσφ≥φ√Θ ΓΦ≡≤±. ╧≡Φ τα∩≤±Ωσ Φ∙σ≥ .COM- Φ .EXE-⌠αΘδ√ Φ∞σ■∙Φσ COM-⌠ε≡∞α≥ Φ τα∩Φ±√Γασ≥± Γ Φ⌡ Ωεφσ÷. ╙ΓσδΦ≈ΦΓασ≥ φα 100 δσ≥ ±Φ±≥σ∞φ≤■ Σα≥≤, ∩ε ≈σ≥Γσ≡πα∞ ∩ε≡≥Φ≥ Σαφφ√σ BIOS. ╤εΣσ≡µΦ≥ ±≥≡εΩ≤:
Victim of Galeocerdo...
|
|
|
|