| Problem description: |
 |
"Kerbot" is a computer worm that spreads:
- through "Peer-to-Peer" networks,
- through the local networks of the infected systems by exploiting the RPC vulnerability in the "Server" service on Microsoft Windows systems, described in the CERT-IST/AV-2008.460 advisory.
"Kerbot" attempts to lower security settings and opens a backdoor on the infected systems.
Note : "Kerbot" is also knowwn as "Kernelbot". |
|
| Technical information: |
|
In addition to the overall behaviour already described, on the compromised computer "Kerbot":
- attempts to end some processes,
- prevents automatic execution of certain programs when Windows starts,
- registers itself as Windows services,
- download and install the eMule P2P client program,
- modify the "hosts" file to prevent access to various domains.
|
|
| Diagnostic: |
|
Here are the visible characteristics of the "Kerbot" worm that allows to detect it on an infected system :
1°) Network traffic :
- Network port(s) opened : NA
- Site(s)/Server(s) contacted :
- [http://]121.10.114.10
- [http://]121.10.114.222
- [http://]freegoogla.vicp.net
- [http://]zz.ushealthmart.com
- [http://]st.ushealthmart.com
- E-mail address(es) contacted : NA
2°) Systems modifications :
- File(s) added :
- %System%\compbatc.sys
- %System%\compbatc.zip
- %System%\compbatc.exe
- %System%\compbatc.dll
- %System%\compbatc.ocx
- %System%\compbatc.ini
- Registry key(s) changed:
- HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\safemon\"UDiskAccess" = "0"
- HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\safemon\"ExecAccess" = "0"
- HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\safemon\"IEProtAccess" = "0"
- HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\safemon\"LeakAccess" = "0"
- HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\safemon\"MonAccess" = "0"
- HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\safemon\"SiteAccess" = "0"
- Registry key(s) added:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\compbatc
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\compbatcDrv
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[8 NUMBERS]
- Registry key(s) deleted:
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"360Safetray"
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"360Safebox"
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"360Antiarp"
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"runeip"
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"Iparmor"
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
|
|
