Fibebol, DDoS, Koredos
Windows 2000, Windows XP, Windows Server 2003
Installation
Schleust die folgenden Dateien ein:
(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows XP und Server 2003.. %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.)
Autostart-Technik
Registriert sich als Systemdienst, damit sie bei jedem Systemstart automatisch ausgeführt wird, indem sie die folgenden Registrierungseinträge hinzufügt:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
m{3 random alphabetic characters}svc = "m{3 random alphabetic characters}svc"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
w{2 random alphabetic characters}csvc = "w{2 random alphabetic characters}csvc"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
s{3 random alphabetic characters}svc = "s{3 random alphabetic characters}svc"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\m{3 random alphabetic characters}svc
Type = "20"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\m{3 random alphabetic characters}svc
Start = "2"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\m{3 random alphabetic characters}svc
ErrorControl = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\m{3 random alphabetic characters}svc
ImagePath = "%System Root%\system32\svchost.exe -k m{3 random alphabetic characters}svc"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\m{3 random alphabetic characters}svc
DisplayName = "Microsoft DNS resolve Service"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\m{3 random alphabetic characters}svc
ObjectName = "LocalSystem"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\m{3 random alphabetic characters}svc
Description = "Provides DNS resolve.If this service is stopped, system cannot be well performed"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\m{3 random alphabetic characters}svc\Parameters
ServiceDll = = "%System Root%\system32\m{3 random alphabetic characters}svc.dll"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\s{3 random alphabetic characters}svc
Type = "20"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\s{3 random alphabetic characters}svc
Start = "2"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\s{3 random alphabetic characters}svc
ErrorControl = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\s{3 random alphabetic characters}svc
ImagePath = "%System Root%\system32\svchost.exe -k s{3 random alphabetic characters}svc"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\s{3 random alphabetic characters}svc
DisplayName = "Removal stoarage Service"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\s{3 random alphabetic characters}svc
ObjectName = "LocalSystem"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\s{3 random alphabetic characters}svc
Description = "Allows Removal storage. If this service is stopped, system cannot be well performed"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\s{3 random alphabetic characters}svc\Parameters
ServiceDll = "%System Root%\system32\s{3 random alphabetic characters}svc.dll"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\w{2 random alphabetic characters}csvc
Type = "20"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\w{2 random alphabetic characters}csvc
Start = "2"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\w{2 random alphabetic characters}csvc
ErrorControl = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\w{2 random alphabetic characters}csvc
ImagePath = = "%System Root%\system32\svchost.exe -k w{2 random alphabetic characters}csvc"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\w{2 random alphabetic characters}csvc
DisplayName = "Windows DNS Security controler Service"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\w{2 random alphabetic characters}csvc
ObjectName = "LocalSystem"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\w{2 random alphabetic characters}csvc
Description = "Transmits DNS Security controler.If this service is stopped, system cannot be well performed"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\w{2 random alphabetic characters}csvc\Parameters
ServiceDll = "%System Root%\system32\w{2 random alphabetic characters}csvc.dll"
Registriert sich als Systemdienst, damit die Ausführung bei jedem Systemstart automatisch erfolgt, indem die folgenden Registrierungsschlüssel hinzufügt werden:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\m{3 random alphabetic characters}svc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\s{3 random alphabetic characters}svc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\w{2 random alphabetic characters}csvc