Analysé par: Jeanne Jocson   

 

Worm:MSIL/Cribz.A (Microsoft); W32.Kribz (Symantec); Troj/Cribz-A (Sophos);

 Plate-forme:

Windows

 Overall Risk:
 Dommages potentiels: :
 Distribution potentielle: :
 reportedInfection:
 Information Exposure Rating::
Faible
Medium
Élevé
Critique

  • Type de grayware:
    Worm

  • Destructif:
    Non

  • Chiffrement:
    Oui

  • In the wild::
    Oui

  Overview

Voie d'infection: Aus dem Internet heruntergeladen, Fallen gelassen von anderer Malware, Verbreitet sich per E-Mail

Ändert bestimmte Registrierungseinträge, um Funktionen des Security Centers zu deaktivieren. Dadurch kann diese Malware ihre Routinen unentdeckt ausführen. Umgeht die Windows Firewall. Dadurch kann diese Malware ihre geplante Routine ausführen, ohne von einer installierten Firewall entdeckt zu werden. Erstellt bestimmte Registrierungseinträge, um Sicherheitsanwendungen zu deaktivieren.

Sammelt Empfänger-E-Mail-Adressen aus zwischengespeicherten E-Mails, Adressbüchern und Postfächern.

Ändert Zoneneinstellungen von Internet Explorer. Setzt die Sicherheitseinstellungen von Internet Explorer herab.

  Détails techniques

File size: 2,251,808 bytes
File type: EXE
Memory resident: Oui
Date de réception des premiers échantillons: 11 février 2015
Charge malveillante: Steals information, Modifies system registry

Installation

Schleust die folgenden Eigenkopien in das betroffene System ein und führt sie aus:

  • %User Temp%\{random filename}.exe
  • %System%\{random filename}.exe

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000, XP und Server 2003.. %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows XP und Server 2003.)

Schleust die folgenden Dateien ein und führt sie aus:

  • %User Temp%\{random}.reg ← used to add registry entires; deleted afterwards

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000, XP und Server 2003.)

Autostart-Technik

Fügt folgende Registrierungseinträge hinzu, um bei jedem Systemstart automatisch ausgeführt zu werden.

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunOnce
{random filename} = {random filename}"User Temp%\{random filename}.exe -w"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
{random filename} = "User Temp%\{random filename}.exe -w"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random filename} = "{random filename}.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
{random filename} = "{random filename}.exe"

Andere Systemänderungen

Fügt die folgenden Registrierungseinträge als Teil der Installationsroutine hinzu:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time
ImagePath = "%SystemRoot%\System32\svchost.exe -k netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time
Objectname = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time
Type = "20"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
LastClockRate = "18730"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
MinClockRate = "18636"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
MaxClockRate = "1882a"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
FrequencyCorrectRate = "4"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
PollAdjustFactor = "5"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
LargePhaseOffset = "138800"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
SpikeWatchPeriod = "5a"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
HoldPeriod = "5"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
MaxPollInterval = "f"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
LocalClockDispersion = "a"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
EventLogFlags = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
PhaseCorrectRate = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
MinPollInterval = "a"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
UpdateInterval = "57e40"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
MaxNegPhaseCorrection = "d2f0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
MaxPosPhaseCorrection = "d2f0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
AnnounceFlags = "a"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Config
MaxAllowedPhaseOffset = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Parameters
ServiceMain = "SvchostEntry_W32Time"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Parameters
ServiceDll = "%SystemRoot%\System32\w32time.dll"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Parameters
NtpServer = "time.windows.com,0x1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Parameters
Type = "NTP"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpClient
Enabled = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpClient
InputProvider = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpClient
AllowNonstandardModeCombinations = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpClient
CrossSiteSyncFlags = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpClient
ResolvePeerBackoffMinutes = "f"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpClient
ResolvePeerBackoffMaxTimes = "7"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpClient
CompatibilityFlags = "80000000"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpClient
EventLogFlags = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpClient
DllName = "%SystemRoot%\System32\w32time.dll"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpClient
SpecialPollTimeRemaining = "time.windows.com,{value}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpClient
SpecialPollInterval = "{value}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpServer
Enabled = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpServer
InputProvider = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpServer
AllowNonstandardModeCombinations = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\TimeProviders\
NtpServer
DllName = "%SystemRoot%\System32\w32time.dll"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\W32Time\Enum
0 = "Root\LEGACY_W32TIME\0000"

Fügt die folgenden Registrierungseinträge als Teil der Installationsroutine hinzu:

HKEY_CURRENT_USER\Software\Microsoft\
Office\10.0\Access\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\10.0\Excel\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\10.0\Outlook\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\10.0\Outlook\
Security
Level1Remove = ".bat;.com;.exe;.js;.jse;.reg;.vbe;.vbs"

HKEY_CURRENT_USER\Software\Microsoft\
Office\10.0\PowerPoint\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\10.0\Word\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\11.0\Access\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\11.0\Excel\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\11.0\Outlook\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\11.0\Outlook\
Security
Level1Remove = ".bat;.com;.exe;.js;.jse;.reg;.vbe;.vbs"

HKEY_CURRENT_USER\Software\Microsoft\
Office\11.0\PowerPoint\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\11.0\Word\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\12.0\Access\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\12.0\Excel\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\12.0\Outlook\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\12.0\Outlook\
Security
Level1Remove = ".bat;.com;.exe;.js;.jse;.reg;.vbe;.vbs"

HKEY_CURRENT_USER\Software\Microsoft\
Office\12.0\PowerPoint\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Office\12.0\Word\
Security
Level = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
DisallowRun = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
.NETFramework\Windows Presentation Foundation\Hosting
RunUnrestricted = "1"

Ändert die folgenden Registrierungseinträge:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
LocalAccountTokenFilterPolicy = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
HideSCAHealth = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Lsa
ForceGuest = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Session Manager\Memory Management
ClearPageFileAtShutdown = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = "4"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\CryptSvc
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\HTTPFilter
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ose
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WebClient
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\winmgmt
Start = "2"

Ändert die folgenden Registrierungseinträge, um Funktionen des Security Centers zu deaktivieren:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AllAlertsDisabled = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirstRunDisabled = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "0"

Ändert die folgenden Registrierungseinträge, um die Einstellungen der Windows Firewall zu deaktivieren:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DisableNotifications = "1"

(Note: The default value data of the said registry entry is {user-defined}.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DoNotAllowExceptions = "0"

(Note: The default value data of the said registry entry is {user-defined}.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = "1"

(Note: The default value data of the said registry entry is {user-defined}.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

(Note: The default value data of the said registry entry is {user-defined}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\WindowsFirewall\DomainProfile
DisableNotifications = "1"

(Note: The default value data of the said registry entry is {user-defined}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\WindowsFirewall\DomainProfile
DoNotAllowExceptions = "0"

(Note: The default value data of the said registry entry is {user-defined}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\WindowsFirewall\StandardProfile
DisableNotifications = "1"

(Note: The default value data of the said registry entry is {user-defined}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\WindowsFirewall\StandardProfile
DoNotAllowExceptions = "0"

(Note: The default value data of the said registry entry is {user-defined}.)

Erstellt den oder die folgenden Registrierungseinträge, um die Windows Firewall zu umgehen:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
%System%\{random filename}.exe = "%System%\{random filename}.exe:*:Enabled:{random filename}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\{random filename}.exe = "%System%\{random filename}.exe:*:Enabled:{random filename}"

Erstellt die folgenden Registrierungseinträge, um Sicherheitsanwendungen zu deaktivieren:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\DisallowRun
1 = "avgnt.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\DisallowRun
2 = "avguard.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\DisallowRun
3 = "avshadow.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\DisallowRun
4 = "AVWEBGRD.EXE"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\DisallowRun
5 = "sched.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\DisallowRun
6 = "AvastSvc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\DisallowRun
7 = "AvastUI.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\DisallowRun
8 = "afwServ.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\AhnlabAntiVirus
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\ComputerAssociatesAntiVirus
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\KasperskyAntiVirus
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\McAfeeAntiVirus
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\McAfeeFirewall
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\PandaAntiVirus
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\PandaFirewall
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\SophosAntiVirus
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\SymantecAntiVirus
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\SymantecFirewall
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\TinyFirewall
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\TrendAntiVirus
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\TrendFirewall
DisableMonitoring = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\ZoneLabsFirewall
DisableMonitoring = "1"

Verbreitung

Sammelt Empfänger-E-Mail-Adressen aus zwischengespeicherten E-Mails, Adressbüchern und Postfächern.

Sammelt Empfänger-E-Mail-Adressen mit den folgenden Erweiterungen:

  • .accdb
  • .accde
  • .asp
  • .aspx
  • .avi
  • .bat
  • .bmp
  • .cab
  • .cer
  • .chm
  • .com
  • .config
  • .csv
  • .ctt
  • .dat
  • .dbx
  • .der
  • .doc
  • .docx
  • .dwg
  • .dxf
  • .eml
  • .eps
  • .exe
  • .gif
  • .hlp
  • .htm
  • .html
  • .ico
  • .inf
  • .ini
  • .iso
  • .jpg
  • .key
  • .log
  • .manifest
  • .mdb
  • .msg
  • .msi
  • .oeaccount
  • .pdf
  • .pfx
  • .png
  • .ppt
  • .pptx
  • .pps
  • .pst
  • .rar
  • .rdp
  • .rtf
  • .sln
  • .sql
  • .tif
  • .txt
  • .vbe
  • .vbproj
  • .vbs
  • .vcf
  • .vcproj
  • .vhd
  • .vmcx
  • .wab
  • .wks
  • .wmf
  • .wpd
  • .wri
  • .xls
  • .xlsx
  • .xml
  • .zip
  • .zipx

Änderung der Startseite von Webbrowser und Suchseite

Ändert Zoneneinstellungen von Internet Explorer.

Setzt die Sicherheitseinstellungen von Internet Explorer herab.

Datendiebstahl

Folgende Daten werden gesammelt:

  • Processor ID
  • HardDrive Signature
  • OS Name
  • OS Serial Number
  • OS Boot-up Time
  • MAC Addresss
  • Mother Board Serial Number

  Solutions

Moteur de scan minimum: 9.800
First VSAPI Pattern File: 11.470.04
First VSAPI Pattern Release Date: 10 février 2015
VSAPI OPR Pattern Version: 11.471.00
VSAPI OPR Pattern Release Date: 11 février 2015

Step 1

Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.

Step 3

Im abgesicherten Modus neu starten

[ learnMore ]

Step 4

Diesen Registrierungsschlüssel löschen

[ learnMore ]

Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.

  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • W32Time

Step 5

Diesen Registrierungswert löschen

[ learnMore ]

Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.

  • In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
    • {random filename} = {random filename}"User Temp%\{random filename}.exe -w"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
    • {random filename} = "User Temp%\{random filename}.exe -w"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • {random filename} = "{random filename}.exe"
  • In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    • {random filename} = "{random filename}.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Access\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Excel\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Security
    • Level1Remove = ".bat;.com;.exe;.js;.jse;.reg;.vbe;.vbs"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\PowerPoint\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Access\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Security
    • Level1Remove = ".bat;.com;.exe;.js;.jse;.reg;.vbe;.vbs"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\PowerPoint\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Access\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Excel\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security
    • Level1Remove = ".bat;.com;.exe;.js;.jse;.reg;.vbe;.vbs"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\PowerPoint\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Security
    • Level = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    • DisallowRun = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Windows Presentation Foundation\Hosting
    • RunUnrestricted = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AllAlertsDisabled = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AntiVirusDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AntiVirusOverride = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • FirewallDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • FirstRunDisabled = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • FirewallOverride = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • UacDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • UpdatesDisableNotify = "0"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List
    • %System%\{random filename}.exe = "%System%\{random filename}.exe:*:Enabled:{random filename}"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • %System%\{random filename}.exe = "%System%\{random filename}.exe:*:Enabled:{random filename}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
    • 1 = "avgnt.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
    • 2 = "avguard.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
    • 3 = "avshadow.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
    • 4 = "AVWEBGRD.EXE"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
    • 5 = "sched.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
    • 6 = "AvastSvc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
    • 7 = "AvastUI.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
    • 8 = "afwServ.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall
    • DisableMonitoring = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall
    • DisableMonitoring = "1"

Step 6

Diese Datei suchen und löschen

[ learnMore ]
Möglicherweise sind einige Komponentendateien verborgen. Aktivieren Sie unbedingt das Kontrollkästchen Versteckte Elemente durchsuchen unter Weitere erweiterte Optionen, um alle verborgenen Dateien und Ordner in den Suchergebnissen zu berücksichtigen.  
  • %User Temp%\{random}.reg

Step 7

Diesen geänderten Registrierungswert wiederherstellen

[ learnMore ]

Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.

  • In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
    • From: EnableLUA = "0"
      To: EnableLUA = "1"
  • In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
    • From: LocalAccountTokenFilterPolicy = "1"
      To: LocalAccountTokenFilterPolicy = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
    • From: HideSCAHealth = "1"
      To: HideSCAHealth = "0"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
    • From: ForceGuest = "0"
      To: ForceGuest = "1"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
    • From: ClearPageFileAtShutdown = "1"
      To: ClearPageFileAtShutdown = "0"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
    • From: Start = "4"
      To: Start = {user-define}
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv
    • From: Start = "2"
      To: Start = {user-define}
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc
    • From: Start = "2"
      To: Start = {user-define}
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTPFilter
    • From: Start = "2"
      To: Start = {user-define}
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ose
    • From: Start = "2"
      To: Start = {user-define}
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess
    • From: Start = "2"
      To: Start = {user-define}
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient
    • From: Start = "2"
      To: Start = {user-define}
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winmgmt
    • From: Start = "2"
      To: Start = {user-define}
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
    • From: DisableNotifications = "1"
      To: DisableNotifications = {user-define}
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
    • From: DoNotAllowExceptions = "0"
      To: DoNotAllowExceptions = {user-define}
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • From: DisableNotifications = "1"
      To: DisableNotifications = {user-define}
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • From: DoNotAllowExceptions = "0"
      To: DoNotAllowExceptions = {user-define}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
    • From: DisableNotifications = "1"
      To: DisableNotifications = {user-define}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
    • From: DoNotAllowExceptions = "0"
      To: DoNotAllowExceptions = {user-define}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
    • From: DisableNotifications = "1"
      To: DisableNotifications = {user-define}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
    • From: DoNotAllowExceptions = "0"
      To: DoNotAllowExceptions = {user-define}

Step 8

Führen Sie den Neustart im normalen Modus durch, und durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt nach Dateien, die als WORM_CRIBZ.J entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.


Participez à notre enquête!