º» °Ô½Ã¹°¿¡ ´ëÇÑ ¾î¶°ÇÑ Ã¥ÀÓµµÁöÁö ¾Ê½À´Ï´Ù.

www.gjcd.com

No, 41
2004/4/10(Åä)
Á¶È¸: 628
[ÃßõÆÁ]¹ÙÀÌ·¯½ºµîÀ¸·Î °øÀ¯¿¡¼­ IPC$,ADMIN$ ÀÌ »ç¶óÁ³À»¶§  
°¡²û ¹ÙÀÌ·¯½ºµîÀ¸·Î IPC$,ADMIN$µîÀÇ °øÀ¯°¡ »ç¶óÁ®¼­
¼­¹ö°¡ Æ®·£Àè¼ÇÀÌ ±¸¼ºµÇ¾î ÀÖÁö ¾Ê½À´Ï´Ù. ¶ó°í ³ª¿À¸é¼­
°øÀ¯°¡ ¾ÈµÉ°æ¿ì°¡ Àִµ¥ ±×·²¶© ¹Ø¿¡ ¹æ¹ýÀ¸·Î ÇÏ¸é µÈ´Ù³×¿ä! ^^

¹ÙÀÌ·¯½º³ª backdoor, sypware, hackerÅøµî°ú °°Àº °Íµé·Î ÀÎÇØ ½Ã½ºÅÛÀÇ ±âº» admin share
°¡ Á¦°ÅµÇ´Â Çö»óÀÌ ¹ß»ý µÉ ¼ö ÀÖ½À´Ï´Ù.

ÀÌ·¯ÇÑ ¹ÙÀÌ·¯½ºµîÀº admin share¸¦ Á¦°ÅÇÏ°í ¾Æ·¡ ·¹Áö½ºÆ®¸® Å°ÀÇ AutoShareServer, AutoSh
areWks °ªÀ» 0À¸·Î º¯°æ(ÀÌ °ªÀÌ 0À̸é admin share°¡ ¼û±â±â ¼³Á¤µÊ)ÇÏ¿© net¸í·ÉÀ¸·Î º¹±¸ÇÏ
¿©µµ ÀçºÎÆÃµÇ¸é ´Ù½Ã admin share¸¦ ¼û±âµµ·Ï µ¿ÀÛÇÕ´Ï´Ù.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Paramet
ers

ÀÌ¿¡ ¾Æ·¡ ¹æ¹ýÀ¸·Î admin share¸¦ ´Ù½Ã Ç¥½ÃÇϵµ·Ï ¼³Á¤ º¯°æÇϽñ⠹ٶø´Ï´Ù.

[¹æ ¹ý]
1. ½ÃÀÛ - ½ÇÇà¿¡¼­ "regedt32" (" "¾øÀÌ) ÀÔ·ÂÇÏ°í È®ÀÎÇÏ¿© ·¹Áö½ºÆ®¸® ÆíÁý±â¸¦ ½ÇÇàÇÕ´Ï´Ù

2. ¾Æ·¡ Æú´õ¸¦ ¼±ÅÃÇÕ´Ï´Ù.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parame
ters

3. ¿À¸¥ÂÊ È­¸é¿¡¼­ Å° °ª Áß AutoShareServer ¿Í AutoShareWks °ªÀÌ 0À¸·Î µÇ¾î ÀÖ´Ù¸é, ÀÌ °ª
À» 1·Î º¯°æÇϰųª ¶Ç´Â Á¦°ÅÇϽñ⠹ٶø´Ï´Ù.

(¡Ø ±âº»ÀûÀ¸·Î ÀÌ Å° °ªÀº ¾ø´Â °ªÀ¸·Î, AutoShareServer, AutoShareWks¸¦ Á¦°ÅÇÏ¸é ±âº»ÀûÀ¸
·Î admin share°¡ Ç¥½ÃµÇµµ·Ï ¼³Á¤µË´Ï´Ù)

4. ·¹Áö½ºÆ®¸® ÆíÁý±â¸¦ Á¾·áÇÏ°í ÀçºÎÆÃÇÏ¿© È®ÀÎÇÕ´Ï´Ù.

ÀÌ¿Ü¿¡µµ Windows2000 Administrator Åø¿¡ Æ÷ÇÔµÈ Poledit ÅøÀ» ÀÌ¿ëÇÏ¿© º¯°æÇÏ´Â ¹æ¹ýÀÌ ÀÖ½À
´Ï´Ù.
º¸´Ù ÀÚ¼¼ÇÑ °ÍÀº ¾Æ·¡ ¹®¼­¸¦ È®ÀÎÇϽñ⠹ٶø´Ï´Ù.

318755 HOW TO: Restore Administrative Shares That Have Been Deleted
http://support.microsoft.com/?id=318755

¾Æ¿ï·¯, ¾Æ·¡ ¸®½ºÆ®´Â ½ÃÀÛ ÇÁ·Î±×·¥¿¡ µî·ÏµÇ¾î ÀÌ·¯ÇÑ ¹®Á¦¸¦ ÀÏÀ¸Å³ ¼ö ÀÖ´Â spyware¼º ÇÁ·Î
±×·¥µé°ú ¹ÙÀÌ·¯½ºµéÀÔ´Ï´Ù.
Âü°íÇϽñ⠹ٶø´Ï´Ù.

------------------------------------------------
Below is a list of suspect files that have been found on computers affected by this
problem. Many of these overwrite or spoof the names of legitimate files and
services. They often load from the registry subkey
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run:

abc.bat
ADMDLL.DLL
Adobea.exe
adobes.exe
Arial.exe
Arialfont.exe
Close.bat
clt.exe
cmd.exe
CRSS.EXE
CSIFCSVC.EXE
dll32.exe
Dvldr32.exe
expiorer.exe
fd.exe
filter.dll
FireDaemon.exe
Gates.txt
Gg.bat
HCMD.EXE
hidden32.exe
INST.EXE
invoker.exe
iroffer.exe
lps.exe
LSASS.EXE
Mirc.ini
MP Tclockvv.exe
msapp.exe
MSASP.EXE
msexplorer.exe
mskces32
mskernel32.exe
mspass.exe
MSSAVE.EXE
net.exe
netbios.exe
Ocxdll.exe
pckill.exe
psexec.exe
PSEXESVC.EXE
READWRITE.EXE
regedit32.exe
registry.exe
root.bat
screwed.exe
sec32.exe
secure.exe
Servudaemon.ini
SERVUEVENT.DLL
Shares.bat
shell32.exe
SOCK3.EXE
SPAC.TXT
start.bat
svchost32.exe
sys32.exe
Syscfg.exe
Taskmngr.exe
tasp.exe
t-exec.dll
vmn32.exe
whynot.exe
win32.exe
win32load.exe
WINCPU.EXE
windowsupdate.bat
windowsupdate.exe
winmem.exe
Winmgnt.exe
Winshell
winspsv.exe
wmiprvse.exe
xsecure.bat
xsetup.bat
xshare.bat
ZMOKE.EXE

Below are some worms, trojans and backdoors that have been found on computers
affected by this problem:

Backdoor.IRCBot.gen
Backdoor irc.flood.c
Backdoor irc.flood.e
Backdoor irc.flood.f
Backdoor.Dvldr
Backdoor.IRC.Aladinz
Backdoor.irc.flood
Backdoor.IRC.Zcrew
Backdoor.subseven
BackGate Kit Trojan
boncer
Deloder
HIDLE
ILoveYou
MIRC
mirc/shaz.a.worm
Sdbot
servu
Troj/Litmus-108
W32.HLLW.Deloder
W32/Deloder.worm
W32/Deloder-A
W32/Nackbot-A
Worm.Win32.Deloder
WORM_DELODER.A
------------------------------------------------

                   
¹øÈ£Á¦¸ñÀÛ¼ºÀÏÁ¶È¸
43   [ÃßõÆÁ]160±â°¡ »ç¿ëÇϱâ 2004-04-11  470
42   [ÃßõÆÁ]½ÃÀÛ-½ÇÇà-msconfigÈÄ ÀÚµ¿À¸·Î âÀÌ ´ÝÈ÷½Ã´Â ºÐ º¸¼¼¿ä 2004-04-11  521
41   [ÃßõÆÁ]¹ÙÀÌ·¯½ºµîÀ¸·Î °øÀ¯¿¡¼­ IPC$,ADMIN$ ÀÌ »ç¶óÁ³À»¶§ 2004-04-10  628
40   [ÃßõÆÁ]·Î±×¿ÀÇÁ(Á¾·á, ÀçºÎÆõµ...) ¹Ù·Î°¡±â ¾ÆÀÌÄÜ ¸¸µé±â 2004-04-10  760
39   À© xp ÃÖÀû Á¶°ÇÀ¸·Î »ç¿ëÇϱâÀÔ´Ï´Ù 2004-04-09  252
38   [ÃßõÆÁ]XPºí·ç ½ºÅ©¸°¿¡¼­ ÇØ°á 2004-04-09  700
37   [ÃßõÆÁ]EBS µ¿¿µ»ó °­ÀÇ Ç÷¹ÀÌ ¹®Á¦Á¡ ¹× ÇØ°á¹æ¹ý 2004-04-07  529
36   [ÃßõÆÁ]ÀÎÅͳݼ³Á¤ 2004-04-05  494
35   [ÃßõÆÁ]MSN ¸Þ½ÅÁ® ´Ù¸¥»ç¶÷ ·Î±×¿Â Áö¿ì±â 2004-04-05  487
34   [À©µµxp]xp¿¡¼­ À©µµ¿ì ¸Þ½ÅÀú »èÁ¦Çϱâ 2004-04-05  726

 
¸ñ·Ï ¾²±â