º» °Ô½Ã¹°¿¡ ´ëÇÑ ¾î¶°ÇÑ Ã¥ÀÓµµÁöÁö ¾Ê½À´Ï´Ù.
No, 41 2004/4/10(Åä) Á¶È¸: 628 | |
[ÃßõÆÁ]¹ÙÀÌ·¯½ºµîÀ¸·Î °øÀ¯¿¡¼ IPC$,ADMIN$ ÀÌ »ç¶óÁ³À»¶§ ¼¹ö°¡ Æ®·£Àè¼ÇÀÌ ±¸¼ºµÇ¾î ÀÖÁö ¾Ê½À´Ï´Ù. ¶ó°í ³ª¿À¸é¼ °øÀ¯°¡ ¾ÈµÉ°æ¿ì°¡ Àִµ¥ ±×·²¶© ¹Ø¿¡ ¹æ¹ýÀ¸·Î ÇÏ¸é µÈ´Ù³×¿ä! ^^ ¹ÙÀÌ·¯½º³ª backdoor, sypware, hackerÅøµî°ú °°Àº °Íµé·Î ÀÎÇØ ½Ã½ºÅÛÀÇ ±âº» admin share °¡ Á¦°ÅµÇ´Â Çö»óÀÌ ¹ß»ý µÉ ¼ö ÀÖ½À´Ï´Ù. ÀÌ·¯ÇÑ ¹ÙÀÌ·¯½ºµîÀº admin share¸¦ Á¦°ÅÇÏ°í ¾Æ·¡ ·¹Áö½ºÆ®¸® Å°ÀÇ AutoShareServer, AutoSh areWks °ªÀ» 0À¸·Î º¯°æ(ÀÌ °ªÀÌ 0À̸é admin share°¡ ¼û±â±â ¼³Á¤µÊ)ÇÏ¿© net¸í·ÉÀ¸·Î º¹±¸ÇÏ ¿©µµ ÀçºÎÆÃµÇ¸é ´Ù½Ã admin share¸¦ ¼û±âµµ·Ï µ¿ÀÛÇÕ´Ï´Ù. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Paramet ers ÀÌ¿¡ ¾Æ·¡ ¹æ¹ýÀ¸·Î admin share¸¦ ´Ù½Ã Ç¥½ÃÇϵµ·Ï ¼³Á¤ º¯°æÇϽñ⠹ٶø´Ï´Ù. [¹æ ¹ý] 1. ½ÃÀÛ - ½ÇÇà¿¡¼ "regedt32" (" "¾øÀÌ) ÀÔ·ÂÇÏ°í È®ÀÎÇÏ¿© ·¹Áö½ºÆ®¸® ÆíÁý±â¸¦ ½ÇÇàÇÕ´Ï´Ù 2. ¾Æ·¡ Æú´õ¸¦ ¼±ÅÃÇÕ´Ï´Ù. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parame ters 3. ¿À¸¥ÂÊ È¸é¿¡¼ Å° °ª Áß AutoShareServer ¿Í AutoShareWks °ªÀÌ 0À¸·Î µÇ¾î ÀÖ´Ù¸é, ÀÌ °ª À» 1·Î º¯°æÇϰųª ¶Ç´Â Á¦°ÅÇϽñ⠹ٶø´Ï´Ù. (¡Ø ±âº»ÀûÀ¸·Î ÀÌ Å° °ªÀº ¾ø´Â °ªÀ¸·Î, AutoShareServer, AutoShareWks¸¦ Á¦°ÅÇÏ¸é ±âº»ÀûÀ¸ ·Î admin share°¡ Ç¥½ÃµÇµµ·Ï ¼³Á¤µË´Ï´Ù) 4. ·¹Áö½ºÆ®¸® ÆíÁý±â¸¦ Á¾·áÇÏ°í ÀçºÎÆÃÇÏ¿© È®ÀÎÇÕ´Ï´Ù. ÀÌ¿Ü¿¡µµ Windows2000 Administrator Åø¿¡ Æ÷ÇÔµÈ Poledit ÅøÀ» ÀÌ¿ëÇÏ¿© º¯°æÇÏ´Â ¹æ¹ýÀÌ ÀÖ½À ´Ï´Ù. º¸´Ù ÀÚ¼¼ÇÑ °ÍÀº ¾Æ·¡ ¹®¼¸¦ È®ÀÎÇϽñ⠹ٶø´Ï´Ù. 318755 HOW TO: Restore Administrative Shares That Have Been Deleted http://support.microsoft.com/?id=318755 ¾Æ¿ï·¯, ¾Æ·¡ ¸®½ºÆ®´Â ½ÃÀÛ ÇÁ·Î±×·¥¿¡ µî·ÏµÇ¾î ÀÌ·¯ÇÑ ¹®Á¦¸¦ ÀÏÀ¸Å³ ¼ö ÀÖ´Â spyware¼º ÇÁ·Î ±×·¥µé°ú ¹ÙÀÌ·¯½ºµéÀÔ´Ï´Ù. Âü°íÇϽñ⠹ٶø´Ï´Ù. ------------------------------------------------ Below is a list of suspect files that have been found on computers affected by this problem. Many of these overwrite or spoof the names of legitimate files and services. They often load from the registry subkey HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run: abc.bat ADMDLL.DLL Adobea.exe adobes.exe Arial.exe Arialfont.exe Close.bat clt.exe cmd.exe CRSS.EXE CSIFCSVC.EXE dll32.exe Dvldr32.exe expiorer.exe fd.exe filter.dll FireDaemon.exe Gates.txt Gg.bat HCMD.EXE hidden32.exe INST.EXE invoker.exe iroffer.exe lps.exe LSASS.EXE Mirc.ini MP Tclockvv.exe msapp.exe MSASP.EXE msexplorer.exe mskces32 mskernel32.exe mspass.exe MSSAVE.EXE net.exe netbios.exe Ocxdll.exe pckill.exe psexec.exe PSEXESVC.EXE READWRITE.EXE regedit32.exe registry.exe root.bat screwed.exe sec32.exe secure.exe Servudaemon.ini SERVUEVENT.DLL Shares.bat shell32.exe SOCK3.EXE SPAC.TXT start.bat svchost32.exe sys32.exe Syscfg.exe Taskmngr.exe tasp.exe t-exec.dll vmn32.exe whynot.exe win32.exe win32load.exe WINCPU.EXE windowsupdate.bat windowsupdate.exe winmem.exe Winmgnt.exe Winshell winspsv.exe wmiprvse.exe xsecure.bat xsetup.bat xshare.bat ZMOKE.EXE Below are some worms, trojans and backdoors that have been found on computers affected by this problem: Backdoor.IRCBot.gen Backdoor irc.flood.c Backdoor irc.flood.e Backdoor irc.flood.f Backdoor.Dvldr Backdoor.IRC.Aladinz Backdoor.irc.flood Backdoor.IRC.Zcrew Backdoor.subseven BackGate Kit Trojan boncer Deloder HIDLE ILoveYou MIRC mirc/shaz.a.worm Sdbot servu Troj/Litmus-108 W32.HLLW.Deloder W32/Deloder.worm W32/Deloder-A W32/Nackbot-A Worm.Win32.Deloder WORM_DELODER.A ------------------------------------------------ |
¹øÈ£ | Á¦¸ñ | ÀÛ¼ºÀÏ | Á¶È¸ |
43 | [ÃßõÆÁ]160±â°¡ »ç¿ëÇϱâ | 470 | |
42 | [ÃßõÆÁ]½ÃÀÛ-½ÇÇà-msconfigÈÄ ÀÚµ¿À¸·Î âÀÌ ´ÝÈ÷½Ã´Â ºÐ º¸¼¼¿ä | 521 | |
41 | [ÃßõÆÁ]¹ÙÀÌ·¯½ºµîÀ¸·Î °øÀ¯¿¡¼ IPC$,ADMIN$ ÀÌ »ç¶óÁ³À»¶§ | 628 | |
40 | [ÃßõÆÁ]·Î±×¿ÀÇÁ(Á¾·á, ÀçºÎÆõµ...) ¹Ù·Î°¡±â ¾ÆÀÌÄÜ ¸¸µé±â | 760 | |
39 | À© xp ÃÖÀû Á¶°ÇÀ¸·Î »ç¿ëÇϱâÀÔ´Ï´Ù | 252 | |
38 | [ÃßõÆÁ]XPºí·ç ½ºÅ©¸°¿¡¼ ÇØ°á | 700 | |
37 | [ÃßõÆÁ]EBS µ¿¿µ»ó °ÀÇ Ç÷¹ÀÌ ¹®Á¦Á¡ ¹× ÇØ°á¹æ¹ý | 529 | |
36 | [ÃßõÆÁ]ÀÎÅͳݼ³Á¤ | 494 | |
35 | [ÃßõÆÁ]MSN ¸Þ½ÅÁ® ´Ù¸¥»ç¶÷ ·Î±×¿Â Áö¿ì±â | 487 | |
34 | [À©µµxp]xp¿¡¼ À©µµ¿ì ¸Þ½ÅÀú »èÁ¦Çϱâ | 726 |