https://croatianschoolsydney.com/index.php?action=history&feed=atom&title=VBS.Runauto.F 2026-06-16T14:07:13Z Povijest promjena ove stranice na wikiju MediaWiki 1.36.2 https://croatianschoolsydney.com/index.php?title=VBS.Runauto.F&diff=118358&oldid=prev 2021-09-13T22:32:52Z

<p>Bot: Automatski unos stranica</p> <p><b>Nova stranica</b></p><div>&lt;!--'''VBS.Runauto.F'''--&gt;'''VBS.Runauto.F''' je [[računalni crv]] otkriven [[19. svibnja]] [[2009.]] godine. Zaražava računala koja rade pod operativnim sustavom Microsoft Windows ([[Windows 98]], [[Windows 95]], [[Windows XP]], [[Windows Me]], [[Windows Vista]], [[Windows NT]], [[Windows Server 2003]], [[Windows 2000]]).<br /> <br /> == Djelovanje ==<br /> Crv se kopira kao datoteke %System%\winjpg.jpg i %SystemDrive%\winfile.jpg. Također pravi datoteku %SystemDrive%\autorun.inf koja se aktivira kad korisnik pristupi %SystemDrive%-u te onda ubacuje komponentu [[backdoor]]a u datoteku %System%\winxp.exe. <br /> <br /> U [[Windows Registry]] VBS.Runauto.F dodaje vrijednost &lt;code&gt;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\&quot;CTFMON&quot; = &quot;%System%\wscript.exe /E:vbs %System%\winjpg.jpg&quot;&lt;/code&gt; kako bi se mogao pokretati tijekom sljedećih podizanja sustava, te &lt;code&gt;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\&quot;regdiit&quot; = &quot;%System%\winxp.exe&quot;&lt;/code&gt;<br /> &lt;code&gt;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\&quot;abu salem&quot; = &quot;43 00 3A 00 5C 00 57 00 49 00 4E 00 44 00 4F 00 57 00 53 00 5C 00 73 00 79 00 73 00 74 00 65 00 6D 00 33 00 32 00 5C 00 77 00 69 00 6E 00 78 00 70 00 2E 00 65 00 78 00 65 00&lt;/code&gt; za pokretanje backdora, također za vrijeme sljedećih podizanja sustava.<br /> <br /> Crv mijenja vrijednosti &lt;code&gt;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwwinxp.exe\&quot;Debugger&quot; = &quot;%System%\winxp.exe&quot;&lt;/code&gt;,&lt;code&gt;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSConfig.exe\&quot;Debugger&quot; = &quot;%System%\wscript.exe /E:vbs %System%\winjpg.jpg&quot;&lt;/code&gt;, &lt;code&gt;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\&quot;Debugger&quot; = &quot;\winxp.exe&quot;&lt;/code&gt;,&lt;code&gt;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\&quot;Debugger&quot; = &quot;%System%\wscript.exe /E:vbs %System%\winjpg.jpg&quot;&lt;/code&gt; kako bi se on sam pokrenuo umjesto traženih aplikacija.<br /> <br /> VBS.Runauto.F umanjuje [[računalna sigurnost|sigurnost računala]] mijenjanjem vrijednosti &lt;code&gt;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\&quot;Enabled&quot; = &quot;1&quot;&lt;/code&gt;, &lt;code&gt;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\&quot;AntiVirusOverride&quot; = &quot;1&quot;&lt;/code&gt;, &lt;code&gt;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\&quot;CheckedValue&quot; = &quot;1&quot;&lt;/code&gt;,<br /> &lt;code&gt;HKEY_USERS\S-1-5-21-1110976373-127614085-1323839693-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\&quot;NoDriveTypeAutoRun&quot; = &quot;0&quot;&lt;/code&gt;.<br /> <br /> Crv se širi tako što se kopira na sve izmjenjive diskove (''removable drives'') kao datoteka %DriveLetter%\winfile.jpg te pravi datoteku %DriveLetter%\autorun.inf koja se aktivira kad korisnik pristupi izmjenjivim driverima.<br /> <br /> == Izvor ==<br /> * [http://www.symantec.com/security_response/writeup.jsp?docid=2009-051918-1008-99&amp;tabid=2 Symantec.com]<br /> <br /> [[Kategorija:Računalni crvi]]</div>

WikiSysop