|
이 웜은 이메일을 통하여 전파되며, 이 웜은 이메일을 통하여 전파되며, 미국의 결재 대행 서비스 회사인 paypal로 위장하고 있다.
첨부파일을 포함하고 있는 웜은 아래와 같은 본문 내용을 가지고 있다.
보낸사람 PayPal.com [donotreply@paypal.com]
Dear PayPal member,
PayPal would like to inform you about some important information
regarding your PayPal account. This account, which is associated with
the email address
메일주소
will be expiring within five business days. We apologize for any
inconvenience that this may cause, but this is occurring because all of
our customers are required to update their account settings with their
personal information.
We are taking these actions because we are implementing a new security
policy on our website to insure everyone''s absolute privacy. To avoid
any interruption in PayPal services then you will need to run the
application that we have sent with this email (see attachment) and
follow the instructions. Please do not send your personal information
through email, as it will not be as secure.
IMPORTANT! If you do not update your information with our secure
application within the next five business days then we will be forced to
deactivate your account and you will not be able to use your PayPal
account any longer. It is strongly recommended that you take a few
minutes out of your busy day and complete this now.
DO NOT REPLY TO THIS MESSAGE VIA EMAIL! This mail is sent by an
automated message system and the reply will not be received.
Thank you for using PayPal.
해당 파일이 실행 되면 윈도우 폴더(win9x, XP: c:\windows, win2000: c:\winnt)에
svchost32.exe를 생성한다.
또한 C: 에 다음의 파일을 생성한다.
pp.gif (PayPal 그림파일)
pp.hta (PayPal 카드번호 입력창)
위의 정보는 ppinfo.sys 파일에 저장되어 외부로 유출 된다.
그런 다음 다음처럼 레지스트를 수정하여 다음 부팅시 실행되도록 조작한다.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
항목에
(win9x, Xp의 경우)
SvcHost32 = c:\windows\svchost32.exe
(win2000, NT의 경우)
SvcHost32 = c:\winnt\svchost32.exe |
|
|
Home 
