Da li je SMSC.exe virus?
- Začetnik teme Mare
- Datum pokretanja
OP
OP
Mare
Čuven
- Učlanjen(a)
- 01.02.2002
- Poruke
- 6,454
- Poena
- 885
evo
Description:
This memory-resident worm takes advantage of the following vulnerabilities to propagate across the network:
Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) vulnerability
RPC Locator Exploit
IIS/WebDAV Vulnerability
For more information about these Windows vulnerabilities, please refer to the following Microsoft Web pages:
Microsoft Security Bulletin MS03-026
Microsoft Security Bulletin MS03-001
Microsoft Security Bulletin MS03-007
It spreads via network shares by dropping a copy of itself in the Windows system folder using the following file name:
SMSC.EXE
It has backdoor capabilities. It acts as a server program controlled by an IRC bot then sends commands to control the target system.
It also perfoms denial of service (DoS) attacks, gathers product IDs and CD keys of popular game applications, and terminates a list of processess, which are mostly related to antivirus applications.
It runs on Windows NT, 2000, and XP.
Solution:
Restarting in Safe Mode
» On Windows NT (VGA mode)
Click Start>Settings>Control Panel.
Double-click the System icon.
Click the Startup/Shutdown tab.
Set the Show List field to 10 seconds and click OK to save this change.
Shut down and restart your computer.
Select VGA mode from the startup menu.
» On Windows 2000
Restart your computer.
Press the F8 key, when you see the Starting Windows bar at the bottom of the screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.
» On Windows XP
Restart your computer.
Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.
Terminating the Malware Program
This procedure terminates the running malware process.
Open Windows Task Manager.
" On Windows 95, 98, and ME, press
CTRL+ALT+DELETE
" On Windows NT, 2000, and XP, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the process:
SMSC.EXE
Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your system.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
--------------------------------------------------------------------------------
*NOTE: On systems running Windows 95, 98, and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process. Otherwise, continue with the next procedure, noting additional instructions.
Removing Autostart Entries from the Registry
Removing autostart entries from the registry prevents the malware from executing at startup.
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
Win32 USB 2 Driver = "smsc.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>RunOnce
In the right panel, locate and delete the entry:
Win32 USB 2 Driver = "smsc.exe"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
Win32 USB 2 Driver = "smsc.exe"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>RunOnce
In the right panel, locate and delete the entry:
Win32 USB 2 Driver = "smsc.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE\Software\Microsoft Windows\CurrentVersion\Runservices
In the right panel, locate and delete the entry:
Win32 USB 2 Driver = "smsc.exe"
Close Registry Editor.
--------------------------------------------------------------------------------
NOTE: If you were not able to terminate the malware process as described in the previous procedure, restart your system.
Description:
This memory-resident worm takes advantage of the following vulnerabilities to propagate across the network:
Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) vulnerability
RPC Locator Exploit
IIS/WebDAV Vulnerability
For more information about these Windows vulnerabilities, please refer to the following Microsoft Web pages:
Microsoft Security Bulletin MS03-026
Microsoft Security Bulletin MS03-001
Microsoft Security Bulletin MS03-007
It spreads via network shares by dropping a copy of itself in the Windows system folder using the following file name:
SMSC.EXE
It has backdoor capabilities. It acts as a server program controlled by an IRC bot then sends commands to control the target system.
It also perfoms denial of service (DoS) attacks, gathers product IDs and CD keys of popular game applications, and terminates a list of processess, which are mostly related to antivirus applications.
It runs on Windows NT, 2000, and XP.
Solution:
Restarting in Safe Mode
» On Windows NT (VGA mode)
Click Start>Settings>Control Panel.
Double-click the System icon.
Click the Startup/Shutdown tab.
Set the Show List field to 10 seconds and click OK to save this change.
Shut down and restart your computer.
Select VGA mode from the startup menu.
» On Windows 2000
Restart your computer.
Press the F8 key, when you see the Starting Windows bar at the bottom of the screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.
» On Windows XP
Restart your computer.
Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.
Terminating the Malware Program
This procedure terminates the running malware process.
Open Windows Task Manager.
" On Windows 95, 98, and ME, press
CTRL+ALT+DELETE
" On Windows NT, 2000, and XP, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the process:
SMSC.EXE
Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your system.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
--------------------------------------------------------------------------------
*NOTE: On systems running Windows 95, 98, and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process. Otherwise, continue with the next procedure, noting additional instructions.
Removing Autostart Entries from the Registry
Removing autostart entries from the registry prevents the malware from executing at startup.
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
Win32 USB 2 Driver = "smsc.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>RunOnce
In the right panel, locate and delete the entry:
Win32 USB 2 Driver = "smsc.exe"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
Win32 USB 2 Driver = "smsc.exe"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>RunOnce
In the right panel, locate and delete the entry:
Win32 USB 2 Driver = "smsc.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE\Software\Microsoft Windows\CurrentVersion\Runservices
In the right panel, locate and delete the entry:
Win32 USB 2 Driver = "smsc.exe"
Close Registry Editor.
--------------------------------------------------------------------------------
NOTE: If you were not able to terminate the malware process as described in the previous procedure, restart your system.
