The Trojan will display such picture containing some text in Japanese.
Once executed, the Trojan copies itself as the following files:
taskmgr.exe
ugu.scrIt then creates the following files:
C:\MI3\LOOT.TXT – trace route output
C:\MI3\IP.TXT – IP address of the victim
C:\MI3\SHOT.BMP – screenshot of the desktopThen it replaces random files from the current drive with a picture
contained within the Trojan and also changes the file extension to .jpg.
The files may be any type, including documents and executables.It then deletes all files from all folders found under:
C:\Program FilesIt takes screenshots of the desktop and saves them to :
C:\MI3\SHOT.BMPIt executes the following command:
command.com /C tracert www.yahoo.co.jpIt then stores the output to the following file:
C:\MI3\LOOT.TXTThe Trojan connects to the following ftp server:
[ftp://]ftp.isweb.i[REMOVED]Then it creates a folder containing the local logged user name,
the date and the IP address into the above mentioned ftp location
using the following account:name: oonoki2006
pass: o2006The Trojan stores the following information in the created folder:
IP[COUNTER].TXT – contains the output of the tracert command
*.BMP – BMP images that contain screenshots of the desktop
The other following pictures when it executed.
如上述，常使用日系的檔案共有軟體Winny(俗稱NY或紐約)的人可得注意了～
記得之前也曾出現類似手法，以「涼宮ハルヒの憂鬱」為名的侵略(笑
總而言之，養成習慣開啟任何壓縮檔如zip或rar的時候請事先掃毒一下吧～
至於在下的話…其實我只抓附檔名為avi、mpeg、mpg、wmv的玩意！(拖走
