Santa Claus tiene un virus para ti

Publicado el 03. Dic, 2009 por el autor Israel Rangel en la categoria Seguridad y ha sido 52 veces visto.

Buscando referencias de malwares, como era de esperar, encontrar mensajes electrónicos spammers hablando sobre esto, ya que los creadores de virus aprovechan cualquier circunstancia para infectar equipos lo más rápido y efectivo que se pueda. El mensaje spam que se ha recibido es el siguiente:

HO HO HO Santa has the best offer of the year for you

Hello, it’s me Santa Clause, I suppose you already know me, I have for you the most wanted offer of the year.

If you make an account on: hxxp://gracebiblechurchofphoenix.org/santaclause.exe until the 5th December, you can choose one welcome gift from us for 50 Euros from hxxp://gracebiblechurchofphoenix.org/santaclause.exe

and enter your validation code, which is: a91-valets-cloud-mad (Only until the 5th December availible.)

This is our way to say Happy Holidays, take your chance to feel the Christmas Anticipation.

Regards,
Santa Clause

Como pueden ver, el enlace los dirige a un archivo infectado con el nombre de santaclause.exe, la infección crea las siguientes carpetas:

%Windir%\Temp\spoolsv
%Windir%\Temp\spoolsv\download
%Windir%\Temp\spoolsv\logs
%Windir%\Temp\spoolsv\sounds

También crea las siguientes claves de registro:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cha]
- (Default) = “ChatFile”
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chat]
- (Default) = “ChatFile”
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Topic]
- (Default) = “Connect”
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ifexec]
- (Default) = “%1″
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Application]
- (Default) = “svchost”
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec]
- (Default) = “%1″
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\command]
- (Default) = “”%Windir%\temp\spoolsv\spoolsv.exe” -noconnect”
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\DefaultIcon]
- (Default) = “”%Windir%\temp\spoolsv\spoolsv.exe”"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile]
- (Default) = “Chat File”
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Topic]
- (Default) = “Connect”
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\ifexec]
- (Default) = “%1″
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Application]
- (Default) = “svchost”
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec]
- (Default) = “%1″
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\command]
- (Default) = “”%Windir%\temp\spoolsv\spoolsv.exe” -noconnect”
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\DefaultIcon]
- (Default) = “”%Windir%\temp\spoolsv\spoolsv.exe”"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc]
- (Default) = “URL:IRC Protocol”
- EditFlags = 02 00 00 00
- URL Protocol = “”
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
- spoolsv = “”%Windir%\temp\spoolsv\spoolsv.exe”"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC]
- DisplayName = “mIRC”
- UninstallString = “”%Windir%\temp\spoolsv\spoolsv.exe” -uninstall”
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\svchost\Parameters]
- Application = “”%Windir%\temp\spoolsv\spoolsv.exe”"
- AppDirectory = “”%Windir%\temp\spoolsv\spoolsv.exe”"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\svchost\Parameters]
- Application = “”%Windir%\temp\spoolsv\spoolsv.exe”"
- AppDirectory = “”%Windir%\temp\spoolsv\spoolsv.exe”"
[HKEY_CURRENT_USER\Software\Microsoft\Microsoft Agent]
- VoiceEnabled = 0×00000001
- UseVoiceTips = 0×00000001
- KeyHoldHotKey = 0×00000091
- UseBeepSRPrompt = 0×00000001
- SRTimerDelay = 0×000007D0
- SRModeID = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- EnableSpeaking = 0×00000001
- UseBalloon = 0×00000001
- UseCharacterFont = 0×00000001
- UseSoundEffects = 0×00000001
- SpeakingSpeed = 0×00000005
- PropertySheetX = 0×000F423F
- PropertySheetY = 0×000F423F
- PropertySheetWidth = 0×00000000
- PropertySheetHeight = 0×00000000
- PropertySheetPage = 0×00000000
- CommandsWindowLeft = 0xFFFFFFFF
- CommandsWindowTop = 0xFFFFFFFF
- CommandsWindowWidth = 0×000000C8
- CommandsWindowHeight = 0×000000C8
- CommandsWindowLocationSet = 0×00000000
[HKEY_CURRENT_USER\Software\mIRC\%UserName%]
- (Default) = “WhiteHat”
[HKEY_CURRENT_USER\Software\mIRC\LockOptions]
- (Default) = “0,4096″
[HKEY_CURRENT_USER\Software\mIRC\License]
- (Default) = “5662-546732″
[HKEY_CURRENT_USER\Software\WinRAR SFX]
- C%%Windows%temp%spoolsv% = “%Windir%\temp\spoolsv\”