EMCODEC.B troyano simula ser instalador de Codec de Windows Media Player libera archivos y un destructivo troyano. 

© Jorge Machado  Lima-Perú

Troj/Emcodec.B

Emcodec.B es un troyano reportado el 09 de Mayo del 2006, que ingresa furtivamente a los sistemas a través de diversos servicios de Internet tales como Telnet, servidores FTP, puerto 8080 (HTTP) e incluso puede ser enviado en mensajes de correo.

Este troyano simula ser el instalador del Codec para Windows Media Player, denominado eCodec:

http://www.emcodec.com

Copia un archivo infectado que inserta en el Winlogon.exe de Windows para alterar sus Inicio y libera un destructivo troyano de la familia Zlob.

Es un PE (Portable Ejecutable) e infecta Windows 95/98/NT/Me/2000/XP y Server 2003, escrito en MS Visual C++ con extensión variable y comprimido con el utilitario UPX (Ultimate Packer for eXecutables):

http://upx.sourceforge.net

Al ingresar a un sistema muestra el Acuerdo de Licencia de Uso para Usuario Final (EULA) de eMediaCodec:

EMEDIACODEC ("Licensor") (emediacodec.com)

LICENSE AGREEMENT

YOU SHOULD CAREFULLY READ THE FOLLOWING TERMS AND CONDITIONS BEFORE USING THIS PRODUCT. IT CONTAINS SOFTWARE, THE USE OF WHICH IS LICENSED BY LICENSOR TO ITS CUSTOMERS FOR THEIR USE ONLY AS SET FORTH BELOW. IF YOU DO NOT AGREE TO THE TERMS AND CONDITIONS OF THIS AGREEMENT, DO NOT USE THE SOFTWARE. USING ANY PART OF THE SOFTWARE INDICATES THAT YOU ACCEPT THESE TERMS.

THE PRODUCT IS PROVIDED "AS IS". THERE ARE NO WARRANTIES UNDER THIS AGREEMENT, AND LICENSOR DISCLAIMS ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR PARTICULAR PURPOSE.

GRANT OF LICENSE: Licensor grants to you this personal, limited, non-exclusive, non-transferable, non-assignable license solely to use in a single copy of the Licensed Works on a single computer for use by a single concurrent user only, and solely provided that you adhere to all of the terms and conditions of this Agreement. "Licensed Works" means computer software together with any related documentation (including design, systems and user) and other materials for use in connection with such computer software in this package. The foregoing is an express limited use license and not an assignment, sale, or other transfer of the Licensed Works or any Intellectual Property Rights (as defined below) of Licensor.

ASSENT: By opening the file package containing this software, you agree that this Agreement is a legally binding and valid contract, agree to abide by the intellectual property laws and all of the terms and conditions of this Agreement, and further agree to take all necessary steps to ensure that the terms and conditions of this Agreement are not violated by any person or entity under your control or in your service.

OWNERSHIP OF SOFTWARE: The Licensor and/or its affiliates or subsidiaries own certain rights that may exist from time to time in this or any other jurisdiction, whether foreign or domestic, under patent law, copyright law, publicity rights law, moral rights law, trade secret law, trademark law, unfair competition law or other similar protections, regardless of whether or not such rights or protections are registered or perfected (the "Intellectual Property Rights"), in the Licensed Works. ALL INTELLECTUAL PROPERTY RIGHTS IN AND TO THE LICENSED WORKS ARE AND SHALL REMAIN IN LICENSOR.

NO COMMERCIAL USE: This License Agreement grants you the right to use the software for personal use only. Commercial use of the software or of the work products resulting from its use is not permitted under this License Agreement.

RESTRICTIONS:

(a) You are expressly prohibited from copying, modifying, merging, selling, leasing, redistributing, assigning, or transferring in any matter, Licensed Works or any portion thereof.

(b) You may take a single copy of materials within the package or otherwise related to Licensed Works only as required for backup purposes.

(c) You are also expressly prohibited from reverse engineering, decompiling, translating, disassembling, deciphering, decrypting, or otherwise attempting to discover the source code of the Licensed Works as the Licensed Works contain proprietary material of Licensor. You may not otherwise modify, alter, adapt, port, or merge the Licensed Works.

(d) You may not remove, alter, deface, overprint or otherwise obscure Licensor patent, trademark, service mark or copyright notices.

(e) You agree that the Licensed Works will not be shipped, transferred or exported into any other country, or used in any manner prohibited by any government agency or any export laws, restrictions or regulations.

(f) You may not publish or distribute in any form of electronic or printed communication the materials within or otherwise related to Licensed Works, including but not limited to the object code, documentation, help files, examples, and benchmarks.

TERM: This Agreement is effective until terminated. You may terminate this Agreement at any time by uninstalling the Licensed Works and destroying all copies of the Licensed Works. Upon any termination, you agree to uninstall the Licensed Works and return or destroy all copies of the Licensed Works, any accompanying documentation, and all other associated materials.

SOFTWARE INSTALLATION: Components bundled with our software may report to Licensor and/or its affiliates the installation status of certain marketing offers, such as toolbars, and also generalized installation information, such as language preference and operating system version, to assist Licensor in its product development. No personal information will be communicated to EMEDIACODEC or its affiliates during this process. Licensor may offer additional components through our version checking/update system. These components include: Toolbar, Popup advertising solution, Commercial homepage manager, Commercial messenger, Antispyware software.

WARRANTIES AND DISCLAIMER: EXCEPT AS EXPRESSLY PROVIDED OTHERWISE IN A WRITTEN AGREEMENT BETWEEN LICENSOR AND YOU, THE LICENSED WORKS ARE NOW PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, OR THE WARRANTY OF NON-INFRINGEMENT. WITHOUT LIMITING THE FOREGOING, LICENSOR MAKES NO WARRANTY THAT (i) THE LICENSED WORKS WILL MEET YOUR REQUIREMENTS, (ii) THE USE OF THE LICENSED WORKS WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE, (iii) THE RESULTS THAT MAY BE OBTAINED FROM THE USE OF THE LICENSED WORKS WILL BE ACCURATE OR RELIABLE, (iv) THE QUALITY OF THE LICENSED WORKS WILL MEET YOUR EXPECTATIONS, (v) ANY ERRORS IN THE LICENSED WORKS WILL BE CORRECTED, AND/OR (vi) YOU MAY USE, PRACTICE, EXECUTE, OR ACCESS THE LICENSED WORKS WITHOUT VIOLATING THE INTELLECTUAL PROPERTY RIGHTS OF OTHERS. SOME STATES OR JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES OR LIMITATIONS ON HOW LONG AN IMPLIED WARRANTY MAY LAST, SO THE ABOVE LIMITATIONS MAY NOT APPLY TO YOU. IF CALIFORNIA LAW IS NOT HELD TO APPLY TO THIS AGREEMENT FOR ANY REASON, THEN IN JURISDICTIONS WHERE WARRANTIES, GUARANTEES, REPRESENTATIONS, AND/OR CONDITIONS OF ANY TYPE MAY NOT BE DISCLAIMED, ANY SUCH WARRANTY, GUARANTEE, REPRESENATION AND/OR WARRANTY IS: (1) HEREBY LIMITED TO THE PERIOD OF EITHER (A) THIRTY (30) DAYS FROM THE DATE OF OPENING THE PACKAGE CONTAINING THE LICENSED WORKS OR (B) THE SHORTEST PERIOD ALLOWED BY LAW IN THE APPLICABLE JURISDICTION IF A THIRTY (30) DAY LIMITATION WOULD BE UNENFORCEABLE; AND (2) LICENSOR'S SOLE LIABILITY FOR ANY BREACH OF ANY SUCH WARRANTY, GUARANTEE, REPRESENTATION, AND/OR CONDITION SHALL BE TO PROVIDE YOU WITH A NEW COPY OF THE LICENSED WORKS.

IN NO EVENT SHALL LICENSOR OR ITS SUPPLIERS BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, OR ANY DAMAGES WHATSOEVER, INCLUDING, WITHOUT LIMITATION, THOSE RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER OR NOT LICENSOR HAD BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, AND ON ANY THEORY OF LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OF THE LICENSED WORKS. SOME JURISDICTIONS PROHIBIT THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, SO THE ABOVE LIMITATIONS MAY NOT APPLY TO YOU. THESE LIMITATIONS SHALL APPLY NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY.

SEVERABILITY: In the event any provision of this License Agreement is found to be invalid, illegal or unenforceable, the validity, legality and enforceability of any of the remaining provisions shall not in any way be affected or impaired and a valid, legal and enforceable provision of similar intent and economic impact shall be substituted therefor.

ENTIRE AGREEMENT: This License Agreement (located at http://www.emediacodec.com/terms.html) sets forth the entire understanding and agreement between you and Licensor, supersedes all prior agreements, whether written or oral, with respect to the software, and may be amended only in a writing signed by both parties.

inmediatamente libera en las siguientes rutas los archivos:

Luego ejecuta el archivo ecodec.exe y copia a la carpeta %System% el archivo regperf.exe el mismo que libera aleatoriamente un troyano de la familia Zlob, el cual inserta su código en Winlogon.exe, un proceso del sistema operativo ubicado en la ruta C:\Windows\System32 que es ejecutado en segundo plano y es la última fase de activación del sistema operativo.

Muchos gusanos conocidos infectan este archivo para alterar el inicio de los sistemas.

Los troyanos de la familia Zlob son destructivos pues descargan y ejecutan remotamente archivos y alteran o modifica los servicios, funciones y programas de Windows.

%System% es la variable C:\Windows\System para Windows 95/98/Me, C:\Winnt\System32 para Windows NT/2000 y C:\Windows\System32 para Windows XP y Windows Server 2003.

%ProgramFiles% es la variable para \Program files o \Archivos de programa de los directorios raíz de cualquier unidad de disco.

Finalmente borra en la ruta siguiente, el archivo:

%ProgramFiles%\Media-Codec\ecodec.exe

Los archivos de audio/video que hubiesen sido comprimidos usando este Codec, no podrán funcionar.

PER ANTIVIRUS® versión 9.7 con registro de virus al 09 de Mayo del 2006 detecta y elimina eficientemente este troyano. 


Ir al menú anterior

Regresar al Portal de PER SYSTEMS