More actions
Bot: Automatski unos stranica |
m Zamjena teksta - '<!--'''V(.*)'''-->' u '' |
||
| Redak 1: | Redak 1: | ||
'''VBS.Desktuk''' je [[računalni crv]] otkriven [[25. kolovoza]] [[2007.]] godine. Zaražava računala koja rade pod operativnim sustavom [[Microsoft Windows]] ([[Windows 98]], [[Windows 95]], [[Windows XP]], [[Windows Me]], [[Windows Vista]], [[Windows NT]], [[Windows Server 2003]], [[Windows 2000]]). | |||
Crv pravi datoteke %System%\explorar.vbs i %System%\destruckto.html te u [[Windows Registry]] dodaje vrijednost <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Explorer" = "%System%\explorar.vbs"</code> kako bi se pokretao tijekom sljedećeg podizanja sustava. VBS.Desktuk potom umanjuje [[računalna sigurnost|sigurnost računala]] mijenanjem registarskih vrijednosti <code>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\"Window Title" = "DESTRUKTO!!!!!"</code>,<code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoFind" = "1"</code>,<code> HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoRun" = "1"</code>, <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableRegistryTools" = "1"</code>, <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableTaskMgr" = "1"</code>, <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"ShowSuperHidden" = "0"</code>, <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\"NoFolderOptions" = "1"</code>, <code>HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\"DisableConfig" = "1"</code>, <code>HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\"DisableSR" = "1"</code>, <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoDriveTypeAutoRun" = "0"</code> | Crv pravi datoteke %System%\explorar.vbs i %System%\destruckto.html te u [[Windows Registry]] dodaje vrijednost <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Explorer" = "%System%\explorar.vbs"</code> kako bi se pokretao tijekom sljedećeg podizanja sustava. VBS.Desktuk potom umanjuje [[računalna sigurnost|sigurnost računala]] mijenanjem registarskih vrijednosti <code>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\"Window Title" = "DESTRUKTO!!!!!"</code>,<code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoFind" = "1"</code>,<code> HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoRun" = "1"</code>, <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableRegistryTools" = "1"</code>, <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableTaskMgr" = "1"</code>, <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"ShowSuperHidden" = "0"</code>, <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\"NoFolderOptions" = "1"</code>, <code>HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\"DisableConfig" = "1"</code>, <code>HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\"DisableSR" = "1"</code>, <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoDriveTypeAutoRun" = "0"</code> | ||
Posljednja izmjena od 22. lipanj 2025. u 06:51
VBS.Desktuk je računalni crv otkriven 25. kolovoza 2007. godine. Zaražava računala koja rade pod operativnim sustavom Microsoft Windows (Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000).
Crv pravi datoteke %System%\explorar.vbs i %System%\destruckto.html te u Windows Registry dodaje vrijednost HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Explorer" = "%System%\explorar.vbs" kako bi se pokretao tijekom sljedećeg podizanja sustava. VBS.Desktuk potom umanjuje sigurnost računala mijenanjem registarskih vrijednosti HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\"Window Title" = "DESTRUKTO!!!!!",HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoFind" = "1", HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoRun" = "1", HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableRegistryTools" = "1", HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableTaskMgr" = "1", HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"ShowSuperHidden" = "0", HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\"NoFolderOptions" = "1", HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\"DisableConfig" = "1", HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\"DisableSR" = "1", HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoDriveTypeAutoRun" = "0"
Crv se poslije toga kopira na svim izmjenjivim diskovima (removable drives) zaraženog računala kao datoteke %DriveLetter%\autorun.inf i %DriveLetter%\explorar.vbs.