Malware Zero Kit

Virus Zero Season 2 : cafe.naver.com/malzero
Batch Script : ViOLeT (archguru)

http://cafe.naver.com/malzero/94376

 ! Ÿ Ʈ/ī/α/䷻Ʈ  /   ̿   ! (߰  Ű )

- - - - - - - - - - - - - - - - - - - - -

  01. Malware Zero Kit ũƮ  ؾ ϳ?

   Ǿ ִ <6.  >  

- - - - - - - - - - - - - - - - - - - - -

  02. ũƮ    ߻մϴ. (Ǵ ũƮ ʱȭ  )

   A. ʼ   ʰų  · 

          Ͻðų   Ŀ  ߻ϸ   ޾ 

        ӵ , Ǵ   Ż  ϴ Ǽڵ忡    Ƿ  (Ʈŷ ) ȯ濡 ٸ  ġ  Ǯ ˻ 

   B. Ʈ   

      Ǽڵ忡 Ͽ Ʈ   ִ ,  unhookexec.inf    콺  Ŭ  ġ

       ,   系 PC  Ư  Ģ    ִ  ذ   

   C. ͺ̽   ġ  (Ǵ   )

        ũƮ    ü       Ǵ  unlock.reg    

        ӵ ,   Ű Virut Ǵ Parite  Ǽڵ忡     Ƿ   ǰ() ̿Ͽ  ˻  (ܵ   )

   D. Oops, Unsupported Korean Language !

      Control Panel  Region and Language  Administrative  Language for non-Unicode programs  Change system locale  Korean (Korea)

   X. ũƮ ʱȭ ð ʹ  ɸ  (10 ̻)

       ǰ ǽð   Ȱȭ  ˻ Ǵ     ˻ 

- - - - - - - - - - - - - - - - - - - - -

  03. ũƮ   ڱ ǰų Ư  ð ߴ    ̷ ʽϴ.

    unlock.reg Ʈ /  ,    ߻ϴ  Ʒ   1ȸ Ͽ Ǽڵ ġ  

    Kaspersky TDSSKiller          : http://media.kaspersky.com/utilities/VirusUtilities/EN/tdsskiller.exe
    AhnLab V3 OnlineGameHack Kill : http://download.ahnlab.com/vaccine/gamehackkill.exe

    '  ã  ϴ.' ޽ ǥõ  Ǹ Cidox ƮŶ    Ƿ Kaspersky TDSSKiller   

- - - - - - - - - - - - - - - - - - - - -

  04. Ǽ α׷ Ǵ Ǽڵ尡 ߰ Ǿ ŵ ʾҽϴ.  ؾ ϳ?

   Ǽ ׸  Ű  , ǻ͸  Ǵ     ٽ   ˻ õ

   Ŀ ſ ϸ  ǰ()    Ǵ   ƿƼ Ͽ  

    ŵ ʴ Ʈ  , Ʈ (REGEDIT) Ͽ  

      Ϲ ¿ Ʈ (REGEDIT)   Ű Ұ  Ʒ α׷ ޾  

       PsExec : https://technet.microsoft.com/ko-kr/bb897553

       Ʈ( ) Ͽ  ̵  Ʒ  Ͽ Ʈ (REGEDIT)     õ
      (  Ű    Everyone  ߰   ѿ  üũ  )

      PsExec -i -d -s regedit.exe

- - - - - - - - - - - - - - - - - - - - -

  05.      , Ʈ  Դϴ.  Ѱ?

   ˿ (⺻: C:\Quarantine_MZK)  

       ϸ ڿ  ¥ vz Ȯ  , Ʈ  Ͽ    ( ̵ )
   Ʈ  reg Ȯ   ȮϿ     

   ˿    Files  , Folders  , Registrys  Ʈ  

     ߻ , mzkhelp@gmail.com ڿּҷ ˻ Ʈ  ÷Ͽ Ű

- - - - - - - - - - - - - - - - - - - - -

  06.   ϴ  𸣰ڽϴ.  ؾ ϳ?

   [ Windows Vista, 7 ]
   ʱ Windows  ȭ  ٷ    ȭ ¿ F8 Ű     ȭ鿡 

   [ Windows 8 ]
   (:  + I Ű)  PC    Ʈ        ɼ  ٽ    ذ   ɼ     ٽ     ȭ鿡 

   [ Windows 10 ]
   (:  + I Ű)  Ʈ        ɼ  ٽ    ذ   ɼ     ٽ     ȭ鿡 

- - - - - - - - - - - - - - - - - - - - -

  07. ˻縦  Ϸ Ŀ ͳݿ  ʽϴ. ( Ŀ   )

   Ǽڵ忡  ý (Ư WSHTCPIP.DLL)  WINSOCK, TCP/IP, DHCP  Ǵ DNS    Ǵ ջ  ߻ ϸ, Ʒ  Ͽ Ʈũ ȯ 

     ý   ʾ  ߻  ǥ ȯ Ͽ Windows ġ ̵(CD/DVD)  ,  Ʈ(CMD)   Ͻ  SFC /SCANNOW ɾ , Ǵ < 12> 

    Ȥ Ʈũ Ͱ  (Deep Slip)  Ǿ  Ұ  ,   ġ ڿ   Ʈũ    ' '  ' ϱ  ǻͰ  ġ   ' ׸ ؾ 

   1) Ʒ   'DNS'  Ȯ  

      A. ''  'Ʈũ  ͳ'  'Ʈũ   '  (Ǵ NCPA.CPL )
      B. 'Ȱ Ʈũ ' '' ׸񿡼 '(Ǵ )  ' Ŭ (Ī ٸ  )
      C. (Ǵ )    â 'Ϲ' ǿ 'Ӽ' ư Ŭ
      D. Ӽ â 'Ʈŷ' ǿ 'Internet Protocol Version 4 (TCP/IPv4)' ׸   'Ӽ' ư Ŭ
      E. Ӽ â 'Ϲ' ǿ ϴ DNS  'ڵ DNS  ּ ޱ' Ǵ ' DNS  ּ ' üũ

         * ' DNS  ּ ' üũ  Էؾ  IP
           (Ż Ǵ Ʈũ ȯ渶 ٸ  ,  DNS ּҸ ϴ ȸ   DNS ּ Է)

         KT Olleh     = ⺻ DNS : 168.126.63.1,    DNS : 168.126.63.2
         SK Broadband = ⺻ DNS : 210.220.163.82,  DNS : 219.250.36.130
         LG U+ #1     = ⺻ DNS : 164.124.101.2,   DNS : 203.248.252.2
         LG U+ #2     = ⺻ DNS : 164.124.107.9,   DNS : 203.248.252.2
         LG U+ #3     = ⺻ DNS : 61.41.153.2,     DNS : 1.214.68.2
         Google       = ⺻ DNS : 8.8.8.8,         DNS : 8.8.4.4

      F. 'Ȯ' ư Ŭ  ͳ  Ȯ

   2) ''  'Ʈũ  ͳ'  'Ʈũ   ' â ϴ ' ذ'    

   3) ⸦  ,   Ǵ  ư      Ȯ

   4)  ׸  Ŀ    Ʒ ɾ    

      IPCONFIG /REGISTERDNS
      IPCONFIG /FLUSHDNS
      IPCONFIG /RELEASE
      IPCONFIG /RENEW

   5) 4 ׸  Ŀ    Ʒ ɾ   

      NETSH WINSOCK RESET

   6) 5 ׸  Ŀ    Ʒ ɾ   
      ( TCP/IP     IP, DNS  Ʈ  ʱȭǹǷ 缳 ʿ  )

      NETSH INT IP RESET C:\LOG.TXT

   7) Ʒ   ã    Ŭ, 'Ӽ'    ǿ '' ư Ŭ

      Windows  System32   NSISVC.DLL
      Windows  System32  wbem   WMISVC.DLL

      ư Ŭ  SYSTEM, Administrators, Users ׷ 'б  '  ''  Ǿ  ȮϿ Ǿ    '' 

        

   8) 7 ׸  Ŀ   , Ʒ    ī 'ӵ  '  

      A. ''  'Ʈũ  ͳ'  'Ʈũ   ' 
      B. 'Ȱ Ʈũ ' ׸񿡼 '  ' Ŭ (Ī ٸ  )
      C.     â 'Ϲ' ǿ 'Ӽ' ư Ŭ
      D.    Ӽ â 'Ʈŷ' ǿ '' ư Ŭ
      E.  ī ̹ Ӽ â '' ǿ 'ӵ  ' ׸    <1Gbps /100Mbps /10Mbps >     (⺻: ڵ )
      F. 'Ȯ' ư   

    Ʈũ    ǥõ   < 08> ׸ Ͽ ذ
     ε   ,  ī ̹ 缳ġ Ǵ ü   

- - - - - - - - - - - - - - - - - - - - -

  08. 'Ʈũ   ' Ʈũ Ͱ ǥõ ʰų    ġ 

   1) Ʈũ   (Deep Slip)  

      A. ''  'ġ ' 
      B. 'Ʈũ ' ׸񿡼    ġ    ư Ŭ
      C. 'Ӽ' ޴ Ŭ
      D. ' '  Ŭ
      E. ' ϱ  ǻͰ  ġ   ' ׸ üũ 
      F.    

   2)  Ʈ(CMD)   Ͽ Ʒ ɾ   

      REGSVR32 NETSHELL.DLL
      REGSVR32 NETCFGX.DLL
      REGSVR32 NETMAN.DLL

   3)  ذ  , Ʒ    '̹ Ʈ Ʈ'  ( ߻  Ϳ    )

      A. ''  'ġ ' 
      B. 'Ʈũ ' ׸񿡼  ǥ  ǥ  ġ    ư Ŭ
      C. '̹ Ʈ Ʈ' ޴ Ŭ
      D. 'ǻͿ ̹ Ʈ ãƺ' Ŭ
      E. 'ǻ ġ ̹ Ͽ  ' Ŭ
      F.  ġ  Ī ̹   '' ư Ŭ
      G.    

- - - - - - - - - - - - - - - - - - - - -

  09. ũƮ   "ڰ  Ʈ  ʵ ߽ϴ." ޽ ǥõ˴ϴ.

    unlock.reg Ʈ /  ˻ 

- - - - - - - - - - - - - - - - - - - - -

  10. ũƮ   "ý  ġ"  ߻մϴ.  ؾ ϳ?

       ˻ 

- - - - - - - - - - - - - - - - - - - - -

  11. ͳ ͽ÷η   ʴ  ̻  ߻մϴ.  ؾ ϳ?

     Ʈũ  ͳ  ͳ ɼ      ư   ʱȭ

     ġǾ ִ  ÷ ÷̾(Adobe Flash Player) 浹   Ƿ, ÷ ÷̾   缳ġ

- - - - - - - - - - - - - - - - - - - - -

  12. ʼ ý   ʰų 'Ȯ ʿ' ǥõǾϴ.  óؾ ϳ?

   1) ʼ ý     (DLL  츸 ش)

       http://ko.dll-files.com
       http://www.dlldownloader.com

       Ʈ    湮Ͽ ϸ ˻, ڽ ü  Ʈ  ´  Windows   System32 Ǵ SysWOW64  
      (System32 Ȥ SysWOW64    Ȯ Ʈ Ͽ ϵ  )

       32bit ü : System32 (32bit)
       64bit ü : System32 (64bit), SysWOW64 (32bit)

   2) ʼ ý  'Ȯ ʿ' ǥõǾ 

      ü Ʈ     쿡 'Ȯ ʿ'  ǥõ  Ƿ,  ̷ Ż(https://www.virustotal.com) Ʈ 湮Ͽ شǴ  ÷ ˻ 

      ̷ Ż  ( ׸ ʷϻ) ȮεǴ , ũƮ  ޾   ȮεǾٸ Ʈ Ͽ ϵ SHA-256  mzkhelp@gmail.com ڿּҷ 뺸
       ũƮ  ޾  ° ƴ϶ ũƮ  ޾  (ڵ Ʈ  )

      ̷ Ż  Ǽ Ǿٸ Ʒ A  B ׸ Ȯ

      A. DLL  Ǽ Ϸ (  8 ̻)Ǿ 쿡 ٷ  1)׸  (,   ϸ   ʿ)
      B. EXE  Ǽ Ϸ (Virut Ǵ Parite )Ǿ 쿡 http://cafe.naver.com/malzero/94118 Խù Ͽ ġ

- - - - - - - - - - - - - - - - - - - - -

  13. Ǽڵ ġ/ Ŀ ǻͰ  ϴ.

   Ǽڵ尡   ̳ ũ   ߻ 쿡 Ÿ  ɼ ũǷ, Ʒ  Ͽ ũ  

   1)  Ʈ(CMD)   
   2) CHKDSK Է   (!  Ͱ ߰ߵǸ  ˻ )
   3)  ߰ߵ , CHKDSK /F (  ˻縦   /F  /R  ) Է  
   4) ' ý ٽ     ˻ϵ Ͻðڽϱ?' ޽ Y Է  
   5)  (ü  ߰ ũ ˻ , ð ټ ҿ)

    Ȥ ũ µ   찡 ,   ǻ͸ Ų   20 Ŀ 

- - - - - - - - - - - - - - - - - - - - -

  14. ũƮ   "    (ϴ)"  ߻մϴ.  ؾ ϳ?

    unlock.reg Ʈ /  ˻ 

    Ŀ    Windows  System32   ϴ CMD.EXE( Ʈ)  ϴ Ȯ
       Ǽڵ忡 Ͽ  ·, Ʒ  ޱ

   https://www.cubby.com/pl/FileRepair_CMD_KR.zip/_f51a11d2752541a8b89ec5557a741866

    ޾  Ǯ ü ´  Windows   System32   , ũƮ 

- - - - - - - - - - - - - - - - - - - - -

  15. Ÿ ߻  ִ   ذϷ?

    Microsoft   : http://windows.microsoft.com/ko-kr/windows/support

- - - - - - - - - - - - - - - - - - - - -

  16. Ǽڵ  ǽɵ  Ž ʽϴ.  ؾ ϳ?

   ϰ ô  ǰ ü  Ǵ Ʒ Խù Ͽ м    ȳ ڿ ּҷ 

    Ǽڵ м û : http://cafe.naver.com/malzero/98809

- - - - - - - - - - - - - - - - - - - - -

  17. ͺ̽(DB)  Ǿٴ  ޽ ǥõ˴ϴ.  ؾ ϳ?

    ϴ ũƮ  , Ʒ ũ   Ʈ  ũƮ ޾ 

    Malware Zero Kit : http://cafe.naver.com/malzero/94376

- - - - - - - - - - - - - - - - - - - - -