Backdoor.Pcclient是一种于2004年7月9日发现的木马病毒，可以感染Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP等操作系统，被感染后会有记录键盘鼠标操作，自动重启，下载文件，强行关机等行为

Backdoor.Pcclient 病毒剖析

该病毒最初发现日期：2004年7月9日。

病毒类型：木马病毒。

可以被感染的操作系统: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Backdoor.Pcclient 病毒文件被运行后会有如下行为:

1. 在system32目录下创建一个dll文件.

注释:

· 通过监测, 该病毒在system32目录下创建的文件名是smss.dll

· 并将下列参数值添加到注册表启动项:

"PcClient" = "[path to Trojan]"

HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run

2. 该木马病毒会尝试以随机的端口以http应用层协议连接预先定义好的网站, 并将被感染机器的用户名, CPU型号, 计算机名等信息发送到连接的主机. 已知的连接网站有:

· saap.meibu.com

· ps7.meibu.com

· net918.dns0755.net

· xjtomb.20cn.com

3. 该木马病毒可以有下列行为:

· 注销当前帐户, 强行关机, 重新启动你的计算机, 下载和运行更多的文件,

· 记录键盘鼠标 行为.

实例公布:

UC2008beta2绿色显IP显隐身版被Norton查出有Backdoor Pcclient 病毒. 经过多方及本人的专业手段测试, 这是对UC插件ucplugin.dll内嵌显隐身技术地封杀. ucplugin.dll动态库文件为uc.exe文件工作模块, 没有任何上述后门木马病毒的行为. uc玩家尽可放心使用 ”uc2008beta2绿色显IP显隐身去聊天室限制版本”.

以下为Norton公司的安全建议. 非常实用, 供有一定专业英语基础的读者自行翻译阅读:

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

· Use a firewall to block all incoming connections from the Internet to services that should not be publicly available. By default, you should deny all incoming connections and only allow services you explicitly want to offer to the outside world.

· Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.

· Ensure that programs and users of the computer use the lowest level of privileges necessary to complete a task. When prompted for a root or UAC password, ensure that the program asking for administration-level access is a legitimate application.

· Disable AutoPlay to prevent the automatic launching of executable files on network and removable drives, and disconnect the drives when not required. If write access is not required, enable read-only mode if the option is available.

· Turn off file sharing if not needed. If file sharing is required, use ACLs and password protection to limit access. Disable anonymous access to shared folders. Grant access only to user accounts with strong passwords to folders that must be shared.

· Turn off and remove unnecessary services. By default, many operating systems install auxiliary services that are not critical. These services are avenues of attack. If they are removed, threats have less avenues of attack.

· If a threat exploits one or more network services, disable, or block access to, those services until a patch is applied.

· Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.

· Configure your email server to block or remove email that contains file attachments that are commonly used to spread threats, such as .vbs, .bat, .exe, .pif and .scr files.

· Isolate compromised computers quickly to prevent threats from spreading further. Perform a forensic analysis and restore the computers using trusted media.

· Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

· If Bluetooth is not required for mobile devices, it should be turned off. If you require its use, ensure that the device's visibility is set to "Hidden" so that it cannot be scanned by other Bluetooth devices. If device pairing must be used, ensure that all devices are set to "Unauthorized", requiring authorization for each connection request. Do not accept applications that are unsigned or sent from unknown sources.

· For further information in this document, please refer to the Security Response glossary.

· Reference: http://www.symantec.com/business/security_response/glossary.jsp