Malware Zero Kit

Virus Zero Season 2 : cafe.naver.com/malzero

Batch Script : ViOLeT (archguru)

http://cafe.naver.com/malzero/94376
http://naver.me/5ctaTplR

! ///
/
! ( )

- - - - - - - - - - - - - - - - - - - - -

f 01. Malware Zero Kit

?

5 <6. >

- - - - - - - - - - - - - - - - - - - - -

f 02. 7

. (
)

A. x

; d8 f f f
; y

f , ; ;
8 ( )
' ;

B. =

, 5
unhookexec.inf ; 8

, PC
= ;

C. = (
v)

x f f
5 unlock.reg ;

f , ; Virut
Parite 8 f();
d ( f )

D. Oops, Unsupported Korean Language !

Control Panel Region and Language Administrative Language for

non-Unicode programs Change system locale Korean (Korea)

X. 7 (10 )

f

- - - - - - - - - - - - - - - - - - - - -

f 03. ~ d a
f 4.

5 unlock.reg / ,
; 1

Kaspersky TDSSKiller :
http://media.kaspersky.com/utilities/VirusUtilities/EN/tdsskiller.exe
AhnLab V3 OnlineGameHack Kill :
http://download.ahnlab.com/vaccine/gamehackkill.exe

'd ; ; 4.' ~ Cidox

8 Kaspersky TDSSKiller

- - - - - - - - - - - - - - - - - - - - -

f 04. w : 8 f 4.

?

f ; ,
()

f f() f
f / f

f , (REGEDIT)
f

(REGEDIT) f
w; y f

PsExec : https://technet.microsoft.com/ko-kr/bb897553

w( ) ;
(REGEDIT) f
(f d Everyone d
f)

PsExec -i -d -s regedit.exe

- - - - - - - - - - - - - - - - - - - - -

f 05. f , d
. ?

(: C:\Quarantine_MZK)

: vz f ,
; ( )
reg ; d

Files , Folders , Registrys

x

, mzkhelp@gmail.com ;


- - - - - - - - - - - - - - - - - - - - -

; 4 .
f 06. ?

[ Windows Vista, 7 ]
Windows 1 :
F8 4

[ Windows 8 ]
d(: ) + I ) PC d
f
d

[ Windows 10 ]
d(: ) + I )
f d

- - - - - - - - - - - - - - - - - - - - -

f 07. 4 . (
; )

( WSHTCPIP.DLL) WINSOCK, TCP/IP, DHCP

DNS v ,

v
8 Windows (CD/DVD) ,
w(CMD) 8 = SFC /SCANNOW
, <f 12>

(Deep Slip)
8,
d ' ' '; '
=' ; f

1) 'DNS' d;

A. 'f' ' ' ' / '

( NCPA.CPL )
' '' '( ) '
B. '
(: )=
C. ( ) ''
''
D. '' 'Internet Protocol Version 4 (TCP/IPv4)'
''
E. '' DNS d; '8 DNS
' '= DNS '

* '= DNS ' IP

( 8
, DNS
DNS )

KT Olleh = DNS : 168.126.63.1, v DNS : 168.126.63.2

SK Broadband = DNS : 210.220.163.82, v DNS : 219.250.36.130
LG U+ #1 = DNS : 164.124.101.2, v DNS : 203.248.252.2
 LG U+ #2 = DNS : 164.124.107.9, v DNS : 203.248.252.2
LG U+ #3 = DNS : 61.41.153.2, v DNS : 1.214.68.2
Google = DNS : 8.8.8.8, v DNS : 8.8.4.4

F. ''

2) 'f' ' ' ' / '

'f ; 'a

3) / , / ;
/

4) ' ;

IPCONFIG /REGISTERDNS
IPCONFIG /FLUSHDNS
IPCONFIG /RELEASE
IPCONFIG /RENEW

5) 4 ;

NETSH WINSOCK RESET

6) 5 ;

(x TCP/IP d; 8 d; IP, DNS
d d =)

NETSH INT IP RESET C:\LOG.TXT

7) ; 8 , '';
= ''

Windows System32 NSISVC.DLL

Windows System32 wbem WMISVC.DLL

SYSTEM, Administrators, Users ' '

'' d : ;
''8 d

8) 7 ; ,
' ' d

A. 'f' ' ' ' / '

B. '' ' ' (:

=)
C. '' ''
D. '' ''

E. '' ' ' ;

1> ; Gbps /100Mbps /10Mbps >
( : )
F. '' ;
 5 ; <f 08> ;

8 ; ,
f a8

- - - - - - - - - - - - - - - - - - - - -

f 08. ' / '

; v

1) (Deep Slip) f

A. 'f' ' '

B. ' ' 8

C. ''
D. ' '
E. '; ' ='
f
F. d

2) w(CMD) 8

REGSVR32 NETSHELL.DLL
REGSVR32 NETCFGX.DLL
REGSVR32 NETMAN.DLL

3) f ; , 8 '
' (f
8 d)

A. 'f' ' '

B. ' ' 3
8
C. ' '
'
D. '
E. ' b '
F. '='

G. d

- - - - - - - - - - - - - - - - - - - - -

f 09. " w
d4." .

5 unlock.reg /

- - - - - - - - - - - - - - - - - - - - -

f 10. " ~ " 7 .

- - - - - - - - - - - - - - - - - - - - -

f 11. 4
 .
?

f
;

(Adobe Flash Player)

f 8, f

- - - - - - - - - - - - - - - - - - - - -

f 12. x ' '

?
4.

1) x ; (DLL )

http://ko.dll-files.com
http://www.dlldownloader.com

' ; 8 , f
8 Windows System32 SysWOW64
(System32 : SysWOW64 : d )

32bit f : System32 (32bit)

64bit f : System32 (64bit), SysWOW64 (32bit)

2) ' ' ;

f ' '
8, (https://www.virustotal.com)
;

d( )8 ,
y ; SHA-256 ;
mzkhelp@gmail.com
y
y ( =)

8 d A B ;

A. DLL ( 8 );
(1 ' (, v : )
B. EXE (Virut Parite );
http://cafe.naver.com/malzero/94118 ;

- - - - - - - - - - - - - - - - - - - - -

f 13. /f d8 7s4.

7
, 7 f

1) w(CMD) 8
2) CHKDSK (! )
3) 7 , CHKDSK /F ( d /F /R
)
4) '= ;
4?' Y
5) (f , )
 7 8,

~ 20

- - - - - - - - - - - - - - - - - - - - -

f 14. " ; =(4)" 7

.
?

5 unlock.reg /

; Windows System32
x CMD.EXE( w) x ,
x ; f d ;

- - - - - - - - - - - - - - - - - - - - -

f 15. fa; x?

Microsoft : http://windows.microsoft.com/ko-
kr/windows/support

- - - - - - - - - - - - - - - - - - - - -

f 16. 4 .
?

f ;

: http://naver.me/xd5XBA00

- - - - - - - - - - - - - - - - - - - - -

f 17. (DB) 7
.

x f ,
y

Malware Zero Kit : http://naver.me/5ctaTplR

- - - - - - - - - - - - - - - - - - - - -