https://www.botnets.fr/index.php?action=history&feed=atom&title=MSRT_March_2012%3A_breaking_bad 2026-10-24T08:13:11Z Revision history for this page on the wiki MediaWiki 1.43.11 https://www.botnets.fr/index.php?title=MSRT_March_2012:_breaking_bad&diff=5721&oldid=prev 2015-08-05T19:50:14Z

<p>Text replacement - &quot; blogs.technet.com&quot; to &quot;&quot;</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 19:50, 5 August 2015</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l5">Line 5:</td> <td colspan="2" class="diff-lineno">Line 5:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Licence=</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Licence=</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Video=</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Video=</div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>|Link=http://blogs.technet.com/b/mmpc/archive/2012/03/13/msrt-march-2012-breaking-bad.aspx <del style="font-weight: bold; text-decoration: none;">blogs.technet.com</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>|Link=http://blogs.technet.com/b/mmpc/archive/2012/03/13/msrt-march-2012-breaking-bad.aspx</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Author=Rex Plantado,  </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Author=Rex Plantado,  </div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|NomRevue=Technet Blogs: Microsoft Malware Protection Center  </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|NomRevue=Technet Blogs: Microsoft Malware Protection Center  </div></td></tr> <!-- diff cache key wiki:diff:1.41:old-2075:rev-5721:php=table --> </table>

Eric.freyssinet https://www.botnets.fr/index.php?title=MSRT_March_2012:_breaking_bad&diff=2075&oldid=prev 2015-02-07T14:23:48Z

<p>1 revision imported</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:23, 7 February 2015</td> </tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div> </td></tr> <!-- diff cache key wiki:diff:1.41:old-2074:rev-2075 --> </table>

Eric.freyssinet https://www.botnets.fr/index.php?title=MSRT_March_2012:_breaking_bad&diff=2074&oldid=prev 2012-03-13T19:31:39Z

<p>a déplacé <a href="/index.php?title=MSRT_March_2012:_Breaking_bad&amp;action=edit&amp;redlink=1" class="new" title="MSRT March 2012: Breaking bad (page does not exist)">MSRT March 2012: Breaking bad</a> vers <a href="/wiki/MSRT_March_2012:_breaking_bad" title="MSRT March 2012: breaking bad">MSRT March 2012: breaking bad</a></p> <p><b>New page</b></p><div>{{Publication<br /> |Image=MSRT March 2012.png<br /> |Legend=<br /> |Document=<br /> |Licence=<br /> |Video=<br /> |Link=http://blogs.technet.com/b/mmpc/archive/2012/03/13/msrt-march-2012-breaking-bad.aspx blogs.technet.com<br /> |Author=Rex Plantado, <br /> |NomRevue=Technet Blogs: Microsoft Malware Protection Center <br /> |Date=13 Mar 2012 <br /> |Editor=Microsoft<br /> |Year=2012<br /> |ISBN=<br /> |Page=<br /> |Abstract=This month, the MMPC added Win32/Dorkbot to the Microsoft Malicious Software Removal Tool along with detections for the threats Win32/Hioles, Win32/Pluzoks and Win32/Yeltminky.<br /> <br /> Win32/Dorkbot is described as an IRC-based botnet and a worm, a backdoor with rootkit capability and a password stealer. Despite using a very simple IRC protocol to communicate with the command and control (C&amp;C) server, it was able to build a substantial installation base after a couple of years in operation. Some might compare Win32/Dorkbot with the infamous Win32/EyeStye due to some similarities in their behavior and advanced features.<br /> <br /> Dorkbot implements an advanced user-level rootkit that is very similar to the hooking technique used by EyeStye. The hooking is used to hide its registry and file components from users that are not using rootkit detection software. Both threats appear to have a dedicated development team and both threats can also steal users credentials, which may include personal and banking information, via a form grabbing technique.<br /> <br /> For an attacker, the Dorkbot malware is simpler to configure and control, less aggressive and less expensive to own than EyeStye. It also strictly uses the IRC protocol, while EyeStye is a complex botnet with a changeable communication protocol, from P2P, UDP to a custom protocol.<br /> |Botnet=Dorkbot, <br /> |Malware=Hioles, Pluzoks, Yeltminky, EyeStye, Dorkbot_(bot), <br /> |CCProtocol=, <br /> |Operation=, <br /> |Keyword=, <br /> }}</div>

Eric.freyssinet