|
kernel32.dll (5.1.2600.1106)
소프트웨어안에 포함하는 |
|---|
| 이름: | Windows XP Home Edition, Deutsch |
|---|
| 면허: | 상업 |
|---|
| 정보 연결: | http://www.microsoft.com/windowsxp/ |
|---|
파일 세부사항 |
|---|
| 파일 경로: | C:\WINDOWS\system32 \ kernel32.dll |
|---|
| 파일 날짜: | 2002-08-29 14:00:00 |
|---|
| 버전: | 5.1.2600.1106 |
|---|
| 파일 사이즈: | 1.004.032 바이트 |
|---|
검사함과 파일은 잘게 썬다 |
|---|
| CRC32: | ADF5064D |
|---|
| MD5: | 6F07 A474 9244 4D38 A6D2 3D56 BC9F 1CF7 |
|---|
| SHA1: | B72A D610 AEF6 FA8E 88E1 6D76 A0AE 2EE6 2665 B3BA |
|---|
버전 자원 정보 |
|---|
| 회사명: | Microsoft Corporation |
|---|
| 파일 설명: | Client-DLL fr Windows NT-Basis-API |
|---|
| 파일 운영 체계: | Windows NT, Windows 2000, Windows XP, Windows 2003 |
|---|
| 파일 유형: | Dynamic Link Library (DLL) |
|---|
| 파일 버전: | 5.1.2600.1106 |
|---|
| 내부 이름: | kernel32 |
|---|
| 법적인 저작권: | Microsoft Corporation. Alle Rechte vorbehalten. |
|---|
| 원래 파일 이름: | kernel32 |
|---|
| 제품 이름: | Betriebssystem Microsoft Windows |
|---|
| 제품 버전: | 5.1.2600.1106 |
|---|
kernel32.dll은 뒤에 오는 보고안에 발견되었다:
|
|
|---|
W32.Music.A.Worm |
|---|
W32.Music.A.Worm에 관하여
...specific Win32 API that is only available in Windows 95 and Windows 98 versions of Kernel32.dll. Type: Worm...
기술적 세부사항
...specific Win32 API that is only available in Windows 95 and Windows 98 versions of Kernel32.dll. W32.Music.A.Worm has two components:...
근원: http://securityresponse.symantec.com/avcenter/venc/data/w32.music.a.worm.html |
|---|
W32.Music.E.Worm |
|---|
W32.Music.A.Worm에 관하여
...specific Win32 API that is only available in Windows 95 and Windows 98 versions of Kernel32.dll. Type: Worm...
근원: http://securityresponse.symantec.com/avcenter/venc/data/w32.music.e.worm.html |
|---|
W32.Demiurg.16354 |
|---|
위협 평가
...Infects various files on system: *.com *.exe *.bat *.xls and kernel32.dll Distribution...
...Excel files and *.bat files. Also infects the Kernel32.dll. ...
기술적 세부사항
...The virus copies the WindowsSystemKernel32.dll file to the Windows folder....
...NOTES: In Windows 95/98/Me, the Kernel32.dll file in the WindowsSystem folder remains unchanged; however, Windows will...
...In Windows 2000, the virus moves the infected copy of Kernel32.dll from the Windows folder to the WindowsSystem folder after you restart the...
...computer. The original Kernel32.dll file is overwritten. In Windows NT, the infected...
근원: http://securityresponse.symantec.com/avcenter/venc/data/w32.demiurg.16354.html |
|---|
W32.Crypto |
|---|
W32.Music.A.Worm에 관하여
...The virus first infects the operating system file KERNEL32.DLL. Once infected, KERNEL32.DLL...
기술적 세부사항
...When an infected file is executed, the virus infects KERNEL32.DLL in the Windows directory....
...It is interesting to note that the virus is not encrypted in the KERNEL32.DLL file, and its logic can be seen with any common viewing tools....
...In order to cause the infected KERNEL32 file to be used by the Windows operating system, the virus creates a wininit.ini...
...This wininit.ini file instructs Windows to use the infected KERNEL32.DLL file the next time the machine is rebooted....
근원: http://securityresponse.symantec.com/avcenter/venc/data/w32.crypto.html |
|---|
W32.HLLW.Apart |
|---|
기술적 세부사항
...It copies itself as the file %system%Kernel32.dll<appended 0xA0 character>....
....dll file extension, should not be confused with the legitimate Windows system file Kernel32.dll. In certain language versions...
...Kernel %system%Kernel32.dll<appended 0xA0 character>....
제거 지시
...Windows NT/2000/XP: Stop the Kernel32.dll process that is running. Run a full system scan, and...
...Windows NT/2000/XP To stop the Kernel32.dll process: Press Ctrl+Alt+Delete one...
...Scroll through the list, and look for Kernel32.dll. If you find the file, click...
...Kernel %system%Kernel32.dll<appended 0xA0 character>....
근원: http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.apart.html |
|---|
W95.Paddi |
|---|
기술적 세부사항
...First, the virus will find a certain byte in Kernel32.dll in memory. The memory address of Kernel32.dll...
...that the virus is searching for is located close to the GetProcAddress function in Kernel32.dll. Once the virus find this byte,...
...As the virus now has the address for GetProcAddress, as well as the address of Kernel32.dll in memory, it can now import functions from Kernel32.dll....
...The virus imports several functions from Kernel32.dll and saves the addresses to these functions so that it can use them later....
근원: http://securityresponse.symantec.com/avcenter/venc/data/w95.paddi.html |
|---|
W95.LoRez |
|---|
기술적 세부사항
...The W95.LoRez virus modifies the Kernel32.dll file and saves it in the Windows folder....
제거 지시
...Restart the computer using a Windows 98 Startup disk, and then replace the Kernel32.dll file with a copy extracted from the installation files. (Windows 95/98 users only....
...Me will, by default, prevent outside programs from altering system files such as Kernel32.dll. If you are running Windows...
...Disk, and follow the prompts. To replace the Kernel32.dll file: This is necessary because...
...Me will, by default, prevent outside programs from altering system files, such as Kernel32.dll. If you are running Windows...
...If you are sure that this is the case, then see the section To extract the Kernel32.dll file if the installation files are located on the hard disk....
...assistance with Microsoft products. To extract the Kernel32.dll file if the installation files are located on the hard disk:...
...not on the hard disk, in which case you should skip to the section To extract the Kernel32.dll file if the installation files are located on the installation CD....
...following command and press Enter. extract /a win98_43.cab kernel32.dll /L c:windowssystem If you are running Windows...
...following command and press Enter. extract /a win95_11.cab kernel32.dll /L c:windowssystem If you do not see any error...
...finished extracting the file. To extract the Kernel32.dll file if the installation files are located on the installation CD....
...following command and press Enter. extract /a win98_43.cab kernel32.dll /L c:windowssystem If you are running Windows...
...commands and press Enter. extract /a win95_11.cab kernel32.dll /L c:windowssystem If you do not see any error...
근원: http://securityresponse.symantec.com/avcenter/venc/data/w95.lorez.html |
|---|
JS.Rootlet.A@m |
|---|
기술적 세부사항
...folder as the following files: Kernel32.dll.js Mapi32.dll.js...
...kernel WindowsSystemKernel32.dll.js to the registry key...
제거 지시
...kernel WindowsSystemKernel32.dll.js Exit the Registry Editor....
근원: http://securityresponse.symantec.com/avcenter/venc/data/js.rootlet.a@m.html |
|---|
W32.Fully.3424 |
|---|
기술적 세부사항
...When W32.Fully.3424 is executed, it looks for Kernel32.dll in memory. Once the base for Kernel32.dll...
...The search for functions in Kernel32.dll proceeds as follows: Find the list of function...
근원: http://securityresponse.symantec.com/avcenter/venc/data/w32.fully.3424.html |
|---|
W32.Golsys.8020 |
|---|
기술적 세부사항
...First, it needs to import several functions from the file Kernel32.dll. Therefore, the virus begins...
...its malicious actions by attempting to find the base (the start of the file) of Kernel32.dll in memory. After it finds the base, it...
...is allocated in 4 KB pages. It then attempts to load Kernel32.dll into its own memory space by using the LoadLibrary function from Kernel32.dll....
...Next, the virus imports a long list of functions from Kernel32.dll. It stores the addresses of...
......
근원: http://securityresponse.symantec.com/avcenter/venc/data/w32.golsys.8020.html |
|---|
|
|
![[filename.info logo]](/img/logo.png){kind=logo}
![[cn kernel32.dll]](/img/nix.gif){kind=small}
