TROJ_VUNDO.EJZ(yayyAsPJ.dll)病毒手动解决

文件名称:yayyAsPJ.dll

文件大小:33,792 bytes

AV命名:TROJ_VUNDO.EJZ

加壳方式:UPX

文件MD5:AC58E584C8B8BCC90EA3B031BB625853

病毒类型:广告程序

主要行为:

1、释放文件:

C:\Windows\System32\yayyAsPJ.dll 25,600 bytes

2、添加注册表:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13F20E4F-F379-41EA-8F80-CCAAE787362A}\InprocServer32]
(Default) = "%System%\yayyAsPJ.dll"
ThreadingModel = "Both"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Settings]
Time = F0 71 A3 1F 83 51 C8 01 00 00 00 00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{13F20E4F-F379-41EA-8F80-CCAAE787362A} = ""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yayyAsPJ]
Asynchronous = 0x00000001
DllName = "yayyAsPJ.dll"
Impersonate = 0x00000000
Logon = "o"
Logoff = "f"

开机注入Explorer.exe和Winlogon.exe启动。

3、开启网络线程在后台刷网页流量。

4、yayyAsPJ.dll安装全局钩子,监视鼠标操作。

5、最后释放批处理removalfile.bat,删除原来的载体


解决方法:

1、删除启动项:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13F20E4F-F379-41EA-8F80-CCAAE787362A}\InprocServer32]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yayyAsPJ]

2、删除文件:

C:\Windows\System32\yayyAsPJ.dll 25,600 bytes

3、升级杀毒软件,全盘扫描,并清空临时文件夹。

用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; CNCDialer; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; TheWorld)