样本来源：
http://bbs.kingzoo.com/viewthread.php?tid=19791&pid=131280&page=1&extra=page%3D1#pid131280文件: 00BAF3985A56E6F0089BEF39ABCA0C6C.exe
大小: 15965 字节
MD5: 00BAF3985A56E6F0089BEF39ABCA0C6C
SHA1: 2938A2DE09B862952D5AA8EA6DEB25CF9FC2761E
CRC32: 11F9B157
加壳类型: Upack
编写语言: 不详
简单行为分析:
释放病毒副本:
%system32%\drivers\HBKernel32.sys
%system32%\HBFY.dll
%system32%\System.exe
%temp%\HBSelfDel.dll
加载文件HBKernel32.sys安装驱动程序恢复SSDT:
HKLM\SYSTEM\CurrentControlSet\Services\HBKernel32: "%system32%\drivers\HBKernel32.sys";
添加注册表启动项:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HBService32: "System.exe";
修改注册表HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs项的值为:
"HBmhly.dll,HB1000Y.dll,HBWOOOL.dll,HBXY2.dll,HBJXSJ.dll,HBSO2.dll,HBFS2.dll,HBXY3.dll,HBSHQ.dll,HBFY.dll,HBWULIN2.dll,HBW2I.dll,HBKDXY.dll,HBWORLD2.dll,HBASKTAO.dll,HBZHUXIAN.dll,HBWOW.dll,HBZERO.dll,HBBO.dll,HBCONQUER.dll,HBSOUL.dll,HBCHIBI.dll,HBDNF.dll,HBWARLORDS.dll,HBTL.dll,HBPICKCHINA.dll,HBCT.dll,HBGC.dll,HBHM.dll,HBHX2.dll,HBQQHX.dll,HBTW2.dll,HBQQSG.dll,HBQQFFO.dll,HBZT.dll,HBMIR2.dll,HBRXJH.dll,HBYY.dll,HBMXD.dll,HBSQ.dll,HBTJ.dll,HBFHZL.dll,HBWLQX.dll,HBLYFX.dll,HBR2.dll,HBCHD.dll,HBTZ.dll,HBQQXX.dll,HBWD.dll,HBZG.dll,HBPPBL.dll,HBXMJ.dll,HBJTLQ.dll,HBQJSJ.dll";
创建注册表:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations: "%system32%\explore.exe";
文件HBFY.dll设置全局挂勾插入所有进程,挂勾函数"WH_MOUSE(监控鼠标)";
调用rundll32.exe命令行"rundll32.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HBSelfDel.dll,MagicDelete 具体样本路径\hb.exe"删除文件及自身;
清理方法:
下载Wsyscheck;
软件设置中选中"禁止进程与文件创建";
找到system.exe进程,全局卸载模块%system32%\HBFY.dll后结束该进程;
在文件管理中找到以下文件右键"发送到重起删除文件列表":
%system32%\drivers\HBKernel32.sys
%system32%\HBFY.dll
%system32%\System.exe
安全检查-重起删除文件-执行重起删除;
重起后修复安装杀毒软件;
删除注册表
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HBService32
HKLM\SYSTEM\CurrentControlSet\Services\HBKernel32
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations;
编辑注册表:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs的值为空(即删除值栏里的所有数据);
注：%System32%是一个可变路径。病毒通过查询操作系统来决定当前System文件夹的位置。
%Windir% WINDODWS所在目录
%DriveLetter% 逻辑驱动器根目录
%ProgramFiles% 系统程序默认安装目录
%HomeDrive% 当前启动的系统的所在分区
%Documents and Settings% 当前用户文档根目录
%Temp% \Documents and Settings
\当前用户\Local Settings\Temp
%System32% 系统的 System32文件夹
Windows2000/NT中默认的安装路径是C:\Winnt\System32
windows95/98/me中默认的安装路径是C:\Windows\System
windowsXP中默认的安装路径是C:\Windows\System32
用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; MAXTHON 2.0)
