文件: vorlnwj.exe
大小: 26924 字节
MD5: 71065A2BFE71723AE10845B8E84A7B9E
SHA1: AC1BA2976AC71CAB2041982BE6EE989882C118EF
CRC32: 26961330
加壳类型: NSpack
编写语言: Delphi
简单行为分析:
释放病毒副本:
%ProgramFiles%\Common Files\Microsoft Shared\gtkaqyu.inf
%ProgramFiles%\Common Files\Microsoft Shared\npehiyu.exe
%ProgramFiles%\Common Files\System\fpwiqhk.exe
%ProgramFiles%\Common Files\System\gtkaqyu.inf
%ProgramFiles%\meex.exe
%system32%\verclsids.exe
%system32%\sexit.dat
穷列盘符在各分区根目录上释放病毒文件:
?:\autorun.inf
?:\vorlnwj.exe
autorun.inf描述:
[AutoRun]
open=vorlnwj.exe
shell\open=打开(&O)
shell\open\Command=vorlnwj.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=vorlnwj.exe
删除文件:
C:\WINDOWS\system32\verclsid.exe
停止以下服务:
helpsvc (帮助与支持中心)
SharedAccess (Windows防火墙/Internet共享)
wscsvc (Windows安全中心)
wuauserv (Windows自动更新)
搜索注册表试图删除:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gtkaqyu
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vorlnwj
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KVMON
添加注册表启动项:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gtkaqyu: "%ProgramFiles%\Common Files\System\fpwiqhk.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vorlnwj: "%ProgramFiles%\Common Files\Microsoft Shared\npehiyu.exe"
修改注册表启用自动播放功能:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun: 0x00000091
修改注册表破坏隐藏受系统保护的文件:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Type: "checkbox2"
此处注:分析代码时发现对software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall\CheckedValue进行修改但实际运行时未发现该行为;
删除注册表破坏安全模式:
HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318};
修改注册表禁用以下服务:
HKLM\SYSTEM\ControlSet001\Services\helpsvc\Start: 0x00000004
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Start: 0x00000004
HKLM\SYSTEM\ControlSet001\Services\wscsvc\Start: 0x00000004
HKLM\SYSTEM\ControlSet001\Services\wuauserv\Start: 0x00000004
HKLM\SYSTEM\ControlSet001\Services\RSPPSYS\Start: 0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Start: 0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\helpsvc\Start: 0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\Start: 0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv\Start: 0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\RSPPSYS\Start: 0x00000004
调用cmd命令行"/c del 自身文件路径"反复删除原文件直到删除为止;
遍历进程试图结束并在HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\下创建键值映像劫持以下进程其Debugger值为 "%ProgramFiles%\Common Files\Microsoft Shared\npehiyu.exe":
360rpt.exe
360Safe.exe
360tray.exe
adam.exe
AgentSvr.exe
AppSvc32.exe
ArSwp.exe
AST.exe
autoruns.exe
AvastU3.exe
avconsol.exe
avgrssvc.exe
AvMonitor.exe
avp.com
avp.exe
CCenter.exe
ccSvcHst.exe
EGHOST.exe
FileDsty.exe
FTCleanerShell.exe
FYFireWall.exe
ghost.exe
HijackThis.exe
IceSword.exe
iparmo.exe
Iparmor.exe
irsetup.exe
isPwdSvc.exe
kabaload.exe
KaScrScn.SCR
KASMain.exe
KASTask.exe
KAV32.exe
KAVDX.exe
KAVPF.exe
KAVPFW.exe
KAVSetup.exe
KAVStart.exe
KISLnchr.exe
KMailMon.exe
KMFilter.exe
KPFW32.exe
KPFW32X.exe
KPfwSvc.exe
KRegEx.exe
KRepair.com
KsLoader.exe
KVCenter.kxp
KvDetect.exe
KvfwMcl.exe
KVMonXP.kxp
KVMonXP_1.kxp
kvol.exe
kvolself.exe
KvReport.kxp
KVScan.kxp
KVSrvXP.exe
KVStub.kxp
kvupload.exe
kvwsc.exe
KvXP.kxp
KvXP_1.kxp
KWatch.exe
KWatch9x.exe
KWatchX.exe
loaddll.exe
MagicSet.exe
mcconsol.exe
mmqczj.exe
mmsk.exe
Navapsvc.exe
Navapw32.exe
nod32.exe
nod32krn.exe
nod32kui.exe
NPFMntor.exe
PFW.exe
PFWLiveUpdate.exe
QHSET.exe
QQDoctor.exe
QQKav.exe
QQSC.exe
Ras.exe
Rav.exe
RavMon.exe
RavMonD.exe
RavStub.exe
RavTask.exe
RegClean.exe
rfwcfg.exe
rfwmain.exe
rfwsrv.exe
RsAgent.exe
Rsaupd.exe
rstrui.exe
runiep.exe
safelive.exe
scan32.exe
shcfg32.exe
SmartUp.exe
SREng.EXE
symlcsvc.exe
SysSafe.exe
TrojanDetector.exe
Trojanwall.exe
TrojDie.kxp
UIHost.exe
UmxAgent.exe
UmxAttachment.exe
UmxCfg.exe
UmxFwHlp.exe
UmxPol.exe
upiea.exe
UpLive.exe
USBCleaner.exe
vsstat.exe
webscanx.exe
WoptiClean.exe
zjb.exe
随机更改以下文件名:
%System32%\svchost.exe
%System32%\niu.exe
%System32%\sbl.dll
%System32%\wniapsvr.exe
%System32%\Shell.exe
%System32%\Shell.pci
%System32%\crsss.exe
%System32%\chost.exe
%System32%\dream.exe
%System32%\Tasks.exe
%System32%\forget.dll
%System32%\Systom.exe
%System32%\ctfm0n.exe
%System32%\NATIVE.EXE
%System32%\directx.exe
%System32%\progmon.exe
%System32%\internt.exe
%System32%\SoftDLL.dll
%System32%\MySetup.exe
%System32%\SocksA.exe
%System32%\algssl.exe
%System32%\plmmsbl.dll
%System32%\servver.exe
%System32%\chostbl.exe
%System32%\lovesbl.dll
%System32%\netdde .exe
%System32%\svrhost.dll
%System32%\wnipsvr.exe
%System32%\Session.exe
%System32%\algsrvs.exe
%System32%\msfun80.exe
%System32%\msime82.exe
%System32%\msime80.exe
%System32%\msfir80.exe
%System32%\fixfile.exe
%System32%\MicrSoft.exe
%System32%\WMDSINFO.dll
%System32%\Mcshie1d.exe
%System32%\Exp1orer.exe
%System32%\snowfall.exe
%System32%\compobj32.dll
%System32%\snownClean.exe
%System32%\Web\css.css
%System32%\Com\lsass.exe
%System32%\Com\smss.exe
%System32%\IME\svchost.exe
%windir%\Debug\Debug.exe
%System32%\Drivers\csrss.exe
查找标题中带以下字眼的窗口发送WM_QUIT消息关闭窗口:
江民
瑞星
毒霸
恶意软
流氓软
上报
QQ安全
举报
预警
进程
我的电脑
我的電腦
My Computer
System
Shared
x
上報
舉報
诊断
杀毒
2007
Sysint
meex
报警
AV终结
一键
木马
木馬
殺毒
360安全
查毒
病毒
USB
卡巴
:\ - WinRAR
Ghost
还原
Process
usb
清理助
fpwiqhk
npehiyu
专
杀
杀
av终结者
8749
木马专杀
icesword
编辑字符串
编辑 dword 值
并对WndClass为#32770的窗口发送WM_QUIT
其他行为:
联网下载以下文件并于%programfiles%内运行:
http://520sb.cn/ad/images/soft/WindowsXP-KB284301.pif
[url=http://520sb.cn/ad/images/soft/hosts.pif
http://520sb.cn/ad/images/soft/hosts.pif[/quote[/url]]
获取自身下载列表文本联网下载病毒木马,地址已失效:
http://www.webweb.com/TDown1.exe
[url=http://www.webweb.com/ReadDown.txt
]http://www.webweb.com/ReadDown.txt[/quote][/url]
在%programfiles%释放过文件副本:
1.hiv
2.hiv
3.hiv
4.hiv
运行时全部报错
有"set date=1980-01-23"即修改系统时间的行为实际运行时也未能发现成功;
判断各分区的文件系统,如果是NTFS则调用cacls命令行"cacls autorun.inf /t /g everyone:F"提升文件访问权限后删除并释放自身的文件,破坏免疫文件(夹);
两进程相互守护不断重复修改以上释放的文件和创建的注册表以免被删除:
%ProgramFiles%\Common Files\Microsoft Shared\npehiyu.exe
%ProgramFiles%\Common Files\System\fpwiqhk.exe
手工清理:
下载Wsyscheck;
重命名文件后运行,软件设置中勾选"禁止进程和文件创建"结束以下进程:
npehiyu.exe
fpwiqhk.exe
文件管理中删除文件:
%ProgramFiles%\Common Files\Microsoft Shared\gtkaqyu.inf
%ProgramFiles%\Common Files\Microsoft Shared\npehiyu.exe
%ProgramFiles%\Common Files\System\fpwiqhk.exe
%ProgramFiles%\Common Files\System\gtkaqyu.inf
%ProgramFiles%\meex.exe
%system32%\verclsids.exe
%system32%\sexit.dat
?:\autorun.inf
?:\vorlnwj.exe
拷贝一份正常的verclsid.exe文件粘贴到%system32%文件夹内;
注册表管理中删除注册表:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gtkaqyu
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vorlnwj
编辑注册表:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Type: "checkbox"
HKLM\SYSTEM\ControlSet001\Services\helpsvc\Start: 0x00000002
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Start: 0x00000002
HKLM\SYSTEM\ControlSet001\Services\wscsvc\Start: 0x00000002
HKLM\SYSTEM\ControlSet001\Services\wuauserv\Start: 0x00000002
HKLM\SYSTEM\ControlSet001\Services\RSPPSYS\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\helpsvc\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\RSPPSYS\Start: 0x00000002
建议编辑注册表:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun: 0x000000FF
(即禁止自动播放
工具-修复安全模式;
修复IFEO映像劫持(工具有很多);
视个人使用情况决定启用或是保持禁止以下服务:
helpsvc (帮助与支持中心)
SharedAccess (Windows防火墙/Internet共享)
wscsvc (Windows安全中心)
wuauserv (Windows自动更新)
注：%System32%是一个可变路径。病毒通过查询操作系统来决定当前System文件夹的位置。
%Windir% WINDODWS所在目录
%DriveLetter% 逻辑驱动器根目录
%ProgramFiles% 系统程序默认安装目录
%HomeDrive% 当前启动的系统的所在分区
%Documents and Settings% 当前用户文档根目录
%Temp% \Documents and Settings
\当前用户\Local Settings\Temp
%System32% 系统的 System32文件夹
Windows2000/NT中默认的安装路径是C:\Winnt\System32
windows95/98/me中默认的安装路径是C:\Windows\System
windowsXP中默认的安装路径是C:\Windows\System32
用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; MAXTHON 2.0)
