随机8位数病毒新变种Worm.Pabug.db的分析与查杀 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛随机8位数病毒新变种Worm.Pabug.db的分析与查杀

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

随机8位数病毒新变种Worm.Pabug.db的分析与查杀

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-06-08 17:48 \| 只看楼主短消息资料字号：小中大 1楼随机8位数病毒新变种Worm.Pabug.db的分析与查杀以下情况是本人测试所得，如需转帖，请注明作者（清新阳光）和出处 http://hi.baidu.com/newcenturysun/modify/blog/3f7b424e42983908b3de0596谢谢今天收到了随机8位数病毒的新版本（528版本）测试了一下发现对比先前的版本有一些变化原来写过分析在http://hi.baidu.com/newcenturysun/blog/item/2ad3d7cedcea3c0292457e2c.html 病毒主要特征 1.破坏安全模式 2.结束常见杀毒软件以及反病毒工具进程 3.监控窗口 4.关闭自动更新，Windows安全中心，Windows防火墙以及常见杀毒软件的服务 5.屏蔽显示隐藏文件 6.下载木马 7.IFEO映像劫持分析报告 File为C5E46F76.exe Size为36435 bytes MD5为E32966B40D3E655F1912B2CD6930B24B SHA1为1ECE8B7EA4706DF8AA871F0C43E16CBFB6E672FB CRC32为DC232B41 病毒运行后在C:\Program Files\Common Files\Microsoft Shared\MSInfo\下面释放一个同样由8个数字和字母组成的组合的文件名的dll 和一个同名的dat 文件我这里是C:\Program Files\Common Files\Microsoft Shared\MSInfo\41115BDD.dll PS为发现病毒的每次更新时文件大小不变而MD5等值会变在C:\WINDOWS\Help\下面生成一个同样由8个数字和字母组成的组合的文件名的chm文件在C:\WINDOWS\下面生成一个同样由8个数字和字母组成的组合的文件名的hlp文件把C:\WINDOWS\system32\verclsid.exe重命名为verclsid.exe.bak然后删除C:\WINDOWS\system32\verclsid.exe 生成C:\WINDOWS\system32\DirectX\DirectX.ini里面是3个数字表明现在的主程序（随机8位数病毒）的版本在除系统分区以外的其他分区释放一个autorun.inf和随机7位字母的exe文件且右键菜单无变化监视并关闭以下进程以及窗口 AntiVirus TrojanFirewall Kaspersky JiangMin KV200 kxp Rising RAV RFW KAV200 KAV6 McAfe Network Associates TrustPort NortonSymantec SYMANT~1 Norton SystemWorks ESET Grisoft F-Pro Alwil Software ALWILS~1 F-Secure ArcaBit Softwin ClamWin DrWe Fortineanda Software Vba3 Trend Micro QUICKH~1 TRENDM~1 Quick Heal eSafewido Prevx1 ers avg Ikarus SophoSunbeltPC-cilli ZoneAlar Agnitum WinAntiVirus AhnLab Normasurfsecret Bullguard\Blac 360safe SkyNet Micropoint Iparmor ftc mmjk2007 Antiy Labs LinDirMicro Lab Filseclab ast System Safety Monitor ProcessGuard FengYun Lavasoft NOD3 mmsk The Cleaner Defendio kis6Beheadsreng IceSword HijackThis killbox procexp Magicset EQSysSecureProSecurity Yahoo! Google baidu P4P Sogou PXP ardsys 超级兔子木马 KSysFiltsys KSysCallsys AVK K7 Zondex blcorp Tiny Firewall Pro Jetico HAURI CA kmx PCClear_Plus Novatix Ashampoo WinPatrol Spy Cleaner Gold CounterSpy EagleEyeOS Webroot BufferZ avp AgentSvr CCenter Rav RavMonD RavStub RavTask rfwcfg rfwsrv RsAgent Rsaupd runiep SmartUp FileDsty RegClean 360tray 360Safe 360rpt kabaload safelive Ras KASMain KASTask KAV32 KAVDX KAVStart KISLnchr KMailMon KMFilter KPFW32 KPFW32X KPFWSvc KWatch9x KWatch KWatchX TrojanDetector UpLive.EXE KVSrvXP KvDetect KRegEx kvol kvolself kvupload kvwsc UIHost IceSword iparmo mmsk adam MagicSet PFWLiveUpdate SREng WoptiClean scan32 hcfg32 mcconsol HijackThis mmqczj Trojanwall FTCleanerShell loaddll rfwProxy KsLoader KvfwMcl autoruns AppSvc32 ccSvcHst isPwdSvc symlcsvcnod32kui avgrssvc RfwMain KAVPFW Iparmor nod32krn PFW RavMon KAVSetup NAVSetup SysSafe QHSET zxsweep. AvMonitor UmxCfg UmxFwHlp UmxPol UmxAgent UmxAttachment KPFW32 KPFW32X KvXP_1 KVMonXP_1 KvReport KVScan KVStub KvXP KVMonXP KVCenter TrojDie avp.com. krepair.COM KaScrScn.SCR Trojan Virus kaspersky jiangmin rising ikaka duba kingsoft 360safe 木马木馬病毒杀毒殺毒查毒防毒反病毒专杀專殺卡巴斯基江民瑞星卡卡社区金山毒霸毒霸金山社区 360安全恶意软件流氓软件举报报警杀软殺軟防駭 2007-06-08 18:20:33
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	分享到：

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-06-08 17:50 \| 只看楼主短消息资料字号：小中大 2楼注册表相关操作删除 HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} 破坏安全模式修改 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue值为0x00000000 HKU\S-1-5-21-1085031214-1078145449-839522115-500 \Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden为0x00000002 HKU\S-1-5-21-1085031214-1078145449-839522115-500 \Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SuperHidden为0x00000001 屏蔽显示隐藏文件修改 HKLM\SYSTEM\ControlSet001\Services\HookUrl\Start为0x00000004 HKLM\SYSTEM\ControlSet001\Services\mProcRs\Start为0x00000004 HKLM\SYSTEM\ControlSet001\Services\RfwProxySrv\Start为0x00000004 HKLM\SYSTEM\ControlSet001\Services\RfwService\StartHKLM\SYSTEM\ControlSet001\Services\HookUrl\Start为0x00000004 HKLM\SYSTEM\ControlSet001\Services\RsFwDrv\Start为0x00000004 HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Start为0x00000004 HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Epoch\Epoch为0x0000008B HKLM\SYSTEM\ControlSet001\Services\wscsvc\Start为0x00000004 HKLM\SYSTEM\ControlSet001\Services\wuauserv\Start为0x00000004 HKLM\SYSTEM\ControlSet002\Services\HookUrl\Start为0x00000004 HKLM\SYSTEM\ControlSet002\Services\mProcRs\Start为0x00000004 HKLM\SYSTEM\ControlSet002\Services\RfwProxySrv\Start为0x00000004 HKLM\SYSTEM\ControlSet002\Services\RsFwDrv\Start为 0x00000004 破坏常见杀毒软件以及windows安全中心 windows防火墙 windows自动更新添加IFEO映像劫持项 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krepair.COM HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.EXE.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zxsweep.exe 指向C:\Program Files\Common Files\Microsoft Shared\MSInfo\下的那个dat文件
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-06-08 17:51 \| 只看楼主短消息资料字号：小中大 3楼控制IE连接网络下载http://google.171738.org/update2.exe到临时文件夹命名为dl1.exe 他实际上是下面的木马的下载器下载 http://head.xxxxhtml.biz/update/wow.exe http://head.xxxxhtml.biz/update/mh.exe http://head.xxxxhtml.biz/update/wm.exe http://head.xxxxhtml.biz/update/my.exe http://head.xxxxhtml.biz/update/wl.exe http://head.xxxxhtml.biz/update/zt.exe http://head.xxxxhtml.biz/update/jh.exe http://head.xxxxhtml.biz/update/tl.exe http://head.xxxxhtml.biz/update/1.exe http://head.xxxxhtml.biz/update/2.exe http://head.xxxxhtml.biz/update/3.exe http://head.xxxxhtml.biz/update/4.exe http://head.xxxxhtml.biz/update/5.exe到C:\Program Files中分别命名为 stop1.exe~stop13.exe 到C:\Program Files中分别命名为 stop1.exe~stop13.exe 分别由IE启动他们木马全部植入完毕后增加如下文件 C:\WINDOWS\system32\dllhost32.exe C:\WINDOWS\system32\hreax.dll C:\WINDOWS\system32\Kvsc3.dll C:\WINDOWS\system32\LYLOADER.EXE C:\WINDOWS\system32\LYMANGR.DLL C:\WINDOWS\system32\msacn.dll C:\WINDOWS\system32\msdebug.dll C:\WINDOWS\system32\MSDEG32.DLL C:\WINDOWS\system32\msport.dll C:\WINDOWS\system32\netsrvcs.dll C:\WINDOWS\system32\nslookupi.exe C:\WINDOWS\system32\nwiztlbu.exe C:\WINDOWS\system32\nwizwmgjs.exe C:\WINDOWS\system32\until.ttc C:\WINDOWS\system32\windhcp.ocx C:\WINDOWS\system32\wscsv.dll C:\WINDOWS\system32\wtrmm.dll... 解决方法：原先用Xdelbox删除病毒文件的方法在某些情况下可能出现删除不掉的问题今天给大家提供一个简便的方法一.清理病毒主程序 1.确定那个8位随机数的dll的名称这里我们选用winrar确定那个dll的名称方法是：打开winrar.exe 工具查看文件在上面的地址栏中进入c:\program files\common files\microsoft shared\msinfo目录（如图1）我这台被感染的电脑的文件名为41115bdd.dll和41115bdd.dat 2.找到后在winrar中右键点击随机8位数字的那个dll和那个dat文件重命名把他们命名为其他名字越乱越好趁这个机会可以命个名字骂骂这个病毒，呵呵！不过要记住你重命名的文件的名字哦 3.重启计算机 4.由于注册表与那个dll的名字不对应所以重启后自然不会加载那个dll文件恢复映像劫持这里我们使用autoruns这个软件 http://www.skycn.com/soft/17567.html 由于这个软件也被映像劫持了所以我们随便把他改个名字打开这个软件后找到Image hijack (映像劫持）删除除了Your Image File Name Here without a pathSymbolic Debugger for Windows 2000 Microsoft Corporation c:\windows\system32\ntsd.exe 以外的所有项目 5.此时我们就可以打开sreng了打开sreng 系统修复高级修复点击修复安全模式在弹出的对话框中点击是 5.恢复显示隐藏文件把下面的代码拷入记事本中然后另存为1.reg文件 Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] "RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" "Text"="@shell32.dll,-30500" "Type"="radio" "CheckedValue"=dword:00000001 "ValueName"="Hidden" "DefaultValue"=dword:00000002 "HKeyRoot"=dword:80000001 "HelpID"="shell.hlp#51105" 双击1.reg把这个注册表项导入双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹" 并清除"隐藏受保护的操作系统文件（推荐）"前面的钩。在提示确定更改时，单击“是” 然后确定删除c:\program files\common files\microsoft shared\msinfo下面你刚刚重命名的那两个文件(一个dll一个dat) 二.清理下载的木马（由于变种不同，且病毒所连接的下载地址的木马随时在更新，所以你的情况不一定和我测试的相符合，此处仅以我测试时候生成的木马为例）我测试的时候sreng日志如下： [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <Kvsc><C:\WINDOWS\Kvsc3.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <MSDEG32><LYLoader.exe> [] <MSDWG32><LYLoadbr.exe> [N/A] <MSDCG32 ><LYLeador.exe> [N/A] <MSDOG32><LYLoador.exe> [N/A] <MSDSG32><LYLoadar.exe> [N/A] <MSDMG32><LYLoadmr.exe> [N/A] <MSDHG32><LYLoadhr.exe> [N/A] <MSDQG32><LYLoadqr.exe> [N/A] <{15BD4111-4111-5BDD-115B-111BD1115BDD}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\41115BDD.dll> [N/A] <{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}><C:\WINDOWS\system32\msacn.dll> [] 服务 [Win32 Debug Service / MSDebugsvc][Stopped/Auto Start] <C:\WINDOWS\system32\rundll32.exe msdebug.dll,input><Microsoft Corporation> [Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start] <C:\WINDOWS\system32\rundll32.exe windhcp.ocx,input><Microsoft Corporation> [Wireless Service / WZCSRVC][Stopped/Auto Start] <C:\WINDOWS\system32\rundll32.exe netsrvcs.dll,input><Microsoft Corporation> 实践中最难搞的就是那个C:\WINDOWS\system32\msacn.dll了有注册表守护，且几个dll插入进程相互守护对方不过没关系继续我们的重命名大法搜索C:\WINDOWS\system32\msacn.dll然后随便把他起个名字然后打开sreng 启动项目注册表删除如下项目 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <Kvsc><C:\WINDOWS\Kvsc3.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <MSDEG32><LYLoader.exe> [] <MSDWG32><LYLoadbr.exe> [N/A] <MSDCG32 ><LYLeador.exe> [N/A] <MSDOG32><LYLoador.exe> [N/A] <MSDSG32><LYLoadar.exe> [N/A] <MSDMG32><LYLoadmr.exe> [N/A] <MSDHG32><LYLoadhr.exe> [N/A] <MSDQG32><LYLoadqr.exe> [N/A] <{15BD4111-4111-5BDD-115B-111BD1115BDD}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\41115BDD.dll> [N/A] “启动项目”-“服务”-“Win32服务应用程序”中点“隐藏经认证的微软项目”，选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”： Win32 Debug Service / MSDebugsvc Windows DHCP Service / WinDHCPsvc Wireless Service / WZCSRVC 重启电脑打开sreng 启动项目注册表删除如下项目 <{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}><C:\WINDOWS\system32\msacn.dll> [] 双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹" 并清除"隐藏受保护的操作系统文件（推荐）"前面的钩。在提示确定更改时，单击“是” 然后确定 C:\WINDOWS\system32\dllhost32.exe C:\WINDOWS\system32\hreax.dll C:\WINDOWS\system32\Kvsc3.dll C:\WINDOWS\system32\LYLOADER.EXE C:\WINDOWS\system32\LYMANGR.DLL C:\WINDOWS\system32\msdebug.dll C:\WINDOWS\system32\MSDEG32.DLL C:\WINDOWS\system32\msport.dll C:\WINDOWS\system32\netsrvcs.dll C:\WINDOWS\system32\nslookupi.exe C:\WINDOWS\system32\nwiztlbu.exe C:\WINDOWS\system32\nwizwmgjs.exe C:\WINDOWS\system32\until.ttc C:\WINDOWS\system32\windhcp.ocx C:\WINDOWS\system32\wscsv.dll C:\WINDOWS\system32\wtrmm.dll 以及刚才你重命名msacn.dll的那个文件最后也是最重要的就是删除各个分区下面的autorun.inf和8位随机数的exe 一定不要双击也不能右键打开（因为那个autorun.inf编辑的比较巧妙，所以右键菜单无原先的auto等字样）所以一定用winrar删除!!!!
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-06-08 17:52 \| 只看楼主短消息资料字号：小中大 4楼附图1 附件: 文件名:554345200768174219.jpg 下载次数:585 文件类型:image/pjpeg 文件大小: 上传时间:2007-6-8 17:52:31 描述: 预览信息:EXIF信息 User Comment : LEAD Technologies Inc. V1.01
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-06-08 17:52 \| 只看楼主短消息资料字号：小中大 5楼附图2 附件: 文件名:554345200768174234.jpg 下载次数:533 文件类型:image/pjpeg 文件大小: 上传时间:2007-6-8 17:52:46 描述: 预览信息:EXIF信息 User Comment : LEAD Technologies Inc. V1.01
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-06-08 17:53 \| 只看楼主短消息资料字号：小中大 6楼附图3 附件: 文件名:554345200768174322.jpg 下载次数:588 文件类型:image/pjpeg 文件大小: 上传时间:2007-6-8 17:53:33 描述: 预览信息:EXIF信息 User Comment : LEAD Technologies Inc. V1.01
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

火影忍者横据古稀狮帖子:7855 注册: 2006-06-29 来自:火星	发表于： 2007-06-08 17:55 \| 短消息资料字号：小中大 7楼阳光..样本给个我..(发到我邮箱还是直接传我!!!)
火影忍者横据古稀狮帖子:7855 注册: 2006-06-29 来自:火星

天月来了版主帖子:76904 注册: 2007-02-06 来自:	发表于： 2007-06-08 18:04 \| 短消息资料字号：小中大 8楼呵呵！！！以后不能再改名，可就绝了。火影你试试，可别真的不能改名。呵呵！！！！！暂时能改名还不错。
天月来了版主帖子:76904 注册: 2007-02-06 来自:

loveperday 初生襁褓狮帖子:824 注册: 2007-05-11 来自:	发表于： 2007-06-08 18:05 \| 短消息资料字号：小中大 9楼支持阳光，建议版主置顶~ 以后可以直接告诉他们看置顶帖子就行了。
loveperday 初生襁褓狮帖子:824 注册: 2007-05-11 来自:

孤独更可靠锋芒艾服狮帖子:1788 注册: 2007-01-27 来自:	发表于： 2007-06-08 18:05 \| 短消息资料字号：小中大 10楼能重命名? Winrar能打开? C:\Program Files\Common Files\Microsoft Shared\MSInfo\这个路径也不能打开`` 还有IS `````也被`` 不过还是--搞定了``` ``
孤独更可靠锋芒艾服狮帖子:1788 注册: 2007-01-27 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT