“QQ迷你首页”&全球最大的网游私服搜索引擎&ad1.exe--11月6日更新在8楼
链接在反浏览器劫持:http://forum.ikaka.com/topic.asp?board=67&artid=8203568
原贴:http://hi.baidu.com/killvir/blog/item/a78a4f4a11cb0f2308f7ef7c.html“全球最大的网游私服搜索引擎”问题
异常跳出这个
hxxp://www.37ss.com/index20.htm窗口 (58.221.249.131)
标题显示：
QQ迷你首页任务栏显示: Explorer.exe
进程里显示: ad1.exe
hosts文件被修改：部分网页指向IP (
61.135.150.114)
hxxp://hxxp://www.8000qq.com
hxxp://www.800f.net
hxxp://www.1000sf.cn
hxxp://jfengsha.comfb
hxxp://www.1000yf.net
hxxp://www.159sifu.com
hxxp://www.9s5.cn
hxxp://www.spbuy.net
hxxp://www.wym.cn
hxxp://www.cc4f.cn
hxxp://mafan.net
hxxp://www.6688qn.net
hxxp://www.177z.com
hxxp://www.131sf.net
hxxp://tj.cntg.cn
hxxp://www.china45.net
hxxp://www.ok22.com
hxxp://www.17mi.net
hxxp://www.sf8.com.cn
hxxp://www.13177.com
hxxp://ip94.fd4f.com
hxxp://www.521it.net
hxxp://www.ytdj.cn
hxxp://www.fwoool.cn
hxxp://www.5u37.net
hxxp://www.87sf.com
hxxp://ww1.swoool.com
hxxp://wooljsz.cn
hxxp://www.57wool.com
hxxp://www.58816.com
hxxp://chuanqisjsf.blwool.com
hxxp://www.woool188.com
hxxp://www.sf1260.com
hxxp://linf23.b12.cn
hxxp://wg.cn
hxxp://www.wooolweb.com
hxxp://www.yq520.net
hxxp://www.cs222.com
hxxp://www.ok22.com
hxxp://www.7100sf.com
hxxp://www.1352sf.com
hxxp://www.458wool.cn
hxxp://www.555woool.cn
hxxp://www.kaosf.com
hxxp://www.siyuwl.com
hxxp://www.csjsz.cn
hxxp://www.13177.com
hxxp://www.458cs.com
hxxp://www.5573.com
hxxp://www.02945.com
hxxp://www.pkchina.net
hxxp://www.5181314.com
hxxp://www.fknf2.com
hxxp://www2.yoursf.com
hxxp://www.paocs.com
hxxp://www.sfboke.com
hxxp://www.xx878.com
hxxp://ww1.woool188.com
hxxp://www.cs119.com
hxxp://www.xdwoool.net
hxxp://www.xx515.com
hxxp://www.cs176.com
hxxp://www.552sf.com
hxxp://www.ipmir.com
hxxp://www.898woool.com
hxxp://www.qqks.com
hxxp://www.368idc.com
hxxp://www.csbaba.com
hxxp://www.4745.cn
hxxp://www.636400.com
hxxp://www.oursf.cn
hxxp://www.laiba173.com
hxxp://www.14455.com
hxxp://www.zheshan.net
hxxp://zt.aaaaasf.cn
hxxp://www.zt1314.cn
hxxp://www.zt4f.net
hxxp://www.zt002.com
hxxp://www.amir3.com
hxxp://www.sf1717.com
hxxp://www.cq333.cn
hxxp://www.3316.cn
hxxp://www.sosmir3.com
hxxp://www.95279.com
hxxp://www.sf1788.com
hxxp://www.4fboss.com
hxxp://www.45net.net
hxxp://www.lian2.cn
hxxp://www.ytdj.cn
hxxp://www.laiba173.com
hxxp://www.wow1314.com
hxxp://www.zgwow.com
hxxp://www.1000wow.net
hxxp://www.gowowsf.com
hxxp://www.wowsf.com
hxxp://www.wxwow.com
hxxp://520.xinwow.com
hxxp://www.wowhelp.cn
hxxp://www.800wow.com
hxxp://www.56wow.com
hxxp://www.45wow.com
hxxp://www.sfhao123.net
hxxp://www.sfgoogle.cn
hxxp://www.45top.com
hxxp://www.915mu.com
hxxp://www.gm911.net
hxxp://www.4000mu.com
hxxp://www.99musf.com
hxxp://www.mu45.com
hxxp://www.369mu.com
hxxp://www.525sf.com
hxxp://www.2345w.com
hxxp://www.3jsf.net
hxxp://www.xxfsf.com
hxxp://www.521ee.com
hxxp://www.997j.com
hxxp://www.wz4f.net
hxxp://www.hoxx2.com
hxxp://www.398q.com
hxxp://www.xx1314.com
hxxp://www.xx2sf.net
hxxp://www.sifu114.com
hxxp://www.2z2.cn
hxxp://www.haosf.com
hxxp://www.cqsf999.com
hxxp://www.zhaosf.com
hxxp://www.920666.com
hxxp://www.450666.com
hxxp://www.3000ok.com
hxxp://www.3000ok.net
hxxp://www.sf001.com
hxxp://www.92045.com
hxxp://www.45bang.com
hxxp://www.30ok.com
hxxp://www.sf123.com
hxxp://www.sf920.com
hxxp://www.99945.com
hxxp://www.176sf.com
hxxp://www.mir2mir2.com
hxxp://www.33520.com
hxxp://www.xp13.com
hxxp://www.45yes.com
hxxp://www.92095.com
hxxp://www.17ww.com
hxxp://www.4000sf.com
hxxp://www.haouc.com
hxxp://www.921uc.com
hxxp://17126.uc999.com
hxxp://www.45pao.com
hxxp://www.177g.com
hxxp://www.95217.com
hxxp://www.2345sf.com
生成主要文件：
debug.txt
cj1.exe
cj2.exe
c:\~12qwe.exe
c:\1.htm
%SystemRoot%\system32\trks.dll
似乎修改了QQ.Ini 指向
hxxp://www.37ss.com/index20.htm下载：hxxp://www.cj888.net/trkwks.dll
c:\trkwks.dll
dllcache\Trkwks.dll
替换了系统文件：Trkwks.dll
一、案例分析：
本程序主要是替换了系统文件：Trkwks.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks\Parameters]
"ServiceDll"="%SystemRoot%\system32\rkks.dll"
真正的文件信息如下（以我系统的为例）：
Filename : C:\WINDOWS\system32\trkwks.dll
File Size: 90,624 Bytes
SHA-160: A133A57BC40E380A6D9C434BF7C452E1619A8321
MD5 : 91BEF237CAAA97ABF07FF235A7F2DA7F
CRC-32 : C347ADF5
加壳方式：未加壳
编写语言：Microsoft Visual C++
Version Information
====================
Operating System : Windows NT, 32-bit Windows
File Type : Application
File Sub-Type : Unknown
File Version : 5,1,2600,2180
Product Version : 5,1,2600,2180
============================================================
Product Name : Microsoft? Windows? Operating System
File Description : Distributed Link Tracking Client
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Product Version : 5.1.2600.2180
Company Name : Microsoft Corporation
Internal Name : trkwks.dll
Legal Copyright : ? Microsoft Corporation. All rights reserved.
Original FileName : trkwks.dll
病毒文件：
File Size: 91,853 Bytes
SHA-160: AD15B02C282380E523C01114648C134390F746E4
MD5 : A0481500214BF0483238BFC247FA9B6F
CRC-32 : C781D72F
加壳方式：1.25 UPX
编写语言：Microsoft Visual Basic 5.0 / 6.0
无文件信息
二、恢复还原系统文件方法：(怎么来就让它怎么走，呵呵）
1、net stop TrkWks
2、终止ad1.exe、QQ等进程
3、关闭系统文件保护
sfc /cancel
4、用真正的系统文件Trkwks.dll替换掉病毒Trkwks.dll
5、把下面一段复制到记事本保存为TrkWks.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks]
"Description"="在计算机内 NTFS 文件之间保持链接或在网络域中的计算机之间保持链接。"
"DisplayName"="Distributed Link Tracking Client"
"DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"
ObjectName"="LocalSystem"
"Start"=dword:00000002
"Type"=dword:00000020
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
74,00,72,00,6b,00,77,00,6b,00,73,00,2e,00,64,00,6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,60,00,04,00,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,\
05,0b,00,00,00,00,00,18,00,9d,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,\
23,02,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,\
02,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,05,12,00,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks\Enum]
"0"="Root\\LEGACY_TRKWKS\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001
6、执行一次：TrkWks.reg
7、开启系统文件保护
sfc /enable
8、删除相关生成的病毒文件（可能有多个同时生成的Trkwks.dll类似的文件请一并删除）
===========================================
附SFC的命令
SFC/SCANNOW 立即扫描所有受保护的系统文件。
SFC/SCANONCE 扫描所有受保护的系统文件一次。
SFC/SCANBOOT 每次启动时扫描所有受保护的系统文件。
SFC/CANCEL 取消所有暂停的受保护系统文件的扫描。
SFC/QUIET 不提示用户就替换所有不正确的文件版本。
SFC/ENABLE 为正常操作启用 Windows 文件保护
SFC/PURGECACHE 清除文件缓存并立即扫描所有受保护的系统文件。
SFC/CACHESIZE=x 设置文件缓存大小
===========================================
欢迎交流，如有错误请提醒，谢谢！
以上为本人原创，转贴需注明出处。
by killvirus
2006.11.2
发布原址：
[url][/url][url][/url]
