记得是一周前拿到这个样本的。当时，瑞星还查不到它。
自那天起，每天运行一次这个IsowI.exe，下载的病毒/木马均不同。下载的东东日趋丰富。
今天再次运行这个IsowI.exe，发现它又多了点儿新把戏。以前的把戏（禁用Tiny、瑞星的服务，关闭Tiny的Activity Mornitor及瑞星监控等）依然保留，但不再玩儿什么IFEO劫持了。新把戏是通过那个隐藏的IE进程修改OPERA内存，将病毒模块插入其中。
怎么感觉这东东是冲著我来的？
以下是今天运行IsowI.exe后的SRENG日志以及IceSword进程列表中所见的病毒进程。这个下载器释放/下载的文件太多了，这里就不再一一展示。
启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<TinTSentp><C:\WINDOWS\system32\autoc0nv.exe> [N/A]
<System><C:\Program Files\Common Files\System\Updaterun.exe> [N/A]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> [N/A]
<tkliede><C:\Program Files\Microsoft Office\tkliede.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><C:\WINDOWS\system32\userinit.exe,c:\WINDOWS\IsowI.exe> [N/A]
==================================
服务
[Remote Procedure Call System(RPCS) / RpcS][Running/Auto Start]
<C:\windows\system32\Rpcs.exe><Microsoft Corporation>
[wojkl / wojkl][Stopped/Auto Start]
<C:\Program Files\msn\msn.cc><N/A>
[84318FB4 / 84318FB4][Stopped/Auto Start]
<C:\windows\system32\84318FB4.EXE -service><Microsoft Corporation>
[Distributed Application Client / BARCASE][Running/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLL2KXP.EXE C:\WINDOWS\SYSTEM32\WBEM\HMPET.DLL,Export 1087><Microsoft Corporation>
[System Security / Templates][Stopped/Auto Start]
<C:\windows\System32\svchost.exe -k netsvcs-->C:\windows\system32\maqgx.dll><Microsoft Corporation>
[error monitor / EmonSrv][Running/Auto Start]
<C:\windows\system32\1a43.exe><N/A>
[Syswindowsxpserivers / windowsxpserivers][Others/Auto Start]
<C:\Windows\system32\XJUGTFRDP.EXE><N/A>
[kkdj3sdf3 / kkdj3sdf3][Stopped/Auto Start]
<C:\windows\system32\kkdj3sdf3.exe -j><Microsoft Corporation>
==================================
驱动程序
[whmpwpg / whmpwpg][Running/Disabled]
<\??\C:\DOCUME~1\baohelin\LOCALS~1\Temp\whmpwpgcpk><N/A>
[dejsd / dejsd][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\dejsd.sys><N/A>
[acpidisk / acpidisk][Running/Auto Start]
<\??\C:\windows\system32\drivers\acpidisk.sys><N/A>
[msqmx / msqmx][Running/Auto Start]
<\??\C:\windows\system32\drivers\msqmx.sys><N/A>
==================================
浏览器加载项
[ExtentIE Class]
{66C2C482-D4EE-42A5-AEF7-0B124F278D47} <C:\windows\system32\81a4.dll, TODO: <公司名>>
[MYLAU]
{B1F7C1FA-CADB-4563-9A6B-50414070C7D3} <C:\WINDOWS\system32\BLYJWHSDQBN.DLL, N/A>
[IeToolBarPos00 Class]
{CCCD3E2C-8939-5C08-CDE3-3D2A14E9F83D} <C:\WINDOWS\MSTOOL~1\toolbar.dll, IE Toolbar>
[]
{e4888d08-df6d-4410-ae2b-1b294ae19f4f} <C:\windows\system32\4410rsnc.dll, N/A>
[MS Toolbar]
{B9D4F481-DB79-35C6-C548-D8C302837D6E} <C:\WINDOWS\MS Toolbar\toolbar.dll, IE Toolbar>
[搜索]
{0FCB34B6-902D-426E-AE2B-1B294AE19F4F} <C:\windows\system32\4410rsnc.dll, N/A>
[ExtentIE Class]
{66C2C482-D4EE-42A5-AEF7-0B124F278D47} <C:\windows\system32\81a4.dll, TODO: <公司名>>
[MYLAU]
{B1F7C1FA-CADB-4563-9A6B-50414070C7D3} <C:\WINDOWS\system32\BLYJWHSDQBN.DLL, N/A>
[MS Toolbar]
{B9D4F481-DB79-35C6-C548-D8C302837D6E} <C:\WINDOWS\MS Toolbar\toolbar.dll, IE Toolbar>
[IeToolBarPos00 Class]
{CCCD3E2C-8939-5C08-CDE3-3D2A14E9F83D} <C:\WINDOWS\MSTOOL~1\toolbar.dll, IE Toolbar>
[]
{E4888D08-DF6D-4410-AE2B-1B294AE19F4F} <C:\windows\system32\4410rsnc.dll, N/A>
==================================
正在运行的进程
[PID: 744][\??\C:\windows\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\windows\system32\winlib .dll] [N/A, N/A]
[PID: 2648][C:\Program Files\Opera\Opera.exe] [Opera Software, 8679]
[C:\windows\system32\a43c.dll] [N/A, N/A]
[C:\windows\system32\781a.dll] [ , 1, 0, 0, 3]
[PID: 2684][C:\Program Files\Tiny Firewall Pro\cfgtool.exe] [Computer Associates International, Inc., 6.0.0.52]
[C:\windows\system32\a43c.dll] [N/A, N/A]
[C:\windows\system32\781a.dll] [ , 1, 0, 0, 3]
[PID: 268][C:\WINDOWS\system32\shadow\ShadowTip.exe] [PowerShadow, 1, 0, 0, 1]
[C:\windows\system32\a43c.dll] [N/A, N/A]
[C:\windows\system32\781a.dll] [ , 1, 0, 0, 3]
[PID: 1008][C:\Program Files\SREng2\SREng.exe] [Smallfrogs Studio, 2.3.13.690]
[C:\windows\system32\a43c.dll] [N/A, N/A]
[C:\windows\system32\781a.dll] [ , 1, 0, 0, 3]
[PID: 3732][C:\windows\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\windows\system32\a43c.dll] [N/A, N/A]
[C:\windows\system32\781a.dll] [ , 1, 0, 0, 3]
[PID: 436][C:\WINDOWS\SYSTEM32\RUNDLL2KXP.EXE] [Microsoft Corporation, 5.00.2134.1]
[PID: 2032][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\MSTOOL~1\toolbar.dll] [IE Toolbar, 1, 0, 0, 4]
[C:\windows\system32\4410rsnc.dll] [N/A, N/A]
[PID: 1476][C:\windows\system32\1a43.exe] [N/A, N/A]
[PID: 2568][C:\Windows\system32\XJUGTFRDP.EXE] [N/A, N/A]
图1
