病毒名称:explorer.exe
大小: 23612 字节
修改时间: 2007年9月1日, 8:37:12
MD5: 38A9B8D57D84403ABF8C8E0585261D7F
SHA1: 7E4D0F013E6D90316888CF4B09EA762ECF4CD702
CRC32: 75B5DFA
该病毒又添加了流氓软件和盗号木马
强制关闭杀毒软件.
以下为SReng日志扫描分析:
中毒症状:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<DbgHlp32><C:\windows\DbgHlp32.exe> []
<ravmsmon><C:\Program Files\NetMeeting\ravmsmon.exe> []
<ravztmon><C:\Program Files\NetMeeting\ravztmon.exe> []
<DiskMan32><C:\windows\DiskMan32.exe> []
<MsIMMs32><C:\windows\MsIMMs32.exe> []
<avpqqsg><C:\Program Files\NetMeeting\avpqqsg.exe> []
<ravchdmon><C:\Program Files\NetMeeting\ravchdmon.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<twin><C:\windows\system32\ctfnom.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><jzipri.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{2231A43A-1642-641A-64FD-146ADAB223B2}><C:\windows\system32\mxbman.dll> []
<{84123FF1-8371-9834-9021-184518451FA8}><C:\windows\system32\qjhpri.dll> []
<{52311A42-AC1B-158F-FD32-5674345F23A5}><C:\windows\system32\dhepri.dll> []
<{66368135-64FA-BC34-DA32-DCF4FD431C96}><C:\windows\system32\qhfpri.dll> []
<{959AFD5B-159F-ACD8-954C-ACD545FA6589}><C:\windows\system32\jzipri.dll> []
服务添加:
[942D374 / 942D374][Stopped/Auto Start]
<C:\windows\system32\5177F6E8.EXE -d><Microsoft Corporation>
驱动添加:
[khoekej / khoekej][Running/Boot Start]
<\SystemRoot\\SystemRoot\System32\drivers\khoekej.sys><N/A>
[1ezyw9e3 / 1ezyw9e3][Running/Auto Start]
<\??\C:\windows\system32\drivers\1ezyw9e3.sys><N/A> 随机8位
[h2ouwg / h2ouwg][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\h2ouwg.sys><N/A> 随机6位
[acpidisk / acpidisk][Running/Auto Start]
<\??\C:\windows\system32\drivers\acpidisk.sys><N/A>
病毒插入正常进程:
[PID: 848 / SYSTEM][\??\C:\windows\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\windows\system32\350AED48.DLL] [Microsoft Corporation, ]
[PID: 872 / SYSTEM][\??\C:\windows\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\windows\system32\350AED48.DLL]
[C:\windows\system32\winlib .dll] [N/A, ]
[C:\windows\system32\mxbman.dll] [N/A, ]
[C:\windows\system32\qjhpri.dll] [N/A, ]
[C:\windows\system32\dhepri.dll] [N/A, ]
[C:\windows\system32\qhfpri.dll] [N/A, ]
[C:\windows\system32\jzipri.dll] [N/A, ]
[PID: 916 / SYSTEM][C:\windows\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\windows\system32\350AED48.DLL] [Microsoft Corporation, ]
[PID: 928 / SYSTEM][C:\windows\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\windows\system32\350AED48.DLL] [Microsoft Corporation, ]
[PID: 1080 / SYSTEM][C:\windows\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\windows\system32\350AED48.DLL] [Microsoft Corporation, ]
[C:\windows\system32\MsIMMs32.dll] [N/A, ]
[C:\windows\system32\DiskMan32.dll] [N/A, ]
[C:\windows\system32\dhepri.dll] [N/A, ]
[C:\windows\system32\qjhpri.dll] [N/A, ]
[C:\windows\kulionzx.dll] [N/A, ]
[C:\windows\system32\mxbman.dll] [N/A, ]
[C:\windows\system32\DbgHlp32.dll] [N/A, ]
[C:\windows\video.dll] [N/A, ]
[C:\windows\kulionwl.dll] [N/A, ]
[C:\windows\system32\qhfpri.dll] [N/A, ]
[C:\windows\system32\jzipri.dll] [N/A, ]
[C:\windows\kulionwm.dll] [N/A, ]
[C:\windows\kulionrx.dll] [N/A, ]
[PID: 1828 / 侯觉][C:\windows\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
[C:\windows\system32\350AED48.DLL] [Microsoft Corporation, ]
[C:\windows\system32\mxbman.dll] [N/A, ]
[C:\windows\kulionwl.dll] [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat] [N/A, ]
[C:\windows\video.dll] [N/A, ]
[C:\windows\system32\DbgHlp32.dll] [N/A, ]
[C:\windows\system32\qjhpri.dll] [N/A, ]
[C:\windows\kulionzx.dll] [N/A, ]
[C:\Program Files\NetMeeting\ravztmon.dat] [N/A, ]
[C:\windows\system32\dhepri.dll] [N/A, ]
[C:\windows\system32\DiskMan32.dll] [N/A, ]
[C:\windows\system32\MsIMMs32.dll] [N/A, ]
[C:\windows\system32\qhfpri.dll] [N/A, ]
[C:\windows\system32\jzipri.dll] [N/A, ]
[C:\windows\kulionwm.dll] [N/A, ]
[C:\Program Files\NetMeeting\avpqqsg.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravchdmon.dat] [N/A, ]
[C:\windows\kulionrx.dll] [N/A, ]
不一一列举了查杀方法如下:
利用的工具是IceSword和SReng
[C:\windows\system32\winlib .dll] [N/A, ]
[C:\windows\system32\mxbman.dll] [N/A, ]
[C:\windows\system32\qjhpri.dll] [N/A, ]
[C:\windows\system32\dhepri.dll] [N/A, ]
[C:\windows\system32\qhfpri.dll] [N/A, ]
[C:\windows\system32\jzipri.dll] [N/A, ]
关于这类病毒可以用newcenturymoon版主给的专杀是360发布的
下载地址 http://dl.360safe.com/killer_qhbpri.exe
如果杀不了如下:
可以借助IceSword进行强行删除这里就不说了
清除其它病毒步骤如下:
图1:
结束下列进程
