病毒名称： Trojan-PSW.Win32.Nilage.bcw
病毒类型： 木马类
文件 MD5： 48ABEEBC0D32069184C46A86A4C363D9
公开范围： 完全公开
危害等级： 3
文件长度： 33,363 字节,脱壳后120,832 字节
感染系统： windows 98以上版本
开发工具： Borland Delphi 6.0 - 7.0
加壳类型： UPX 0.89.6 - 1.02 / 1.05 - 1.22
该病毒通过移动存储介质、 恶意网站、其它病毒 /木马下载大面积传播；由于 该病毒查杀和劫持杀毒软件、防火墙、病毒查杀工具软件，且插入其它进程的“随机 8位数字与字母组合.dll”对注册表和病毒文件有监视和保护功能，则对其查杀该病毒有一定难度，更增加了其生存的空间。该木马可以通过插入的“随机8位数字与字母组合.dll”来记录用户的操作，从而达到盗用户的敏感信息目的。该木马运行后连接网络，更新文件，下载其它病毒文件，进行信息盗、 arp 欺骗、远程控制等。
1 、病毒被激活后，复制自身到系统目录和各个驱动器下，衍生病毒文件：
自身副本文件：
%Program Files%\Common Files\Microsoft Shared\
MSInfo\随机8位数字与字母组合.dat
%WINDIR%\Help\随机8位数字与字母组合.chm
衍生病毒文件：
%Program Files%\Common Files\Microsoft Shared\
MSInfo\随机8位数字与字母组合.dll
%WINDIR%\随机8位数字与字母组合.hlp
%system%\verclsid.exe.bak(删除原verclsid.exe文件，
并建立副本verclsid.exe.bak)
各个驱动器下释放自身副本：
[DRIVE LETTER]:\ AutoRun.inf
[DRIVE LETTER]:\ 随机8位数字与字母组合.exe
注：随机 8位数字与字母组合, 本次感染为：80C88D28
2 、启动项目：
(1)、修改注册表，在ShellExecuteHooks添加键值，以钩子挂接文件的打开操作，以达
到启动的目的：
HKLM\SOFTWARE\Classes\CLSID\{88D280C8-80C8-8D28-C88D-0C8D2 0C88D28}
键值 : 字串: " 默认 " = ""
HKLM\SOFTWARE\Classes\CLSID\{88D280C8-80C8-8D28-C88D-
0C8D20C88D28}\InProcServer32\
HKLM\SOFTWARE\Classes\CLSID\{88D280C8-80C8-8D28-C88D-
0C8D20C88D28}\InProcServer32
键值 :字串:"默认"=" %ProgramFiles%\CommonFiles\MicrosoftShared\
MSInfo\ 随机 8位数字与字母组合.dll "
HKLM\SOFTWARE\Classes\CLSID\{88D280C8-80C8-8D28-C88D-
0C8D20C88D28}\InProcServer32
键值 : 字串: " ThreadingModel " = "Apartment"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\ShellExecuteHooks
键值 : 字串: "{88D280C8-80C8-8D28-C88D-0C8D20C88D28} " = ""
(2)、修改注册表恢复硬盘或光驱的 AutoRun功能：
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
Explorer\NoDriveTypeAutoRun
键值 : DWORD: 145 (0x91)
在 各个驱动器下释放 AutoRun.inf文件，从而在打开驱动器时运行同目录下的
“随机8位数字与字母组合.exe”文件， AutoRun代码如下：
[AutoRun]
open=80C88D28.exe
shell\open=打开(&O)
shell\open\Command= 随机 8位数字与字母组合.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command= 随机 8位数字与字母组合.exe
3 、“随机 8位数字与字母组合.dll”插入到Explorer.exe进程中，以Explorer.exe进程监视其
写入的注册表键值,如删除则恢复； 尝试通过钩子挂接使“随机8位数字与字母组合.dll”插入
到IEXPLORER.EXE进程和应用程序进程中。
4 、监视并关闭众多杀毒软件、防火墙、病毒查杀工具软件的进程与窗口及和杀毒相关网站，甚
至带有病毒等关键字的窗口：
|
AntiVirus TrojanFirewall
Kaspersky
JiangMin
KV200
Kxp
Rising
RAV
RFW
KAV200
KAV6
McAfe
Network Associates
TrustPort
NortonSymantec SYMANT~1
Norton SystemWorks
ESET
Grisoft
F-Pro
Alwil Software
ALWILS~1
F-Secure
ArcaBit
Softwin
ClamWin
DrWe
Fortineanda Software
Vba3
Trend Micro
QUICKH~1
TRENDM~1
Quick Heal
eSafewido
Prevx1
Ers
Avg
Ikarus
SophoSunbeltPC-cilli
ZoneAlar
Agnitum
WinAntiVirus
AhnLab
Normasurfsecret
Bullguard\Blac
360safe
SkyNet
Micropoint
Iparmor
Ftc
mmjk2007
Antiy Labs
LinDirMicro Lab
Filseclab
Ast
System Safety Monitor
ProcessGuard
FengYun
Lavasoft |
Spy Cleaner Gold
CounterSpy
EagleEyeOS
Webroot
BufferZ
Avp
AgentSvr
CCenter
Rav
RavMonD
RavStub
RavTask
Rfwcfg
Rfwsrv
RsAgent
Rsaupd
Runiep
SmartUp
FileDsty
RegClean
360tray
360Safe
360rpt
Kabaload
Safelive
Ras
KASMain
KASTask
KAV32
KAVDX
KAVStart
KISLnchr
KMailMon
KMFilter
KPFW32
KPFW32X
KPFWSvc
KWatch9x
KWatch
KWatchX
TrojanDetector
UpLive.EXE
KVSrvXP
KvDetect
KRegEx
Kvol
Kvolself
Kvupload
Kvwsc
UIHost
IceSword
iparmo
mmsk
adam
MagicSet
PFWLiveUpdate
SREng
WoptiClean
scan32 |
QHSET
zxsweep.
AvMonitor
UmxCfg
UmxFwHlp
UmxPol
UmxAgent
UmxAttachment
KPFW32
KPFW32X
KvXP_1
KVMonXP_1
KvReport
KVScan
KVStub
KvXP
KVMonXP
KVCenter
TrojDie
avp.com.
krepair.COM
KaScrScn.SCR
Trojan
Virus
kaspersky
jiangmin
rising
ikaka
duba
kingsoft
360safe
木马
木馬
病毒
杀毒
殺毒
查毒
防毒
反病毒
专杀
專殺
卡巴斯基
江民
瑞星
卡卡社区
金山毒霸
毒霸
金山社区
360安全
恶意软件
流氓软件
举报
报警
杀软
殺軟
防駭
微点
MSInfo
winRAR
|
IceSword
HijackThis
Killbox
Procexp
Magicset
EQSysSecureProSecurity
Yahoo!
Google
Baidu
P4P
Sogou PXP
Ardsys
超级兔子木马
KSysFiltsys
KSysCallsys
KsLoader
KvfwMcl
autoruns
AppSvc32
ccSvcHst
isPwdSvc
symlcsvcnod32kui
avgrssvc
RfwMain
KAVPFW
Iparmor
nod32krn
AVK
K7
Zondex
Blcorp
Tiny Firewall Pro
Jetico
HAURI
CA
Kmx
PCClear_Plus
Novatix
Ashampoo
WinPatrol
PFW
Mmsk
The Cleaner
Defendio
kis6Beheadsreng
Trojanwall
FTCleanerShell
loaddll
rfwProxy
mcconsol
HijackThis
Mmqczj
RavMon
KAVSetup
NAVSetup
SysSafe
hcfg32
NOD3 |
5 、破坏注册表安全模式，删除下列注册表项：
HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\
{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\
{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\
{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\
{4D36E967-E325-11CE-BFC1-08002BE10318}
6、改变注册表值使隐藏文件不可见，达到病毒体隐藏目的：
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\Advanced\Folder\Hidden\SHOWALL
键值 : dword:"CheckedValue"=dword:00000001
改为：键值 : dword:"CheckedValue"=dword:00000000
7、在注册表的映像劫持中添加多个劫持项，劫持多个杀毒软件、防火墙、病毒查杀工具等相关
软件：
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\avp.com
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\avp.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\CCenter.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\ccSvcHst.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\FileDsty.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\FTCleanerShell.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\HijackThis.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\IceSword.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\360rpt.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\360Safe.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\360tray.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\adam.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\AgentSvr.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\AppSvc32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\autoruns.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\avgrssvc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\AvMonitor.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\iparmo.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\Iparmor.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\isPwdSvc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\kabaload.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KaScrScn.SCR
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KASMain.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KASTask.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KAV32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KAVDX.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KAVPFW.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KAVSetup.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KAVStart.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KISLnchr.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KMailMon.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KMFilter.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KPFW32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KPFW32X.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KPFWSvc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KRegEx.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\krepair.COM
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KsLoader.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KVCenter.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KvDetect.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KvfwMcl.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KVMonXP.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KVMonXP_1.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\kvol.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\kvolself.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KvReport.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KVScan.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KVSrvXP.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KVStub.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\kvupload.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\kvwsc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KvXP.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KvXP_1.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KWatch.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KWatch9x.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\KWatchX.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\loaddll.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\MagicSet.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\mcconsol.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\mmqczj.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\mmsk.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\NAVSetup.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\nod32krn.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\nod32kui.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\PFW.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\PFWLiveUpdate.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\QHSET.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\Ras.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\Rav.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\RavMon.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\RavMonD.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\RavStub.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\RavTask.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\RegClean.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\rfwcfg.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\RfwMain.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\rfwProxy.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\rfwsrv.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\RsAgent.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\Rsaupd.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\runiep.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\safelive.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\scan32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\shcfg32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\SmartUp.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\SREng.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\symlcsvc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\SysSafe.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\TrojanDetector.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\Trojanwall.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\TrojDie.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\WoptiClean.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\zxsweep.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\UIHost.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\UmxAgent.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\UmxAttachment.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\UmxCfg.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\UmxFwHlp.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\UmxPol.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\UpLive.EXE.exe
被劫持到 C:\Program Files\Common Files\Microsoft Shared\MSInfo\
下面的那个dat文件
8、在注册表中改变键值，以禁用特定杀毒软件服务项，禁用自动更新功能：
HKLM\SYSTEM\ControlSet001\Services\杀毒软件服务名\Start
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv\Start
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\start
9、该木马运行后连接网络，更新文件，下载其它病毒文件，进行信息盗、arp欺骗、远程
控制等。
注：随机 8位数字与字母组合, 本次感染为：80C88D28 .
%System%是一个可变路径。病毒通过查询操作系统来决定当前System文件夹的位置。Windows2000/NT中默认的安装路径是C:\Winnt\System32，windows95/98/me中默认的安装路径是C:\Windows\System，windowsXP中默认的安装路径是C:\Windows\System32。
[1] [2] 下一页
