文件名称：rxjh_2.exe

文件大小：283140 bytes

AV命名：AdWare.Win32.Ejik.en Kaspersky

加壳方式：未

编写语言：Microsoft Visual C++ 6.0

文件MD5：63e7e8d3ed98a8f4f7ee3bc7455024b9

病毒类型：广告程序

1、释放文件：

C:\WINDOWS\system32

(+)(文件) izwybfpzviqqi.dll, 222720 字节

(+)(文件) resiifers.ini, 123 字节

(+)(文件) rxjh_2.exe, 41984 字节

(+)(文件) shells32.ini, 20 字节

C:\WINDOWS\system32\conime

(+)(文件) conime.dll, 81920 字节

(+)(文件) conime.ls 86016 字节

2、注册系统服务，开机启动：

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\conime]

"Type"=dword:00000110

"Start"=dword:00000002

"ErrorControl"=dword:00000001

"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\

00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\

6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00

"DisplayName"="conime"

"ObjectName"="LocalSystem"

"Description"="用于支持windows网络服务程序的除错。如果禁止此项服务，依赖此服务的其他服务将无法启动。"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\conime\Parameters]

"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\

00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\

63,00,6f,00,6e,00,69,00,6d,00,65,00,5c,00,63,00,6f,00,6e,00,69,00,6d,00,65,\

00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\conime\Security]

"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\

00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\

00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\

05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\

20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\

00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\

00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\conime\Enum]

"0"="Root\\LEGACY_CONIME\\0000"

"Count"=dword:00000001

"NextInstance"=dword:00000001

3、注册组件：izwybfpzviqqi.dll，并注入explorer。

4、通信外部，访问：

http://www.info3344.cn/upsite.txt

http://b.mobile567.cn/dodolook636.exe

http://up1.hate163.cn/ver.txt

http://b.mobile567.cn/downnow.txt

http://up6.hate163.cn/ver.txt

http://www.info3344.cn/zl.txt

http://www.info3344.cn/upsite.txt

可能检测病毒版本进行升级和下载其他广告、病毒程序

解决方法：

1、下载SREng(可到down.45its.com下载)，然后断开网络连接。

2、打开SREng的win32系统服务，删除服务项：conime

如图：

然后在出现的提示框中选“否”确认删除。

3、重启计算机，最后删除文件：

C:\WINDOWS\system32

(+)(文件) izwybfpzviqqi.dll, 222720 字节

(+)(文件) resiifers.ini, 123 字节

(+)(文件) rxjh_2.exe, 41984 字节

(+)(文件) shells32.ini, 20 字节

C:\WINDOWS\system32\conime

(+)(文件) conime.dll, 81920 字节(+)(文件) conime.ls 86016 字节