病毒名称:Worm.Win32.RJump.a(AVP) 病毒别名:Trojan.Spy.IeSpy.q或者Worm.Snake.a(瑞星) 病毒大小:3,515,723 字节 加壳方式:无 样本MD5:3efdfddfffe5cf4ad40c5368c336a702 发现时间:2006.5.19 更新时间:2006.6.1 关联病毒: 传播方式:通过U盘、移动硬盘、MP3等 中毒特征:生成RavMonE.exe、RavMoneE.exe.log、RavMonlog 病毒简介:用PYTHON语言编写,py2exe打包 变种特征:RavMon.exe、AdobeR.exe 1. 运行后生成 %windows%\RavMonE.exe(3,515,723 字节)——病毒本身 msvcr71.dll(348,160字节)——库文件,支持病毒运行 RavMoneE.exe.log(644字节) RavMonlog(5字节) Autorun.inf(103字节) 2. 添加注册表 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "RavAV" = "\%windows%\RavMonE.exe" 3. Autorun.inf内容: [AutoRun] open=RavMonE.exe e shellexecute=RavMonE.exe e shell\Auto\command=RavMonE.exe e shell=Auto 用来启动RavMonE.exe 4. RavMoneE.exe.log内容: Traceback (most recent call last): File "RavMonE.py", line 1, in ? File "zipextimporter.pyo", line 78, in load_module File "twisted\internet\reactor.pyo", line 12, in ? File "twisted\internet\selectreactor.pyo", line 182, in install File "twisted\internet\posixbase.pyo", line 168, in __init__ File "twisted\internet\base.pyo", line 268, in __init__ File "twisted\internet\base.pyo", line 568, in _initThreads File "twisted\internet\posixbase.pyo", line 265, in installWaker File "twisted\internet\posixbase.pyo", line 77, in __init__ File "", line 1, in listen socket.error: (10022, 'Invalid argument') 5. RavMonlog内容: 16704 17608 类似的数字 清除方法: 1. 打开任务管理器(ctrl+alt+del或者任务栏右键点击也可),终止所有ravmone.exe的进程 2. 删除注册表 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "RavAV" = "C:\WINNT\RavMonE.exe" 3. 删除%windows%\RavMonE.exe、msvcr71.dll、RavMoneE.exe.log、RavMonlog 4. 打开“文件夹选项”,在“查看”选项卡中,去掉“隐藏受保护的操作系统文件”前的勾,同时选中“显示所以文件和文件夹” 5. 用右键打开U盘,删除包括RavmonE.exe、msvcr71.dll、RavMoneE.exe.log、RavMonlog、autorun.inf RavMon.exe和AdobeR.exe的清除方法类似。 msvcr71.dll是用来支持病毒本身运行的,删除的时候请注意文件生成时间是否与病毒生成的时间一致 |