|
这是个木马下载器。允许其访问网络后，狂下木马。 一、下载/释放的病毒文件: C:\Documents and Settings\baohelin\Local Settings\Temp\packet.dll C:\Documents and Settings\baohelin\Local Settings\Temp\npf.sys（感染完成后自动删除） C:\Documents and Settings\baohelin\Local Settings\Temp\wanpacket.dll C:\Documents and Settings\baohelin\Local Settings\Temp\oprar.exe C:\Documents and Settings\baohelin\Local Settings\Temp\fsrs25vm.dll（隐藏，须用IceSword找到并删除） C:\Documents and Settings\baohelin\Local Settings\Temp\winrar.sys（感染完成后自动删除） C:\Documents and Settings\baohelin\Local Settings\Temp\_wpcap_.bat（感染完成后自动删除） C:\windows\684745M.BMP（插入系统启动加载的所有进程，并动态插入系统启动后用户运行的应用程序进程） C:\WINDOWS\system\mhh.exe C:\WINDOWS\system\wol.exe（感染完成后自动删除） C:\windows\system\con.exe（顽固，须用IceSword强制删除） C:\WINDOWS\system\jwm.exe C:\windows\Download\svhost32.exe C:\windows\system32\Cnscheck001.dll（跟踪应用程序，动态插入相应进程，非常可恶！） C:\windows\system32\xydll.dll C:\windows\system32\ntsmm.nls（插入winlogon、explorer、ctfmon、IDMan、Tiny防火墙进程，并动态插入系统启动后用户运行的应用程序进程） C:\windows\system32\drivers\npf.sys 【注】C:\windows\system32\ntsmm.nls为随机文件名。每次感染都发生变化。这是指导别人杀毒的困难之一。 二、感染后的SREng日志： 启动项目 注册表 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <xy><C:\windows\Download\svhost32.exe> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <Userinit><C:\WINDOWS\system32\userinit.exe,c:\windows\system32\Rundll32.exe C:\windows\system32\ntsmm.nls I,> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><684745M.BMP> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{9A0CFC58-5A6F-41ba-9FFE-4320F4F621BA}><C:\windows\system32\Cnscheck001.dll> [N/A] ================================== 驱动程序 [Netgroup Packet Filter / NPF] <system32\DRIVERS\npf.sys><CACE Technologies> [squell1 / squell1] <\??\C:\DOCUME~1\baohelin\LOCALS~1\Temp\winrar.sys><N/A> ================================== 正在运行的进程 [PID: 708][\??\C:\windows\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 768][C:\windows\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 780][C:\windows\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1008][C:\windows\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1116][C:\windows\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1228][C:\windows\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1476][C:\windows\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1632][C:\windows\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1688][C:\Program Files\Common Files\PFShared\UmxCfg.exe] [Computer Associates International, Inc., 6.0.1.48] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1724][C:\Program Files\Tiny Firewall Pro\UmxFwHlp.exe] [Computer Associates International, Inc., 6.5.3.2] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1776][C:\Program Files\Common Files\PFShared\UmxPol.exe] [Computer Associates International, Inc., 6, 0, 0, 5] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1884][C:\Program Files\Tiny Firewall Pro\UmxAgent.exe] [Computer Associates International, Inc., 6.0.1.76] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1912][C:\Program Files\Tiny Firewall Pro\UmxTray.exe] [Computer Associates International, Inc., 6.5.1.59] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1988][C:\windows\System32\Ati2evxx.exe] [N/A, N/A] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 556][C:\windows\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\windows\684745M.BMP] [N/A, N/A] [C:\windows\system32\ntsmm.nls] [N/A, N/A] [C:\windows\system32\Cnscheck001.dll] [N/A, N/A] [PID: 1188][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] [Microsoft Corporation, 7.00.9466] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1272][C:\windows\System32\QCONSVC.EXE] [N/A, N/A] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1352][C:\windows\system32\shadow\ShadowService.exe] [N/A, N/A] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 1396][C:\Program Files\Common Files\PFShared\umxlu.exe] [Tiny Software, Inc., 6.0.1.15] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 280][C:\windows\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\windows\684745M.BMP] [N/A, N/A] [C:\windows\system32\ntsmm.nls] [N/A, N/A] [C:\windows\system32\Cnscheck001.dll] [N/A, N/A] [PID: 580][C:\Program Files\Tiny Firewall Pro\amon.exe] [Computer Associates International, Inc., 6.5.3.2] [C:\windows\684745M.BMP] [N/A, N/A] [C:\windows\system32\ntsmm.nls] [N/A, N/A] [C:\windows\system32\Cnscheck001.dll] [N/A, N/A] [PID: 876][C:\Program Files\Internet Download Manager\IDMan.exe] [Internet Download Manager Corp., Tonec Inc. , 5, 0, 0, 0] [C:\windows\684745M.BMP] [N/A, N/A] [C:\windows\system32\ntsmm.nls] [N/A, N/A] [C:\windows\system32\Cnscheck001.dll] [N/A, N/A] [PID: 2468][C:\windows\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\windows\684745M.BMP] [N/A, N/A] [PID: 2276][C:\windows\system32\NOTEPAD.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\windows\684745M.BMP] [N/A, N/A] [C:\windows\system32\ntsmm.nls] [N/A, N/A] [C:\windows\system32\Cnscheck001.dll] [N/A, N/A] [PID: 1424][C:\Program Files\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605] [C:\windows\684745M.BMP] [N/A, N/A] [C:\windows\system32\ntsmm.nls] [N/A, N/A] [C:\windows\system32\Cnscheck001.dll] [N/A, N/A] [PID: 2620][C:\Program Files\HyperSnap-DX 5\HprSnap5.exe] [Hyperionics Technology LLC, 5, 3, 0, 0] [C:\windows\684745M.BMP] [N/A, N/A] [C:\windows\system32\ntsmm.nls] [N/A, N/A] 三、我的查杀流程： 1、用SREng删除病毒加载项及驱动项（见SREng日志）。用SSM阻截病毒的进程插入。 2、重启系统。显示隐藏文件。 3、删除病毒文件（详见“一、下载/释放的病毒文件”）。 注：这个注册表项须用户自己找到并删除：HKEY_CLASSES_ROOT\CLSID\{9A0CFC58-5A6F-41ba-9FFE-4320F4F621BA} 
|