样本来自卡饭。
运行此样本后，要耐心等待一段时间，木马才能全部下来。
一、木马运行后，SRENG日志可以见到下列异常项目：
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ravshell><C:\Progra~1\Eset\1explore.exe> [N/A]
<uvf8csw62w04tu5><C:\DOCUME~1\baohelin\LOCALS~1\Temp\c0nime.exe> [N/A]
<1MJPMIG__><C:\windows\IMEINPUTS.EXE> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<winform><C:\windows\winform.exe> [N/A]
<mppdss><C:\windows\mppdss.exe> [N/A]
<upxdnd><C:\windows\upxdnd.exe> [N/A]
<Kvsc3><C:\windows\Kvsc3.exe> [N/A]
<msccrt><C:\windows\msccrt.exe> [N/A]
<cmdbcs><C:\windows\cmdbcs.exe> [N/A]
<jnavavm><C:\windows\jnavavm.exe> [N/A]
<AVPSrv><C:\windows\AVPSrv.exe> [N/A]
==================================
驱动程序
[Netgroup Packet Filter / NPF][Running/Manual Start]
<system32\drivers\npf.sys><CACE Technologies>
==================================
正在运行的进程
[PID: 864][C:\windows\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\windows\system32\jnavavm.dll] [N/A, N/A]
[PID: 1992][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\windows\system32\jnavavm.dll] [N/A, N/A]
[PID: 492][C:\windows\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\windows\system32\jnavavm.dll] [N/A, N/A]
[PID: 1084][C:\Program Files\Internet Download Manager\IDMan.exe] [Internet Download Manager Corp., Tonec Inc. , 5, 0, 0, 0]
[C:\windows\system32\jnavavm.dll] [N/A, N/A]
[PID: 956][C:\Program Files\Tiny Firewall Pro\amon.exe] [Computer Associates International, Inc., 6.5.3.2]
[C:\windows\system32\jnavavm.dll] [N/A, N/A]
[PID: 3668][C:\Program Files\Opera\Opera.exe] [Opera Software, 8771]
[C:\windows\system32\jnavavm.dll] [N/A, N/A]
[PID: 1312][C:\Program Files\SREng2\SREng.exe] [Smallfrogs Studio, 2.3.13.690]
[C:\windows\system32\jnavavm.dll] [N/A, N/A]
[PID: 2764][C:\Program Files\Tiny Firewall Pro\cfgtool.exe] [Computer Associates International, Inc., 6.0.0.52]
[C:\windows\system32\jnavavm.dll] [N/A, N/A]
[PID: 1924][C:\Program Files\Tiny Firewall Pro\tralogan.exe] [Computer Associates International, Inc., 6.0.0.17]
[C:\windows\system32\jnavavm.dll] [N/A, N/A]
[PID: 3704][C:\windows\IMEINPUTS.EXE] [N/A, N/A]
[PID: 2948][C:\windows\jnavavm.exe] [N/A, N/A]
[C:\windows\system32\jnavavm.dll] [N/A, N/A]
[PID: 3744][C:\windows\System32\alg32.exe] [N/A, N/A]
[PID: 1000][C:\DOCUME~1\baohelin\LOCALS~1\Temp\SPOOLVS.exe] [N/A, N/A]
[PID: 2092][C:\Progra~1\Eset\1explore.exe] [N/A, N/A]
[C:\windows\system32\jnavavm.dll] [N/A, N/A]
==================================
Winsock 提供者
MSAFD Tcpip [TCP/IP]
C:\windows\system32\Winhttps.dll(N/A, N/A)
MT-TcpFilter
C:\windows\system32\Winhttps.dll(N/A, N/A)
=================================
SRENG日志看不到木马添加的下面两个注册表项：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{63202121-F04D-11cf-64CD-33FF5FE1CF20}
"StubPath"="C:\\windows\\system32\\nwizAsktao.exe"
HKEY_CLASSES_ROOT\ferefile
二、用IceSword的手工杀毒流程：
1、禁止进程创建，结束病毒进程（见SRENG日志）。
2、强制卸除正常进程中的病毒模块C:\windows\system32\jnavavm.dll。
3、删除病毒文件（见附图）。
4、删除木马添加的注册表项（见前述）。
5、修复Winsock
附件:
1558472007520150925.jpg 
谢了 baohe