一个类似AV终结者的新病毒的分析 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛一个类似AV终结者的新病毒的分析

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

一个类似AV终结者的新病毒的分析

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-07-04 12:05 \| 只看楼主短消息资料字号：小中大 1楼一个类似AV终结者的新病毒的分析昨天拿到一个病毒据说类似AV终结者，测试了一下结果如下: File: debug.exe Size: 46592 bytes MD5: 153D51C2BB487B1DFE9F40355C34BE23 SHA1: 13B4466D8CEFC5A71B787E5B8AB21CDB8FEB8049 CRC32: 6EB3D331 加壳方式：ASPack 2.12 瑞星卡巴等还不能检测出该病毒文件变化: 释放文件 C:\WINDOWS\Debug\debug.exe C:\WINDOWS\Web\css.css C:\MSDOS.log C:\WINDOWS\Temp\~tmp83.tmp 在D盘 E盘下生成gbk.com和autorun.inf C:\WINDOWS\Web\css.css插入其他进程结束如下进程 kvmonxp.kxp kvsrvxp.exe trojdie.kxp kregex.exe uihost.exe avp.exe avp.exe 360safe.exe runiep.exe ras.exe ccenter.exe ravtask.exe ravmon.exe ravmond.exe ravstub.exe kwatch.exe kavstart.exe kpfwsvc.exe kmailmon.exe kpfw32.exe kavsvc.exe kav.exe 关闭如下服务并把相应服务的启动类型改为禁用 sharedaccess ccenter kvsrvxp kvwsc kavsvc kingsoft antivirus kwatch service kingsoft personal firewall service rsravmon service rising proxy service rising process communication center rising personal firewall service 卡巴斯基反病毒6.0个人版创建如下影像劫持项 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\conime.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.COM HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.EXE.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zxsweep.exe 指向 C:\WINDOWS\Debug\debug.exe 2007-07-04 12:59:49
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	分享到：

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-07-04 12:05 \| 只看楼主短消息资料字号：小中大 2楼 C:\WINDOWS\Web\css.css监视 IFEO键值的修改如果一旦被删除则马上恢复删除HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden 键破坏显示隐藏文件连接网络下载http://xxxxxxxx.mircosofts.com/history.txt到C盘下读取里面的内容下载木马 http://xxxxxxxx.2288.org/ms_info32.exe http://xxxxxxxx.2288.org/ms_info33.exe http://xxxxxxxx.2288.org/bots.exe 到C:\Windows下面分别命名为1.exe~3.exe 木马运行完毕后生成的文件如下 C:\WINDOWS\1.exe C:\WINDOWS\2.bat C:\WINDOWS\2.exe C:\WINDOWS\2.vbs C:\WINDOWS\3.exe C:\WINDOWS\IEXPLORE.EXE C:\WINDOWS\tmp$$$.vbs C:\WINDOWS\W1NL0GON.EXE C:\WINDOWS\system32\comspn.dll C:\WINDOWS\system32\inetcfg.h C:\WINDOWS\system32\mst.tlb C:\WINDOWS\system32\SCardSer.exe C:\WINDOWS\system32\spnup.dll 其中1.exe会把系统时间改为2099年12月30日 sreng日志情况启动项目 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <MS Reporter(dont disable)><C:\WINDOWS\W1NL0GON.EXE> [] 服务 [Net Login Helper / netlog][Stopped/Auto Start] <C:\WINDOWS\system32\SCardSer.exe ><N/A> 测试中未发现主程序有创建启动项的行为很奇怪解决方法：安全模式下(开机后不断按F8键然后出来一个高级菜单选择第一项安全模式进入系统) 首先把系统时间改回来把sreng改名为其他名称运行启动项目注册表删除如下项目 <MS Reporter(dont disable)><C:\WINDOWS\W1NL0GON.EXE> [] “启动项目”-“服务”-“Win32服务应用程序”中点“隐藏经认证的微软项目”，选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”： Net Login Helper / netlog 把下面的代码拷入记事本中然后另存为1.reg文件 Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] "RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" "Text"="@shell32.dll,-30500" "Type"="radio" "CheckedValue"=dword:00000001 "ValueName"="Hidden" "DefaultValue"=dword:00000002 "HKeyRoot"=dword:80000001 "HelpID"="shell.hlp#51105" 双击1.reg把这个注册表项导入双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹" 并清除"隐藏受保护的操作系统文件（推荐）"前面的钩。在提示确定更改时，单击“是” 然后确定然后删除C:\WINDOWS\1.exe C:\WINDOWS\2.bat C:\WINDOWS\2.exe C:\WINDOWS\2.vbs C:\WINDOWS\3.exe C:\WINDOWS\IEXPLORE.EXE C:\WINDOWS\tmp$$$.vbs C:\WINDOWS\W1NL0GON.EXE C:\WINDOWS\system32\comspn.dll C:\WINDOWS\system32\inetcfg.h C:\WINDOWS\system32\mst.tlb C:\WINDOWS\system32\SCardSer.exe C:\WINDOWS\system32\spnup.dll C:\WINDOWS\Debug\debug.exe C:\WINDOWS\Web\css.css C:\MSDOS.log C:\WINDOWS\Temp\~tmp83.tmp 右键点击菜单中的打开打开D E删除gbk.com和autorun.inf 重启计算机进入正常模式下载 autoruns http://www.skycn.com/soft/17567.html 由于这个软件也被映像劫持了所以我们把他改个名字打开这个软件后找到Image hijack (映像劫持）删除除了Your Image File Name Here without a pathSymbolic Debugger for Windows 2000 Microsoft Corporation c:\windows\system32\ntsd.exe 以外的所有项目然后修复你的杀毒软件和其他安全软件全盘杀毒即可
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

HOSTのS 飘泊而立狮帖子:784 注册: 2007-06-10 来自:	发表于： 2007-07-04 12:12 \| 短消息资料字号：小中大 3楼不错建议置顶
HOSTのS 飘泊而立狮帖子:784 注册: 2007-06-10 来自:

haohe的fans 叱咤花甲狮帖子:2818 注册: 2007-06-17 来自:	发表于： 2007-07-04 12:47 \| 短消息资料字号：小中大 4楼学习了
haohe的fans 叱咤花甲狮帖子:2818 注册: 2007-06-17 来自:

haohe的fans 叱咤花甲狮帖子:2818 注册: 2007-06-17 来自:	发表于： 2007-07-04 12:48 \| 短消息资料字号：小中大 5楼建议置顶
haohe的fans 叱咤花甲狮帖子:2818 注册: 2007-06-17 来自:

有毒必问锋芒艾服狮帖子:1653 注册: 2005-02-13 来自:廣東	发表于： 2007-07-04 12:49 \| 短消息资料字号：小中大 6楼都几麻烦的病毒，不过今天又有收获了，谢谢~
有毒必问锋芒艾服狮帖子:1653 注册: 2005-02-13 来自:廣東

暗焰欣空拙长孩提狮帖子:142 注册: 2007-03-23 来自:	发表于： 2007-07-04 13:10 \| 短消息资料字号：小中大 7楼学习了~~
暗焰欣空拙长孩提狮帖子:142 注册: 2007-03-23 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT