【原创】oxjsybe.exe病毒分析——一款U盘病毒 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛【原创】oxjsybe.exe病毒分析——一款U盘病毒

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

【原创】oxjsybe.exe病毒分析——一款U盘病毒

UFO不幸外人特邀体验者帖子:2592 注册: 2006-11-26 来自:火星	发表于： 2007-07-29 17:55 \| 只看楼主短消息资料字号：小中大 1楼【原创】oxjsybe.exe病毒分析——一款U盘病毒转载请注明：UFO不幸外人原文发表于我的blog：http://blog.sina.com.cn/u/1454519003 原文地址：http://blog.sina.com.cn/u/56b232db01000a86#comment 病毒及文件的基本信息：样本文件名称：oxjsybe.exe 文件基本大小：25392B MD5：a348330fd62a39246555c0bbc1cc0495 加壳：FSG 2.0 病毒名称：rising：Worm.Agent.xh 病毒启动方式：注册表启动病毒释放文件： C:\Program Files\Common Files\Microsoft Shared\eleicnd.exe（病毒文件） C:\Program Files\Common Files\System\asgwmne.exe（病毒文件） C:\Program Files\meex.exe（病毒文件） C:\Program Files\psdoawu.inf 下载的木马： C:\Documents and Settings\zhang\Local Settings\Temp\LYLOADER.EXE（下载的木马） C:\Documents and Settings\zhang\Local Settings\Temp\LYMANGR.DLL（下载的木马） C:\Documents and Settings\zhang\Local Settings\Temp\MSDEG32.DLL（下载的木马） C:\Documents and Settings\zhang\Local Settings\Temporary Internet Files\Content.IE5\Y7Y94XIP\tl[1].exe（木马安装程序） C:\Program Files\6Ftl.exe（下载的木马） C:\WINDOWS\system32\dllhost32.exe（下载的木马） C:\WINDOWS\system32\LYLOADER.EXE（下载的木马） C:\WINDOWS\system32\LYMANGR.DLL（下载的木马） C:\WINDOWS\system32\msdebug.dll（下载的木马） C:\WINDOWS\system32\MSDEG32.DLL（下载的木马） C:\WINDOWS\system32\windhcp.ocx（下载的木马） C:\WINDOWS\system32\WMIApiSrv.dll（下载的木马） C:\WINDOWS\system32\zt104.dll（下载的木马）各盘符文件修改： X:\autorun.inf X:\oxjsybe.exe autorun.inf文件内容： [AutoRun] open=oxjsybe.exe shell\open=打开(&O) shell\open\Command=oxjsybe.exe shell\open\Default=1 shell\explore=资源管理器(&X) shell\explore\Command=oxjsybe.exe 注册表的修改：添加病毒启动项： HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ MSDQG32: "LYLoadqr.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ psdoawu: "C:\Program Files\Common Files\System\asgwmne.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ oxjsybe: "C:\Program Files\Common Files\Microsoft Shared\eleicnd.exe" 修改注册表，禁止显示所有文件及文件夹 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\ CheckedValue: 0x00000000 修改注册表，禁用自动更新、Windows防火墙、帮助和支持 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\ Start: 0x00000004 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\ Start: 0x00000004 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\ Start: 0x00000004 删除注册表，破坏安全模式： HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\ HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ [用户系统信息]Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; InfoPath.2) 2007-07-31 15:09:49
UFO不幸外人特邀体验者帖子:2592 注册: 2006-11-26 来自:火星	分享到：

UFO不幸外人特邀体验者帖子:2592 注册: 2006-11-26 来自:火星	发表于： 2007-07-29 17:56 \| 只看楼主短消息资料字号：小中大 2楼创建IFEO（Image File Execution Options）劫持，劫持下列EXE文件，使其双击运行时，运行病毒的C:\Program Files\Common Files\Microsoft Shared\eleicnd.exe文件 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FYFireWall.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPfwSvc.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.com HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPFMntor.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe
UFO不幸外人特邀体验者帖子:2592 注册: 2006-11-26 来自:火星

UFO不幸外人特邀体验者帖子:2592 注册: 2006-11-26 来自:火星	发表于： 2007-07-29 17:56 \| 只看楼主短消息资料字号：小中大 3楼 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQKav.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.EXE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upiea.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBCleaner.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe
UFO不幸外人特邀体验者帖子:2592 注册: 2006-11-26 来自:火星

UFO不幸外人特邀体验者帖子:2592 注册: 2006-11-26 来自:火星	发表于： 2007-07-29 17:57 \| 只看楼主短消息资料字号：小中大 4楼病毒的运行原理病毒通过autorun.inf的方式传播，主要途径是移动介质，如：U盘、移动硬盘等。当用户在不知情的情况下，运行了此病毒，病毒会查找某些指定文件或文件夹后，迅速建立C:\Program Files\Common Files\System\asgwmne.exe文件，并启动运行，然后建立C:\Program Files\Common Files\Microsoft Shared\eleicnd.exe文件，启动运行，并开始了双进程保护工作。病毒的保护机制 1、利用IFEO（Image File Execution Options）劫持保护。IFEO劫持下列EXE文件，使其双击运行时，运行病毒的C:\Program Files\Common Files\Microsoft Shared\eleicnd.exe文件，这些EXE文件多数为著名杀毒软件，也有部分杀毒时常用的辅助工具，如：瑞星杀毒软件、卡巴斯基、冰刃（IceSword）、SReng（System Repair Engineer）等等。 2、双进程保护。启动C:\Program Files\Common Files\Microsoft Shared\eleicnd.exe文件后，迅速启动C:\Program Files\Common Files\System\asgwmne.exe文件，进行双进程保护，难以在Windows结束病毒进程，从而删除病毒。若用冰刃（IceSword）“禁止进线程建立”后，只能结束asgwmne.exe进程，无法结束eleicnd.exe进程，但是此时病毒已经失去了对自身的保护。 3、autorun.inf保护。在每一个盘的根目录下建立autorun.inf和oxjsybe.exe这两个文件，并检测U盘插入，如果有U盘插入，则迅速在U盘下建立autorun.inf和oxjsybe.exe这两个文件。若根目录下存在autorun.inf文件或文件夹，病毒会自动删除后再建立文件，如果病毒无法删除，会把文件夹更名为：hoowods，然后再建立文件。删除方法： 1、结束进程：打开冰刃（IceSword）选中“禁止进线程建立”后，结束asgwmne.exe进程，无法结束eleicnd.exe进程，但是此时病毒已经失去了对自身的保护。 2、在冰刃中，利用强制删除，删除病毒文件及其下载的木马 3、删除注册表中的启动项目 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ MSDQG32: "LYLoadqr.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ psdoawu: "C:\Program Files\Common Files\System\asgwmne.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ oxjsybe: "C:\Program Files\Common Files\Microsoft Shared\eleicnd.exe" 4、重新启动计算机 5、利用新版SREng删除IFEO劫持，修复安全模式。 6、修改注册表，启用自动更新、Windows防火墙、帮助和支持 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\ Start: 0x00000002 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\ Start: 0x00000002 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\ Start: 0x00000002 7、修改注册表，修复禁用的“显示所有文件及文件夹” HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\ CheckedValue: 0x00000001 注：下载的木马可能会发生变化，请大家留心观察
UFO不幸外人特邀体验者帖子:2592 注册: 2006-11-26 来自:火星

gwlucker 快乐黄口狮帖子:202 注册: 2006-10-06 来自:	发表于： 2007-07-29 18:06 \| 短消息资料字号：小中大 5楼貌似中过……还杀过，感觉跟AV差不多... 7位的随机码+木马下载器...
gwlucker 快乐黄口狮帖子:202 注册: 2006-10-06 来自:

超级游戏迷卡卡技术团队帖子:25779 注册: 2007-01-14 来自:	发表于： 2007-07-29 18:12 \| 短消息资料字号：小中大 6楼楼主辛苦了，顶！此文我已收藏了，学习一下。
超级游戏迷卡卡技术团队帖子:25779 注册: 2007-01-14 来自:

UFO不幸外人特邀体验者帖子:2592 注册: 2006-11-26 来自:火星	发表于： 2007-07-29 18:19 \| 只看楼主短消息资料字号：小中大 7楼要病毒样本的直接发邮件 1987noodle0158@sina.com
UFO不幸外人特邀体验者帖子:2592 注册: 2006-11-26 来自:火星

孤独更可靠锋芒艾服狮帖子:1788 注册: 2007-01-27 来自:	发表于： 2007-07-29 18:36 \| 短消息资料字号：小中大 8楼呵呵，学习了~！很详细呢``
孤独更可靠锋芒艾服狮帖子:1788 注册: 2007-01-27 来自:

zhongzhi 快乐黄口狮帖子:167 注册: 2006-08-06 来自:	发表于： 2007-07-29 21:17 \| 短消息资料字号：小中大 9楼又见到外幸人贴子了，学习。
zhongzhi 快乐黄口狮帖子:167 注册: 2006-08-06 来自:

素就像天上的浮云快乐黄口狮帖子:206 注册: 2007-02-13 来自:	发表于： 2007-07-29 22:19 \| 短消息资料字号：小中大 10楼辛苦
素就像天上的浮云快乐黄口狮帖子:206 注册: 2007-02-13 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT