图文请参考
http://hi.baidu.com/sreng/blog/item/617c8358438066dc9c8204da.html在修复过程,还有异常,请发邮件:ufwihgu9168@yahoo.com.cn
File: qq.rar
MD5: 97abe0065e045a8c99a7aac81fbdc821
Rising: Win32.Eirus.b
卡巴不报病毒
测试时间:2007-08-19
更新时间:
运行后病毒样本,自动删除病毒本身,自动复制副本到%SYSTEM%目录下
%SYSTEMroot%\svhostkeep.exe
%SYSTEMroot%\svhost.exe
x:\Documents and Settings\你的用户名\Local Settings\Temp\E_4\spec.fne
x:\Documents and Settings\你的用户名\Local Settings\Temp\E_4\eapi.fne
x:\Documents and Settings\你的用户名\Local Settings\Temp\E_4\iext2.fne及所创建的文件.
x:\Recycled\krnln.exe
X:\Program Files\QQ\QQ .exe<见图一>
删除桌面上QQ及QQ直播的,
X:\Documents and Settings\MIB\桌面\QQ
X:\Documents and Settings\MIB\桌面\QQlive5.0
并替换在桌面上的QQ快捷方式及QQ目录下的QQ文件.
x:\Documents and Settings\MIB\桌面\腾讯QQ.lnk
中止所有杀毒软件<俺的电脑使用的MACFEE,可惜没有中断掉,关闭了QQ医生,
创建下列IFEO劫持项：
"Debugger"="X:\windows\system32\svhost.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdPop.Exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdPop.Exe ]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AUTODOWN.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE ]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPM.EXE ]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavscr.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVsvc.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSvcUI.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.EXE ]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVFW.EXE g']
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVwsc.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MAILMON.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NMain.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfw.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVmonD.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravtimer.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rising.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RTHDCPL.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srtask.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TBSCAN.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TCA.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\THGUARD.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanHunter.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WEBSCANX.EXE]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiprvse.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiProcess.exe]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\修复工具.exe]
附SRENG日志:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><C:\windows\system32\C:\Recycled\krnln.exe,userinit.exe,svhost.exe>[(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdPop.Exe]
<IFEO[AdPop.Exe]><svhost.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdPop.Exe ]
<IFEO[AdPop.Exe ]><mmsb.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AUTODOWN.EXE]
<IFEO[AUTODOWN.EXE]><svhost.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE ]
<IFEO[AVP.EXE ]><svhost.exe> []
HOSTS 文件
127.0.0.1 www.360safe.com
127.0.0.1 360safe.com
127.0.0.1 www.skycn.com/soft/3252.html
127.0.0.1 skycn.com/soft/3252.html
127.0.0.1 www.skycn.com/soft/24158.html
127.0.0.1 skycn.com/soft/24158.html
127.0.0.1 mmsk.cn
127.0.0.1 www.mmsk.cn
127.0.0.1 www.luosoft.com/index1.htm
127.0.0.1 www.luosoft.com/index2.htm
127.0.0.1 www.luosoft.com/index3.htm
127.0.0.1 luosoft.com/index3.htm
127.0.0.1 www.luosoft.com
127.0.0.1 luosoft.com
127.0.0.1 safe.qq.com/product
127.0.0.1 safe.qq.com
127.0.0.1 www.safe.qq.com/product
127.0.0.1 www.safe.qq.com
127.0.0.1 www.onlinedown.net/soft/37369.htm
解决方法:
1.把IceSword.exe更改文件名为:ceSword.exe,双击运行后.
文件---设置---禁止进线性创建,结束病毒进程:svhost.exe
2.直接使用ceSword.exe删除病毒文件
%SYSTEMroot%\svhostkeep.exe
%SYSTEMroot%\svhost.exe
嘻嘻!在这里没有把autoruns劫持,取消禁止进线性创建后,直接运行autoruns<见图>,一步一步删除也行,想偷懒可以使用其它工具来修复.
3.运行SREng2,使用“启动项目”－－注册表－－选择要修改的项
<Userinit><C:\windows\system32\C:\Recycled\krnln.exe,userinit.exe,svhost.exe>
，点“编辑”在“值”里删除C:\Recycled\krnln.exe,svhost.exe>
4.重置HOSTS文件.
5.运行SREng2,使用：系统修复－－文件关联－－全选－－修复
6.卸载掉QQ.同时删除QQ文件夹.重新安装一次.
7.x:\Documents and Settings\你的用户名\Local Settings\Temp\E_4\删除文件夹.
[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
