Win32.Troj.QQPass.nw

王朝百科·作者佚名  2010-01-30
窄屏简体版  字體: |||超大  

病毒别名: 处理时间:2007-02-06 威胁级别:★

中文名称: 病毒类型:木马 影响系统:Win 9x/ME,Win 2000/NT,Win XP,Win 2003

病毒行为:

这是一个盗取QQ帐号密码的木马病毒。

1、复制自身到如下路径:

%system%severe.exe

%system%jusodl.exe

%system%driverspnvifj.exe

%system%driversconime.exe

释放病毒文件到%system%jusodl.dll

2、在每个磁盘根目录下生成如下病毒文件,当用户双击盘符时会激活病毒

OSO.EXE、autorun.inf

3、改写hosts文件,屏蔽如下安全网站:

127.0.0.1 localhost

127.0.0.1 mmsk.cn

127.0.0.1 ikaka.com

127.0.0.1 safe.qq.com

127.0.0.1 360safe.com

127.0.0.1 www.mmsk.cn

127.0.0.1 www.ikaka.com

127.0.0.1 tool.ikaka.com

127.0.0.1 www.360safe.com

127.0.0.1 zs.kingsoft.com

127.0.0.1 forum.ikaka.com

127.0.0.1 up.rising.com.cn

127.0.0.1 scan.kingsoft.com

127.0.0.1 kvup.jiangmin.com

127.0.0.1 reg.rising.com.cn

127.0.0.1 update.rising.com.cn

127.0.0.1 update7.jiangmin.com

127.0.0.1 download.rising.com.cn

127.0.0.1 dnl-us1.kaspersky-labs.com

127.0.0.1 dnl-us2.kaspersky-labs.com

127.0.0.1 dnl-us3.kaspersky-labs.com

127.0.0.1 dnl-us4.kaspersky-labs.com

127.0.0.1 dnl-us5.kaspersky-labs.com

127.0.0.1 dnl-us6.kaspersky-labs.com

127.0.0.1 dnl-us7.kaspersky-labs.com

127.0.0.1 dnl-us8.kaspersky-labs.com

127.0.0.1 dnl-us9.kaspersky-labs.com

127.0.0.1 dnl-us10.kaspersky-labs.com

127.0.0.1 dnl-eu1.kaspersky-labs.com

127.0.0.1 dnl-eu2.kaspersky-labs.com

127.0.0.1 dnl-eu3.kaspersky-labs.com

127.0.0.1 dnl-eu4.kaspersky-labs.com

127.0.0.1 dnl-eu5.kaspersky-labs.com

127.0.0.1 dnl-eu6.kaspersky-labs.com

127.0.0.1 dnl-eu7.kaspersky-labs.com

127.0.0.1 dnl-eu8.kaspersky-labs.com

127.0.0.1 dnl-eu9.kaspersky-labs.com

127.0.0.1 dnl-eu10.kaspersky-labs.com

4、修改如下注册表项开机自动启动:

[HKLMSoftwareMicrosoftWindowsCurrentVersionRun]

"pnvifj"="C:WINDOWSsystem32jusodl.exe"

[HKLMSoftwareMicrosoftWindowsCurrentVersionRun]

"jusodl"="C:WINDOWSsystem32severe.exe"

[HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon]

"Shell"="Explorer.exe C:WINDOWSsystem32driversconime.exe"

修改如下项,隐藏病毒文件:

[HKLMsoftwaremicrosoftwindowscurrentversionexploreradvancedfolderhiddenshowall]

CheckedValue="0"

修改如下键值,使正常文件的运行路径指向病毒文件:

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsMagicSet.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsRav.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsavp.comDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsavp.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKRegEx.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKvDetect.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKvXP.kxpDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsTrojDie.kxpDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKVMonXP.kxpDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsIceSword.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsmmsk.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsWoptiClean.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionskabaload.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Options360Safe.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Options

uniep.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsiparmo.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsadam.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsRavMon.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsQQDoctor.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsSREng.EXEDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsRas.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsconfig.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Options

egedit.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Options

egedit.comDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsconfig.comDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsPFWLiveUpdate.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsEGHOST.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsNOD32.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"

5、查找含有如下字符串的窗口,找到则将其关闭:

杀毒、专杀、病毒、木马、注册表。

停止并禁用如下安全服务:

srservice

sharedaccess

KVWSC

KVSrvXP

kavsvc

RsRavMon

RsCCenter

RsRavMon

终止如下安全进程:

"cmd.exe"

"net.exe"

"sc1.exe"

"net1.exe"

"PFW.exe"

"Kav.exe"

"KVOL.exe"

"KVFW.exe"

"adam.exe"

"qqav.exe"

"qqkav.exe"

"TBMon.exe"

"kav32.exe"

"kvwsc.exe"

"CCAPP.exe"

"KRegEx.exe"

"kavsvc.exe"

"VPTray.exe"

"RAVMON.exe"

"EGHOST.exe"

"KavPFW.exe"

"SHSTAT.exe"

"RavTask.exe"

"TrojDie.kxp"

"Iparmor.exe"

"MAILMON.exe"

"MCAGENT.exe"

"KAVPLUS.exe"

"RavMonD.exe"

"Rtvscan.exe"

"Nvsvc32.exe"

"KVMonXP.exe"

"Kvsrvxp.exe"

"CCenter.exe"

"KpopMon.exe"

"RfwMain.exe"

"KWATCHUI.exe"

"MCVSESCN.exe"

"MSKAGENT.exe"

"kvolself.exe"

"KVCenter.kxp"

"kavstart.exe"

"RAVTIMER.exe"

"RRfwMain.exe"

"FireTray.exe"

"UpdaterUI.exe"

"KVSrvXp_1.exe"

"RavService.exe"

7、寻找QQ登陆窗口,记录键盘,获得用户密码后通过自身的邮件引擎发送出去。

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
 
© 2005- 王朝網路 版權所有 導航