Win32.PSWTroj.QQPass
病毒别名： 处理时间：2007-03-30 威胁级别：★
中文名称： 病毒类型：木马 影响系统：Win 9x/ME,Win 2000/NT,Win XP,Win 2003
病毒行为:
该病毒是一个QQ盗号木马。
1、生成的文件
%SystemRoot%system32severe.exe
%SystemRoot%system32mmlucj.exe
%SystemRoot%system32driversavipit.exe
%SystemRoot%system32driversconime.exe
%SystemRoot%system32mmlucj.dll
2、添加启动项
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
"mmlucj" = "%SystemRoot%system32severe.exe"
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
"avipit" = "%SystemRoot%system32mmlucj.exe"
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon
"Shell" = "%SystemRoot%system32driversconime.exe"
3、结束下列进程
PFW.exe,Kav.exe,KVOL.exe,KVFW.exe,adam.exe,qqav.exe,qqkav.exe,TBMon.exe,kav32.exe,kvwsc.exe,CCAPP.exe,KRegEx.exe,kavsvc.exe,VPTray.exe,RAVMON.exe,EGHOST.exe,KavPFW.exe,SHSTAT.exe,RavTask.exe,TrojDie.kxp,Iparmor.exe,MAILMON.exe,MCAGENT.exe,KAVPLUS.exe,RavMonD.exe,Rtvscan.exe,Nvsvc32.exe,KVMonXP.exe,Kvsrvxp.exe,CCenter.exe,KpopMon.exe,RfwMain.exe,KWATCHUI.exe,MCVSESCN.exe,MSKAGENT.exe,kvolself.exe,KVCenter.kxp,kavstart.exe,RAVTIMER.exe,RRfwMain.exe,FireTray.exe,UpdaterUI.exe,KVSrvXp_1.exe,RavService.exe
4、修改注册表使系统总是不显示隐藏文件。
softwaremicrosoftwindowscurrentversionexploreradvancedfolderhiddenshowall
"CheckedValue" = "0"
5、该病毒在d，e，f，g，h，i盘生成autorun.inf和OSO.exe作成autorun启动。
--------------------------------
[AutoRun]
open=OSO.exe
shellexecute=OSO.exe
shellAutocommand=OSO.exe
---------------------------------
6、使用互斥体，使下列进程不能运行
A}cNqqc{[TWQkgdfv7(3 = ExeMutex_QQRobber2.0
@ijNqqc{[TWQkgdfv7(3 = DllMutex_QQRobber2.0
AntiTrojan3721
ASSISTSHELLMUTEX
SKYNET_PERSONAL_FIREWALL
KingsoftAntivirusScanProgram7Mutex
7、访问下列网址，并会尝试下载@#$#.htm、30w.txt、dqhx1.txt、down.txt、dqhx3.txt等文件。
lqrs>*)tsr(``642*fin = http://***.cd321.com
lqrs>*)tsr(``642*kcw = http://***.cd321.net
lqrs>*)tsr(532?43+eli = http://***.677977.com
lqrs>*)tsr(`ps757+eli = http://***.ctv163.com
lqrs>*)tsr(``642*kcw+66t*q~w = http://***.cd321.net/30w.txt
lqrs>*)tsr(`ps757+eli*ggilh,`jqm*q~w = http://***.cd321.com/admin/down.txt
8、生成并执行hx1.bat处理文件，设置系统时间为2004-1-22。
9、调用sc.exe程序停止相关反病毒软件服务和禁止启动运行
-----------------------------------------
stop KVWSC
config KVWSC start= disabled
stop KVSrvXP
config KVSrvXP start= disabled
stop kavsvc
config kavsvc start= disabled
stop RsCCenter
config RsCCenter start= disabled
stop RsRavMon
------------------------------------------
10、映像劫持，使得不能使用下列软件
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsMagicSet.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsRav.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsavp.com
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsavp.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKRegEx.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKvDetect.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKvXP.kxp
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsTrojDie.kxp
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKVMonXP.kxp
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsIceSword.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsmmsk.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsWoptiClean.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionskabaload.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Options360Safe.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Options
uniep.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsiparmo.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsadam.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsRavMon.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsQQDoctor.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsSREng.EXE
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsRas.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsconfig.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Options
egedit.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Options
egedit.com
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsconfig.com
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsPFW.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsPFWLiveUpdate.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsEGHOST.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsNOD32.exe
"Debugger" = "%SystemRoot%system32driversavipit.exe"
11、修改host文件，屏蔽下列网址
127.0.0.1 localhost
127.0.0.1 mmsk.cn
127.0.0.1 ikaka.com
127.0.0.1 safe.qq.com
127.0.0.1 360safe.com
127.0.0.1 www.mmsk.cn
127.0.0.1 www.ikaka.com
127.0.0.1 tool.ikaka.com
127.0.0.1 www.360safe.com
127.0.0.1 zs.kingsoft.com
127.0.0.1 forum.ikaka.com
127.0.0.1 up.rising.com.cn
127.0.0.1 scan.kingsoft.com
127.0.0.1 kvup.jiangmin.com
127.0.0.1 reg.rising.com.cn
127.0.0.1 update.rising.com.cn
127.0.0.1 update7.jiangmin.com
127.0.0.1 download.rising.com.cn
127.0.0.1 dnl-us1.kaspersky-labs.com
127.0.0.1 dnl-us2.kaspersky-labs.com
127.0.0.1 dnl-us3.kaspersky-labs.com
127.0.0.1 dnl-us4.kaspersky-labs.com
127.0.0.1 dnl-us5.kaspersky-labs.com
127.0.0.1 dnl-us6.kaspersky-labs.com
127.0.0.1 dnl-us7.kaspersky-labs.com
127.0.0.1 dnl-us8.kaspersky-labs.com
127.0.0.1 dnl-us9.kaspersky-labs.com
127.0.0.1 dnl-us10.kaspersky-labs.com
127.0.0.1 dnl-eu1.kaspersky-labs.com
127.0.0.1 dnl-eu2.kaspersky-labs.com
127.0.0.1 dnl-eu3.kaspersky-labs.com
127.0.0.1 dnl-eu4.kaspersky-labs.com
127.0.0.1 dnl-eu5.kaspersky-labs.com
127.0.0.1 dnl-eu6.kaspersky-labs.com
127.0.0.1 dnl-eu7.kaspersky-labs.com
127.0.0.1 dnl-eu8.kaspersky-labs.com
127.0.0.1 dnl-eu9.kaspersky-labs.com
127.0.0.1 dnl-eu10.kaspersky-labs.com