分享
 
 
 

Trojan-Spy.Win32.VB.oe

王朝百科·作者佚名  2010-02-19
窄屏简体版  字體: 小|中|大|超大  

病毒名称： Trojan-Spy.Win32.VB.oe

病毒类型： 木马

文件 MD5： B61DF4379D30063FDFCA883E8B9FA2AC

公开范围： 完全公开

危害等级： 中

文件长度： 155,648 字节

感染系统： windows98以上版本

开发工具： Microsoft Visual Basic 5.0 / 6.0

加壳类型： 无

命名对照： Symentec[]

Mcafee[]

病毒描述：

该病毒属木马类，病毒运行后复制自身到%system32%下，并衍生Microsoft Visual Basic所必须的控件mswinsck.ocx 到%system32%目录下，修改注册表，添加启动项，以达到随机启动的目的。

行为分析：

1、病毒运行后复制自身到%system32%下，并释放Microsoft Visual Basic所必须的控件：

%system32%mswinsck.ocx

%system32%病毒名.exe

2、修改注册表，添加启动项，以达到随机启动的目的：

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows

CurrentVersionRun

键值: 字串: "病毒名"="C:WINDOWSsystem32病毒名"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Control

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

Implemented Categories{0DE86A52-2BAA-11CF-A229-00AA003D7352}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{0DE86A53-2BAA-11CF-A229-00AA003D7352}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{0DE86A57-2BAA-11CF-A229-00AA003D7352}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{40FC6ED4-2438-11CF-A3DB-080036F12502}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{40FC6ED5-2438-11CF-A3DB-080036F12502}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

键值: 字串: "@"="C:WINDOWSsystem32MSWINSCK.OCX"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

键值: 字串: "ThreadingModel "="Apartment"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}MiscStatus

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}MiscStatus1

键值: 字串: "@"="132497"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{248DD896-BB45-11CF-9ABC

0080C7E7B78D}MiscStatus

键值: 字串: "@"="0"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}ProgID

键值: 字串: "@"="MSWinsock.Winsock.1"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Programmable

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}ToolboxBitmap32

键值: 字串: "@"="C:WINDOWSsystem32MSWINSCK.OCX, 1"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{248DD896-BB45-

11CF-9ABC-0080C7E7B78D}Version

键值: 字串: "@"="1.0"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

VersionIndependentProgID

键值: 字串: "@"="MSWinsock.Winsock"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD897-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="Winsock General Property Page Object"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD897-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

键值: 字串: "@"="C:WINDOWSsystem32MSWINSCK.OCX"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="IMSWinsockControl"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid32

键值: 字串: "@"="{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid

键值: 字串: "@"="{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "Version "="1.0"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="DMSWinsockControlEvents"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface{248DD893-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid32

键值: 字串: "@"="{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid

键值: 字串: "@"="{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "Version"="1.0"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.Winsock.1

键值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.Winsock.1CLSID

键值: 字串: "@"="{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.Winsock

键值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.WinsockCLSID

键值: 字串: "@"="{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.WinsockCurVer

键值: 字串: "@"="MSWinsock.Winsock.1"

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLi

b{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0win32

键值: 字串: """="C:WINDOWSsystem32MSWINSCK.OCX"

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0

键值: 字串: "@"="Microsoft Winsock Control 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0FLAGS

键值: 字串: "@"="2"

注：% System%是一个可变路径。病毒通过查询操作系统来决定当前System文件夹的位置。Windows2000/NT中默认的安装路径是C:WinntSystem32，windows95/98/me中默认的安装路径是C:WindowsSystem，windowsXP中默认的安装路径是C:WindowsSystem32。

--------------------------------------------------------------------------------

清除方案：

1、使用安天木马防线可彻底清除此病毒(推荐)。

2、手工清除请按照行为分析删除对应文件，恢复相关系统设置。

(1) 使用安天木马防线“进程管理”关闭病毒进程

(2) 删除病毒文件

%system32%mswinsck.ocx

%system32%病毒名.exe

(3) 恢复病毒修改的注册表项目，删除病毒添加的注册表项

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows

CurrentVersionRun

键值: 字串: "病毒名"="C:WINDOWSsystem32病毒名"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Control

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{0DE86A52-2BAA-11CF-A229-00AA003D7352}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{0DE86A53-2BAA-11CF-A229-00AA003D7352}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{0DE86A57-2BAA-11CF-A229-00AA003D7352}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

Implemented Categories{40FC6ED4-2438-11CF-A3DB-080036F12502}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{40FC6ED5-2438-11CF-A3DB-080036F12502}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

键值: 字串: "@"="C:WINDOWSsystem32MSWINSCK.OCX"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

键值: 字串: "ThreadingModel "="Apartment"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}MiscStatus

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}MiscStatus1

键值: 字串: "@"="132497"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}MiscStatus

键值: 字串: "@"="0"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}ProgID

键值: 字串: "@"="MSWinsock.Winsock.1"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Programmable

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}ToolboxBitmap32

键值: 字串: "@"="C:WINDOWSsystem32MSWINSCK.OCX, 1"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Version

键值: 字串: "@"="1.0"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}VersionIndependentProgID

键值: 字串: "@"="MSWinsock.Winsock"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD897-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="Winsock General Property Page Object"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD897-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

键值: 字串: "@"="C:WINDOWSsystem32MSWINSCK.OCX"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="IMSWinsockControl"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid32

键值: 字串: "@"="{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid

键值: 字串: "@"="{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "Version "="1.0"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="DMSWinsockControlEvents"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid32

键值: 字串: "@"="{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid

键值: 字串: "@"="{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "Version"="1.0"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.Winsock.1

键值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.Winsock.1CLSID

键值: 字串: "@"="{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.Winsock

键值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.WinsockCLSID

键值: 字串: "@"="{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.WinsockCurVer

键值: 字串: "@"="MSWinsock.Winsock.1"

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC

0080C7E7B78D}1.0win32

键值: 字串: """="C:WINDOWSsystem32MSWINSCK.OCX"

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0

键值: 字串: "@"="Microsoft Winsock Control 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0FLAGS

键值: 字串: "@"="2"

 
 
 
免责声明：本文为网络用户发布，其观点仅代表作者个人观点，与本站无关，本站仅提供信息存储服务。文中陈述内容未经本站证实，其真实性、完整性、及时性本站不作任何保证或承诺，请读者仅作参考，并请自行核实相关内容。
2023年上半年GDP全球前十五强
 百态   2023-10-24
美众议院议长启动对拜登的弹劾调查
 百态   2023-09-13
上海、济南、武汉等多地出现不明坠落物
 探索   2023-09-06
印度或要将国名改为“巴拉特”
 百态   2023-09-06
男子为女友送行，买票不登机被捕
 百态   2023-08-20
手机地震预警功能怎么开？
 干货   2023-08-06
女子4年卖2套房花700多万做美容：不但没变美脸，面部还出现变形
 百态   2023-08-04
住户一楼被水淹 还冲来8头猪
 百态   2023-07-31
女子体内爬出大量瓜子状活虫
 百态   2023-07-25
地球连续35年收到神秘规律性信号，网友：不要回答！
 探索   2023-07-21
全球镓价格本周大涨27%
 探索   2023-07-09
钱都流向了那些不缺钱的人，苦都留给了能吃苦的人
 探索   2023-07-02
倩女手游刀客魅者强控制（强混乱强眩晕强睡眠）和对应控制抗性的关系
 百态   2020-08-20
美国5月9日最新疫情：美国确诊人数突破131万
 百态   2020-05-09
荷兰政府宣布将集体辞职
 干货   2020-04-30
倩女幽魂手游师徒任务情义春秋猜成语答案逍遥观：鹏程万里
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案神机营：射石饮羽
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案昆仑山：拔刀相助
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案天工阁：鬼斧神工
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案丝路古道：单枪匹马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野：与虎谋皮
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野：李代桃僵
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野：指鹿为马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵：小鸟依人
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵：千金买邻
 干货   2019-11-12
 
推荐阅读
 
 
 
>>返回首頁<<
 
靜靜地坐在廢墟上，四周的荒凉一望無際，忽然覺得，淒涼也很美
© 2005- 王朝網路 版權所有