病毒名称(中文):
病毒别名:
威胁级别:
★★☆☆☆
病毒类型:
木马程序
病毒长度:
232463
影响系统:
Win9xWin2000WinXPWin2003
病毒行为:
编写工具：Delphi
传染条件:
发作条件:
系统修改:
释放文件到%System%
jxhwxj.dll和c:filedebug
修改注册表，添加：
[HKEY_CLASSES_ROOTQPWorkFile]
[HKEY_CLASSES_ROOTQPWorkFile]
"EFile"="052034074052039074047117050044088244174069155003143226175040196060132196115114202169224193030068236097086176002045218004223"
[HKEY_CLASSES_ROOTQPWorkFile]
"DFile"="051036066052037069063176050034084104161066198094084009070246077096139208096164230189003123109239045161109039040061175072044099"
[HKEY_CLASSES_ROOTQPWorkFile]
"UC"="052039077052039077039086050045093239037049154173172027136176"
[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHook]
[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHook]
@="Maihook7003"
[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHookClsid]
[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHookClsid]
@="{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}"
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}]
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}]
@="Maihook7003"
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}InprocServer32]
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}InprocServer32]
@="C:\WINDOWS\SYSTEM\RJXHWXJ.DLL"
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}InprocServer32]
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}ProgID]
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}ProgID]
@="RJXHWXJ.ShellExecuteHook"
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionexplorerShellExecuteHooks]
"{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}"="Maihook7003"
[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]
[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]
"EFile"="052034074052039074047117050044088244174069155003143226175040196060132196115114202169224193030068236097086176002045218004223"
[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]
"DFile"="051036066052037069063176050034084104161066198094084009070246077096139208096164230189003123109239045161109039040061175072044099"
[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]
"UC"="052039077052039077039086050045093239037049154173172027136176"
[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHook]
[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHook]
@="Maihook7003"
[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHookClsid]
[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHookClsid]
@="{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}"
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}]
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}]
@="Maihook7003"
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}InprocServer32]
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}InprocServer32]
@="C:\WINDOWS\SYSTEM\RJXHWXJ.DLL"
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}InprocServer32]
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}ProgID]
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}ProgID]
@="RJXHWXJ.ShellExecuteHook"
发作现象:
盗窃边锋、QQ密码，并发送给木马作者的邮箱。可以杀常见国产杀毒软件的进程。
非凡说明:
