jiazi

进入DOS杀毒..再重装系统.~~~

7情小渔兒

病毒名称(中文):AV终结者变种65536病毒别名:威胁级别:★★☆☆☆病毒类型:木马下载器病毒长度:13824影响系统:Win9xWinMeWinNTWin2000WinXPWin2003
: i. Z$ j4 M, j$ E  B( I# L. v+ q" |, t病毒行为: * j0 _: q/ e9 f" S9 ]- h
. P! e0 H- c9 @% {3 Y; C
这是AV终结者的一个变种。它会恢复系统SSDT表，关闭杀软进程或映像劫持杀软的进程。该毒会将自己注入到系统进程中运行，以防止被删除，同时会建立大量的AUTO文件，实现自动传播。
# a9 s; U2 y. C8 u" V4 V
2 n2 u- G! [1 _7 {5 T1)搜索当进程中是否含有PID为4的进程，没有退出。判断是否为NT系统。 8 G$ X9 e4 g+ D) `, H  _" X
2)判断当前目录下AUTORUN.INF是否存在，存在，获取当前文件路径的前3个字节，并打开。判断是否从autorun.inf打开。
3 r$ l1 q+ y# H9 Q  j! Z) E3)创建SHALONG互斥体，并判断是否存在，存在则退出。
" q' d; z+ I; [( Z% U" B4)将当前文件设置为隐藏和系统。
: b: _9 n3 Q: Z' U  f! K9 E! Z; x5)删除以下文件
5 f% v% O7 f; Q$ ^- U& Zc:\windows\system32\mfc71.dll 5 c/ |  [* b: b; i& N. @9 O' a
C:\ProgramFiles\Kingsoft\KingsoftInternetSecurity2008\kasbrowsershield.dll
9 A; ?. N4 J: L: `8 B/ od:\ProgramFiles\Kingsoft\KingsoftInternetSecurity2008\kasbrowsershield.dll ( M/ P/ ], b1 s4 v; r
f:\ProgramFiles\Kingsoft\KingsoftInternetSecurity2008\kasbrowsershield.dll
1 K) _+ V' q' r% fc:\windows\system32\drivers\etc\hosts、
" j9 a3 {  d$ ac:\winnt\system32\drivers\etc\hosts。
9 @$ L- z; g( u8 {" |+ ]& k6)搜索当前进程中是否含有safeboxTray.exe(360保险箱)，有了将其进程关闭。
2 o' G: W# x1 ?) O$ z7)将系统时间设置为2004年。
- v; w% c; f2 U# t/ d& K8)运行cacls.exec:\windows\system32\packet.dll/e/peveryone:f
  W9 h$ F; V* m, N1 hcacls.exec:\windows\system32\pthreadVC.dll/e/peveryone:f ) {: N! n* N/ x- |
cacls.exec:\windows\system32\wpcap.dll/e/peveryone:f - s' i' ?6 y% P. ~
cacls.exec:\windows\system32\drivers\npf.sys/e/peveryone:f
& R0 v" R# V! u3 g1 M, xcacls.exec:\windows\system32\npptools.dll/e/peveryone:f 3 P1 x9 d3 y2 q" [; M9 `; n) }
cacls.exec:\windows\system32\drivers\acpidisk.sys/e/peveryone:f   @9 |. E) q4 w( y& v( f+ {/ X  K
cacls.exec:\windows\system32\wanpacket.dll/e/peveryone:f ) z) ^/ g: U& E6 m9 b" @; @
cacls.exec:\DocumentsandSettings\AllUsers\「开始」菜单\程序\启动/e/peveryone:f
& c7 Z0 ^+ e, m+ S" mcacls.exec:\windows\system32\drivers\etc\hosts/e/peveryone:f 5 e5 P1 @& m: a
cacls.exec:\windows\system32\ftp.exe/e/peveryone:f ! K( ^  S2 e( X
将这些文件设置为everyone完全控制。 - E$ l2 p% H; l! B: g' B
9)调用sfc_os.dll的第五个导出函数，将%sys32dir%\drivers\beep.sys、%sys32dir%\spoolsv.exe、%sys32dir%\dllcache\spoolsv.exe的文件保护关闭。 & w5 g3 m2 \0 D, C+ i8 F
10)将beep.sys的服务设置为SERVICE_CONTROL_STOP，并将其文件属性设置为Normal。 ) s# ]! Y& N" ~7 M7 j
11)解密数据段的数据，将其写入beep.sys，并开启beep服务，其功能为恢复ssdt. 1 f8 h1 m" ?# E+ v
12)搜索当前进程中是否含有以下进程，有了关闭。 9 Z" A: I3 s; l
wuauclt.exeEsuSafeguard.exeVsTskMgr.exeAvp.EXEIparmor.exeKVWSC.ExEkvsrvxp.exekvsrvxp.kxpKvXP.kxpKRegEx.exeAntiArp.exeVPTRAY.exeVPC32.exescan32.exeFrameworkService.exeKASARP.exenod32krn.exenod32kui.exeTBMon.exerfwmain.exeRavStub.exerfwstub.exerfwProxy.exerfwsrv.exeUpdaterUI.exekissvc.exekav32.exekwatch.exeKAVPFW.EXEkavstart.exekmailmon.exeGFUpd.exeRavxp.exeGuardField.exeRAVMOND.EXERAVMON.EXECenter.EXERSTray.exeRAv.exeRuniep.exe360rpt.EXE360tray.exe360Safe.exe
' T- f1 ]+ s% p! k  n( N13)关闭以下杀毒软件的服务。
. l/ q7 \9 A1 \5 TNortonAntiVirusServerMcAfeeFramework服务SymantecAntiVirus
+ H0 w. o$ V6 F, w* R: N7 h3 EDefinitionWatcherSymantecAntiVirusDriversServicesSymantecAntiVirusKingsoftInternetSecurityCommonServiceKPfwSvcKWhatchsvcMcShieldsharedaccess 6 c" e; L+ {; }
14)比较当前运行路径是否为%sys32dir%\spoolsv.exe,不是的话，将%sys32dir%\spoolsv.exe移到c:\ttmm.tep,并将自己复制到%sys32dir%\spoolsv.exe和%sys32dir%\dllcache\spoolsv.exe
/ V, U+ |7 G1 t9 h15)调用cmd.exe/cnet1startserver,开启server服务。
( ~) i5 z. \4 @0 G2 l1 O$ x+ n. Q16)隐藏方式打开IE，并将自己下载函数注入到其进程中。
% J" i& u6 w: a! ]1 j9 A⑴将%sys32dir%\urlmon.dll复制到%sys32dir%\aktwkss.dll " J8 ~; L' F0 g( A( h) A
⑵获取函数UrldownloadtofileA,下载以下文件，并运行。 1 w- f  `; m3 ]. ?
到C:\ProgramFiles\ccd.pif - S* e; W0 [9 p8 w' |
到C:\ProgramFiles\11.pif # l# j6 z0 g3 H
到C:\ProgramFiles\22.pif # \0 e: ?3 R2 o+ V9 ?5 D
到C:\ProgramFiles\33.pif ' r7 P9 o$ U6 m' W
到C:\ProgramFiles\44.pif 6 |* R# y7 n. ~( L
到C:\ProgramFiles\55pif
. w9 Z$ g: ?; ~6 W到C:\ProgramFiles\66.pif * a: o1 ]. ]! Y+ g- K, }3 a3 O
到C:\ProgramFiles\77.pif
* b  R" h1 n/ ?6 b9 _) L9 W到C:\ProgramFiles\88.pif
6 j* W. G1 k2 V( F0 V- {- \3 g/ M到C:\ProgramFiles\99.pif ( o) H5 x3 c# s* Z7 g. Y9 z
到C:\ProgramFiles\1010.pif $ K9 l0 C! B. c8 \: ?# X8 n0 R
0 D) ^* L+ `3 P4 E) y7 p2 G
17)添加注册表启动键值
0 F# f2 W# w2 _- x# f( _3 QHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\internetnet:"C:\WINDOWS\system32\spoolsv.exe"
6 j9 z& v$ ~5 Q/ D. Y18)添加映像劫持
0 f/ h( c; c4 bHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
) O+ u4 T# ^3 l9 {* |  Q, s\ImageFileExecutionOptions\360rpt.EXE\debugger:
! R) n6 L8 b' O+ n& t" j; o4 L, F"C:\WINDOWS\system32\dllcache\spoolsv.exe"
* p. a- r- T( V* A! J. H$ P$ u: xHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion / j/ d; ~! E3 W- R
\ImageFileExecutionOptions\360safe.EXE\debugger:
1 H* S8 C4 @( o8 q6 @"C:\WINDOWS\system32\dllcache\spoolsv.exe" 7 U, L" q  i- W2 X* b0 y) Y
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
$ t# j5 a4 l' I1 W  Q- C\ImageFileExecutionOptions\360safebox.EXE\debugger:
) K1 [  N. K/ r4 N& w"C:\WINDOWS\system32\dllcache\spoolsv.exe"
% `; w) l9 X1 C# |5 iHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion * P! `) V7 {! R% d+ P$ M& O/ x
\ImageFileExecutionOptions\360tray.EXE\debugger:
( P# H# s4 A# g" c3 @2 l$ K. ?& q5 e( Y; _"C:\WINDOWS\system32\dllcache\spoolsv.exe"   b& L' Q9 j6 `3 H! R2 e. a/ z
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
8 _* Y& Z, n. g9 A. R\ImageFileExecutionOptions\ANTIARP.EXE\debugger: " G" \! W) G7 ~; j: P. B
"C:\WINDOWS\system32\dllcache\spoolsv.exe" ' g. b7 F) K* p3 A- Z
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
  V7 x3 ]: }: R9 L\ImageFileExecutionOptions\ArSwp.EXE\debugger: 0 a+ I' M& Y0 H
"C:\WINDOWS\system32\dllcache\spoolsv.exe"
% {8 h/ I8 V( h" c4 d2 u  VHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion . s) m: t9 Q: c
\ImageFileExecutionOptions\Ast.EXE\debugger:
% j/ q" a3 n- R6 U; l' c"C:\WINDOWS\system32\dllcache\spoolsv.exe"
5 V; f- u. z7 k4 e; g1 mHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
2 w# p! p9 s6 X6 T1 g\ImageFileExecutionOptions\AutoRun.EXE\debugger: % c% {' i( t  b- I# O9 [5 a
"C:\WINDOWS\system32\dllcache\spoolsv.exe" 9 @# J6 m) K* P8 j
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion ( U7 W) S) a% @3 c+ |" f/ t
\ImageFileExecutionOptions\AutoRunKiller.EXE\debugger: 0 m( }7 H! G! W& u% C
"C:\WINDOWS\system32\dllcache\spoolsv.exe"
8 |. J/ f4 w& Y! o* e0 }, z+ b6 W" OHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion / c* _, A& G: a
\ImageFileExecutionOptions\AvMonitor.EXE\debugger: 1 G8 B3 [! z% u# `% a! c  H7 x# e
"C:\WINDOWS\system32\dllcache\spoolsv.exe" . O. m% A. {0 ^1 o+ R) l2 I" K
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion   b, j) Y9 c2 X4 g
\ImageFileExecutionOptions\AVP.COM\debugger: : b9 J/ P6 n% \4 G9 O
"C:\WINDOWS\system32\dllcache\spoolsv.exe" 5 k) q+ H! [" V6 a) X: f
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
+ C( O7 H) _3 s; p\ImageFileExecutionOptions\AVP.EXE\debugger:   H- {  J* k4 a( ]
"C:\WINDOWS\system32\dllcache\spoolsv.exe" 0 D) Z2 m2 k0 s
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion % H! N" w" g. |, @1 T) a/ z
\ImageFileExecutionOptions\CCenter.EXE\debugger: 7 P9 M  j1 y3 u$ U- x; s
"C:\WINDOWS\system32\dllcache\spoolsv.exe"
) E) E" \* ], \HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion ' y  b4 Q8 W$ X4 Q
\ImageFileExecutionOptions\Frameworkservice.EXE\debugger:   Y9 M) J0 n8 L
"C:\WINDOWS\system32\dllcache\spoolsv.exe"
; I* Z1 j3 n9 a. q, H' V' gHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion   A, n% O# d7 w5 `0 d- s
\ImageFileExecutionOptions\GFUpd.EXE\debugger:
% z3 B: o7 h) b7 E, t"C:\WINDOWS\system32\dllcache\spoolsv.exe"
) [* \0 ]& U0 u7 M$ yHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
  D& p% L+ r8 T) v\ImageFileExecutionOptions\GuardField.EXE\debugger:
( u: M* U# R& \9 o( r; N' }: g& o"C:\WINDOWS\system32\dllcache\spoolsv.exe"
+ K: J- \6 Q/ Y* SHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
! P4 [; `( U3 E0 ~; ?" y8 V2 D) d) R\ImageFileExecutionOptions\HijackThis.EXE\debugger:
* H: K' [9 d+ |+ r+ A7 s"C:\WINDOWS\system32\dllcache\spoolsv.exe"
" [: c1 Q4 O: _HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion - y9 q! e: {  j2 p: d
\ImageFileExecutionOptions\IceSword.EXE\debugger: * E' g; \/ R: j
"C:\WINDOWS\system32\dllcache\spoolsv.exe"
, F5 O+ X1 d5 k1 ?HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
: s( s. @  C$ J$ Z7 p\ImageFileExecutionOptions\Iparmor.EXE\debugger: 0 Q- y8 X( Z& a
"C:\WINDOWS\system32\dllcache\spoolsv.exe" 1 }: r) P5 I1 G; [% N# t) X
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
3 M2 a( m, R2 V0 T% E, Q\ImageFileExecutionOptions\KASARP.EXE\debugger: 2 V% _- z; L8 t
"C:\WINDOWS\system32\dllcache\spoolsv.exe" % q" R: Q: z4 I3 T/ S. \
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion : A. j" [" I# f6 Z
\ImageFileExecutionOptions\kav32.EXE\debugger: , n0 n4 i4 K5 Y, y1 S# s
"C:\WINDOWS\system32\dllcache\spoolsv.exe"
, n5 r" I7 j! l7 dHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion 2 N3 A  {# N9 O, R
\ImageFileExecutionOptions\KAVPFW.EXE\debugger: " D# R$ Z- s$ C% D  x' m# }/ l, I4 a* _
"C:\WINDOWS\system32\dllcache\spoolsv.exe" 8 J# ?. Z% p1 a1 K, E" _+ [! _
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
! R9 s3 P" [4 G5 B, ~\ImageFileExecutionOptions\kavstart.EXE\debugger:
8 U! R0 X# O3 k: `7 d0 u# Z- ?' R"C:\WINDOWS\system32\dllcache\spoolsv.exe" . a7 `4 h! d3 {, L" |: I) A
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion . G  i3 D. h$ O6 r+ M* q2 u
\ImageFileExecutionOptions\kissvc.EXE\debugger: ! e- W- @+ L2 [& D
"C:\WINDOWS\system32\dllcache\spoolsv.exe" # A0 {' _2 j, `* E. g& \, ^
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
9 P' N5 m3 ~& j8 K# q4 E\ImageFileExecutionOptions\kmailmon.EXE\debugger:
& e" Q( O% o! {& j"C:\WINDOWS\system32\dllcache\spoolsv.exe"
+ d3 @; V) h7 ^! ~. [HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion 7 J# v9 }. i: i6 ]0 N$ C; j- `6 X
\ImageFileExecutionOptions\KPfwSvc.EXE\debugger:
; X. z* x. N2 r! a" W"C:\WINDOWS\system32\dllcache\spoolsv.exe" 9 {! v! \) E: C2 W8 b
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
$ m- Y1 r# }/ Q  k" r/ ^" T! ]4 a\ImageFileExecutionOptions\KRegEx.EXE\debugger:
2 H- C/ t/ O9 d/ M: t"C:\WINDOWS\system32\dllcache\spoolsv.exe"
6 n6 c, k6 S3 E, J8 U* zHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion ' L/ s4 a: |2 ^  H0 F2 Q9 x& C
\ImageFileExecutionOptions\KVMonxp.KXP\debugger: / W% L: k1 l% z3 Z; A) @, U! `
"C:\WINDOWS\system32\dllcache\spoolsv.exe"
, j- K: q! W! S% X  x9 BHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
8 ^2 _1 V( y' a% o3 g+ S\ImageFileExecutionOptions\KVSrvXP.EXE\debugger: 0 }: ]) V2 p0 |. C% {; l) ^
"C:\WINDOWS\system32\dllcache\spoolsv.exe" 2 c8 J" ]6 j& e9 [. {6 V
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
( X9 C6 Q0 m% w4 j$ |' G\ImageFileExecutionOptions\KVWSC.EXE\debugger: % F! \. _6 y9 ?0 B9 ?1 z6 T
"C:\WINDOWS\system32\dllcache\spoolsv.exe" . T& T- Y' Q/ E( c
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
( d1 b+ }/ ^4 x9 W! O" f\ImageFileExecutionOptions\kwatch.EXE\debugger: ( Q* B! v* W' X% ?% t
"C:\WINDOWS\system32\dllcache\spoolsv.exe" 6 O! X; |, g; H! `/ T  S
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion   m* S8 N9 a& p7 f
\ImageFileExecutionOptions\Mmsk.EXE\debugger: ) i5 ]' t& }, b
"C:\WINDOWS\system32\dllcache\spoolsv.exe"
. t5 U& G% R, F# D$ VHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
6 C. [" R$ Z: U( m& ~; K\ImageFileExecutionOptions\msconfig.EXE\debugger: ) n+ _  \$ U3 _7 N
"C:\WINDOWS\system32\dllcache\spoolsv.exe"
8 A$ }: r2 u9 L0 _HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
7 w9 C6 W' |( e' t\ImageFileExecutionOptions\Navapsvc.EXE\debugger:
- Q4 x# B. W2 a0 z3 P& ^. _"C:\WINDOWS\system32\dllcache\spoolsv.exe"
6 G' z' s  y/ b  m! H( ?, cHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion , C: ?% S' n/ V; I, E4 H
\ImageFileExecutionOptions\nod32krn.EXE\debugger: ! k) V3 f5 D) F1 c
"C:\WINDOWS\system32\dllcache\spoolsv.exe" 3 i* O9 r" ?( o4 n5 M% w1 ^% @* O
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
0 y- E+ z5 L) x\ImageFileExecutionOptions\Nod32kui.EXE\debugger:
6 ?: D9 s% y1 f7 a3 g; f"C:\WINDOWS\system32\dllcache\spoolsv.exe" ! M. I5 [/ O5 I- h7 G
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion 9 H0 y! ]& b  `1 g6 h; u6 ]! W
\ImageFileExecutionOptions\PFW.EXE\debugger:
3 ]5 }$ H6 \* ~# f9 ?, Q/ ^! q"C:\WINDOWS\system32\dllcache\spoolsv.exe"
- I% {# U- e9 |/ K& b8 S  SHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
* L3 J  s) m1 A1 H. m, ]( K4 U: x( I\ImageFileExecutionOptions\QQDoctor.EXE\debugger:
. \0 i" p  J' j; s"C:\WINDOWS\system32\dllcache\spoolsv.exe"
7 Y. c# D4 p% F% S0 ]HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
3 `2 ~& m" A6 O4 o* R0 Y\ImageFileExecutionOptions\RAV.EXE\debugger:
4 c# t% v: z8 p( v0 T6 |1 W  P"C:\WINDOWS\system32\dllcache\spoolsv.exe"
9 x8 e& U9 c5 |4 z( aHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion ' F( Y5 Y* w& H, d8 J* V2 {2 T
\ImageFileExecutionOptions\RavStub.EXE\debugger:
8 w7 _) _% Y& \) R"C:\WINDOWS\system32\dllcache\spoolsv.exe"
6 N9 [: G) S6 h) yHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion 5 }- d* |" Q& G$ P9 j* r  R
\ImageFileExecutionOptions\Regedit.EXE\debugger: & M0 ?% o7 w" m) j5 L: Z7 r
"C:\WINDOWS\system32\dllcache\spoolsv.exe"
8 i9 E+ |4 X" }% nHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
  |% l" R+ m8 ?7 m" [7 L7 c\ImageFileExecutionOptions\rfwmain.EXE\debugger:
, Y8 ~4 d5 t- n/ y9 v( \$ H" Y"C:\WINDOWS\system32\dllcache\spoolsv.exe"
8 ?% j+ _$ C! H# L9 \  RHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion ) j$ r4 F9 H: W) X/ X
\ImageFileExecutionOptions\rfwProxy.EXE\debugger: 5 Z7 j9 H$ j- ]# B6 N, B
"C:\WINDOWS\system32\dllcache\spoolsv.exe"
$ Z6 {. t7 n" aHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
0 j( `! I1 v4 J\ImageFileExecutionOptions\rfwsrv.EXE\debugger: 5 Y2 `' m0 d$ C2 p; A( M
"C:\WINDOWS\system32\dllcache\spoolsv.exe"   j+ J" L* h& E# G- a
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
- X7 [# ?% e# R+ A2 i3 k) p/ S\ImageFileExecutionOptions\rfwstub.EXE\debugger: ; M; l" U* D; p/ f
"C:\WINDOWS\system32\dllcache\spoolsv.exe" # _1 h0 f! w4 O- A) G
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion 4 O& `0 ?* y$ Q8 b; h+ Y
\ImageFileExecutionOptions\RSTray.EXE\debugger: / u# [' t+ E& Y
"C:\WINDOWS\system32\dllcache\spoolsv.exe" : x5 r1 [4 k1 k8 z! ^
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion   V# t( f% y0 ]3 X+ d- R
\ImageFileExecutionOptions\Runiep.EXE\debugger:
$ Y( {; |6 l, |2 P' F7 S"C:\WINDOWS\system32\dllcache\spoolsv.exe"
! J: W% |9 a; fHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
/ B" ]/ P. t8 C1 n( g. p9 W\ImageFileExecutionOptions\safeboxTray.EXE\debugger:
3 n# ?2 M# C2 H"C:\WINDOWS\system32\dllcache\spoolsv.exe" . m! {# X  n& I  x% k* h
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion / W: o: I5 H7 m) N% D% ?
\ImageFileExecutionOptions\SREngLdr.EXE\debugger:
; v1 @0 v1 B4 F' q"C:\WINDOWS\system32\dllcache\spoolsv.exe"
2 O7 F9 R9 j* m: Z$ u4 KHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
5 @/ C6 z) E- M& |& o\ImageFileExecutionOptions\TrojanDetector.EXE\debugger: & S# g. c9 ]  I2 G+ e
"C:\WINDOWS\system32\dllcache\spoolsv.exe"
5 |1 `+ q$ J$ h5 E- f. GHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
9 C0 G  J* A9 h+ l- ]0 F\ImageFileExecutionOptions\Trojanwall.EXE\debugger: ) {  m& c) h) z
"C:\WINDOWS\system32\dllcache\spoolsv.exe"
2 j* X# \9 p# O2 [  {$ `8 [0 O; L% ?HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion 2 s* }% Q  U+ ~# L# H, i
\ImageFileExecutionOptions\TrojDie.KXP\debugger:
* ^5 f$ |  u  o, a1 ~6 o7 [# T0 Y"C:\WINDOWS\system32\dllcache\spoolsv.exe"
" [( k5 t# a. xHKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
) N( k- f8 o1 V6 D# @\ImageFileExecutionOptions\VPC32.EXE\debugger:
" `( c: d% }: T( K, o9 K) ~"C:\WINDOWS\system32\dllcache\spoolsv.exe" / }; _: s& y2 w0 e0 x6 K  C  M
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
/ |% D' ~8 U4 z( ]! w) O  |& F\ImageFileExecutionOptions\VPTRAY.EXE\debugger:
0 T  r# y0 Z  G! I+ K"C:\WINDOWS\system32\dllcache\spoolsv.exe" % l- p7 j' K. _+ f& H1 I" {. e
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion
0 a6 N0 f  h. }3 q% L" H( p7 X! @\ImageFileExecutionOptions\WOPTILITIES.EXE\debugger:
6 }; N" O4 b* `$ m% i/ O"C:\WINDOWS\system32\dllcache\spoolsv.exe" 0 ?" `4 V' _; F" G: b5 f2 y0 I3 {
19)修改隐藏显示
+ `9 k0 r5 E$ l- vHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL下键值CheckedValue改为0x1（0x2为显示）
" ?' `& |& F( k0 h* X% e20)删除以下键值破坏安全模式。
' r9 W! f6 A7 {/ t. I/ g7 _# rHKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}\:"DiskDrive" 8 U7 B* A' Q9 X0 }3 L4 {0 _; T" A
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}\:"DiskDrive" ' S  [3 H0 X, X3 t2 p- |3 c
21)遍历c到z的盘符，发现该驱动器为Fixed，将自己复制到其根目录命名HGZP.PIF，并创建对应的autorun.inf,将文件设置为系统，隐藏。 & O  q, l: E" d) S& _8 ?1 C4 m
22)搜索窗口，发现以下字符串的窗口则发送wm_close消息。
8 y; V1 {3 Y  S* \8 X) B杀毒清理 srengworm 卡巴斯基 超级巡警 江民金山 : R+ ?% \" g3 l& F4 ~
Antivirusfirewall 1 q. d5 j3 E* A8 }3 g7 S1 y! T( U
检测 mcafee 病毒防火墙 主动防御
3 E9 o  W2 H; A6 {6 v$ O微点防御 绿鹰木马 瑞星进程 processnod32
- f  e( b2 b7 b专杀安全卫士