- 瑞瑞爱吃桃
-
* 回复内容中包含的链接未经审核,可能存在风险,暂不予完整展示!应该是U盘病毒搞的鬼.先去下载个专杀试下.这个病毒真TMD变态。..开个压缩文件都自动被它给关闭了。.先去下载个专杀试下。..现在其他盘暂时不要动他们...下载完后在重新启动下.
http://360safe.q***.com/killer/erkiller.html
- 我不懂运营
-
* 回复内容中包含的链接未经审核,可能存在风险,暂不予完整展示!最近,一种病毒变种(以随机八位字符为文件名)疯狂传播。由于病毒制造者会经常更新病毒文件,使病毒变种狂增,一方面使很多用户深受其害,更一方面使得专杀效果不是很好,所以还是建议进行手工查杀。
一、病毒相关分析:
病毒标签:
病毒名称:Trojan-PSW.Win32.Nilage.gen/Virus.Win32.Autorun.gen
病毒别名:帕虫--瑞星,AV终结者--金山,U盘寄生虫--江民
病毒类型:病毒
危害级别:5
感染平台:Windows 平台
病毒大小:33,363 (字节)
SHA1 :d8ced73c38439ca03bd2f4f07a492b58b9a82947
加壳类型:upx
开发工具:Delphi
病毒分析:
1、运行病毒文件后,会生成以下文件:
%CommonProgramFiles%Microsoft SharedMSInfo随机八位字符.dll (46163字节)
%CommonProgramFiles%Microsoft SharedMSInfo随机八位字符.dat (33363字节)
%SystemRoot%Help随机八位字符.chm (33363字节)
%SystemRoot%随机八位字符.hlp (33字节)
在除系统盘外的各盘根目录下生成
autorun.inf (172字节)
随机八位字符.exe (33363字节)
2、关闭运行的安全软件,监控并关闭以下含有以下字符串的文件夹、窗体、进程、服务、网页或文本:
AntiVirus、Trojan、Firewall、Kaspersky、JiangMin、KV200、kxp、Rising、RAV、RFW、KAV200、KAV6、
McAfe、Network Associates、TrustPort、Norton、Symantec、SYMANT~1、Norton、SystemWorks、ESET、
Grisoft、F-Pro、Alwil Software、ALWILS~1、F-Secure、ArcaBit、Softwin、ClamWin、DrWe、Fortine、
anda Software、Vba3、TrendMicro、QUICKH~1、TRENDM~1、Quick Heal、eSaf、ewido、Prevx1、ersavg、
Ikarus、Sopho、Sunbelt、PC-cilli、ZoneAlar、 Agnitum、WinAntiVirus、AhnLab、Norma、surfsecret、
Bullguard、BlackICE、Armor2net、360safe、SkyNet、k2007、AntiyLabs、LinDirMicro Lab、Filseclab、ast、
System Safety Monitor、ProcessGuard、FengYun、Lavasoft、Defendio、kis6、Behead、sreng、IceSword、
HijackThis、killbox、procexp、Magicset、EQSysSecure、ProSecurity、Yahoo!、Google、baidu、P4P、
Sogou PXP、yaskp.sys、BDGuard.sys、超级兔子、木马、KSysFilt.sys、KSysCall.sys、AVK、K7、Zondex、
blcorp、TinyFirewall Pro、Jetico、HAURI、CA、kmx、PCClear_Plus、Novatix、Ashampoo、WinPatrol、
Spy Cleaner Gold、CounterSpy、EagleEyeOS、Webroot、BufferZone、avp、AgentSvr、Ccenter、Rav、
RavMonD、RavStub、RavTask、rfwcfg、rfwsrv、RsAgent、Rsaupd、runiep、SmartUp、FileDsty、RegClean、
360tray、360Safe、360rpt、kabaload、safelive、Ras、KASMain、KASTask、KAV32、KAVDX、KAVStart、
KISLnchr、KmailMon、KMFilter、KPFW32、KPFW32X、KPFWSvc、KWatch9x、Kwatch、KwatchX、TrojanDetector、
UpLive.EXE、KVSrvXP、KvDetect、KregEx、kvol、kvolself、kvupload、kvwsc、UIHost、IceSword、iparmo、
mmsk、adam、MagicSet、PFWLiveUpdate、SREng、WoptiClean、scan32、shcfg32、mcconsol、HijackThis、
mmqcj、Trojanwall、FTCleanerShell、loaddll.、rfwProxy、KsLoader、KvfwMcl、autoruns.、AppSvc32、
ccSvcHst、isPwdSvc、symlcsvc、nod32kui、avgrssvc、RfwMain、KAVPFW、Iparmor、nod32krn、PFW、RavMon、
KAVSetup、NAVSetup、SysSafe、QHSET、xsweep.、AvMonitor、UmxCfg、UmxFwHlp、UmxPol、UmxAgent、
UmxAttachment、KPFW32、KPFW32X、KvXP_1、KVMonXP_1、KvReport、KVScan、KVStub、KvXP、KVMonXP、KVCenter、
TrojDie、a*.com、krepair.COM、KaScrScn.SCR、Trojan、Virus、kaspersky、jiangmin、rising、ikaka、duba、
kingsoft、360safe、木马、木马、病毒、杀毒、杀毒、查毒、防毒、反病毒、专杀、专杀、卡巴、江民、瑞星、
卡卡社区、金山毒霸、毒霸、金山、社区、360安全、恶意软件、流氓软件、举报、报警、杀软、杀软、防骇、微点、
MSInfo、WinRAR、KvNative、bsmain、aswBoot
3、删除以下注册表项破坏安全模式
HKLMSYSTEMControlSet001ControlSafeBootMinimal{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLMSYSTEMControlSet001ControlSafeBootNetwork{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLMSYSTEMCurrentControlSetControlSafeBootMinimal{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLMSYSTEMCurrentControlSetControlSafeBootNetwork{4D36E967-E325-11CE-BFC1-08002BE10318}
修改系统隐藏属性:
改HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
FolderHiddenSHOWALLCheckedValue值为0
//1为显示隐藏文件
4、添加IFEO映像劫持项
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options360rpt.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options360Safe.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options360tray.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsadam.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsAgentSvr.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsAppSvc32.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsAST.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsautoruns.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsavgrssvc.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsAvMonitor.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution O********.com
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsavp.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsCCenter.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsccSvcHst.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsFileDsty.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsFTCleanerShell.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsHijackThis.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsIceSword.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsiparmo.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsIparmor.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsisPwdSvc.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionskabaload.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKaScrScn.SCR
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKASMain.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKASTask.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKAV32.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKAVDX.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKAVPFW.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKAVSetup.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKAVStart.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKISLnchr.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKMailMon.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKMFilter.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKPFW32.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKPFW32X.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKPFWSvc.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKRegEx.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionskrepair.COM
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKsLoader.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKVCenter.kxp
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKvDetect.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKvfwMcl.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKVMonXP.kxp
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKVMonXP_1.kxp
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionskvol.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionskvolself.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKvReport.kxp
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKVScan.kxp
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKVSrvXP.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKVStub.kxp
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionskvupload.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionskvwsc.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKvXP.kxp
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKvXP_1.kxp
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKWatch.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKWatch9x.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsKWatchX.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsloaddll.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsMagicSet.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmcconsol.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmmqczj.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmmsk.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsNAVSetup.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options od32krn.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options od32kui.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsPFW.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsPFWLiveUpdate.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsQHSET.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRas.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRav.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRavMon.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRavMonD.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRavStub.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRavTask.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRegClean.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options fwcfg.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRfwMain.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options fwProxy.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options fwsrv.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRsAgent.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRsaupd.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options uniep.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionssafelive.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsscan32.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsshcfg32.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsSmartUp.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsSREng.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionssymlcsvc.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsSysSafe.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsTrojanDetector.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsTrojanwall.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsTrojDie.kxp
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsUIHost.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsUmxAgent.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsUmxAttachment.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsUmxCfg.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsUmxFwHlp.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsUmxPol.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsUpLive.EXE.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsWoptiClean.exe
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionszxsweep.exe
以上键值均指向
%CommonProgramFiles%Microsoft SharedMSInfo随机八位字符.dat
5、连接http://google.171738.org 和http://head.bodyhtml.biz/ani.js
下载ani.c (1,156 字节)Ani.c为ANI溢出程序,并通过该文件下载
http://head.bodyhtml.biz/update.exe。
通过连接http://w*.cnz.com/stat/website.php?web_id=518199记录访问量。
6、update.exe文件会从http://head.bodyhtml.biz上下载大量木马与病毒。
其中包括AV终结者变种,病毒如下:%CommonProgramFiles%systemjbtmfqq.exe (25240字节)
%CommonProgramFiles%microsoft sharedytbikec.exe (25240字节)
在除系统盘根目录下
autorun.inf
hsomklg.exe (28672字节)
%temp%目录下
LYLOADER.EXE (10196字节)
LYMANGR.DLL (2816字节)
MSDEG32.DLL (4999字节)
~SM3.tmp (19504字节)
~SM4.tmp (19504字节)
~SM5.tmp (19504字节)
~SM6.tmp (19504字节)
~SM7.tmp (19504字节)
以上文件会采用添加自身到启动项或插入explorer.exe进程进行自我保护,还会下载其他盗取网游帐号的木马。
二、解决方案:
1、先找突破点。因为映像劫持(image File Execution Options Hijack)只是针对文件名,所以只要更改变文件名,就
可以使它失效。为了防止刚清理的病毒又被重新生成或者安全软件不能使用。我们先解除映像支持,使用超级巡警中
新发布的IFEO修复功能(“安全优化”中“系统修复”下的“Fix IF- FinCloud
-
现进入安全模式 把旧的杀毒软件删了 然后下载 卡巴斯基 杀毒软件 杀毒就ok了! 卡巴斯基很强!!!
- 可可
-
现在很多病毒都能攻击杀毒软件的,病毒中含有反杀程序,你试下在安全模式下运行杀毒软件杀毒。也可以改变杀软件的进程名。
但你也有可能中了AV终结者,中此毒者无法运行杀毒软件,无法打开带毒字的有关网站,中这个毒就算把系统都格了也杀不掉它,因为你打不开有关杀毒软件的网页,所以你也下不了专杀工具,你可以叫你的朋友到金山的网页上去下AV终结者专杀工具再用QQ传到你的电脑上,你再运行这个工具杀毒,杀掉之后别先重启机子,你再用你的电脑上的杀毒软件对全盘进行杀毒,然后就OK了
- 南yi
-
ewido anti-spyware 4.0这个不会被平了
- cloud123
-
杀毒啊