杀软克星Win32.Troj.Autorun.mv.141312分析

中航海 发表于 2007-9-28 18:12:00

杀软克星Win32.Troj.Autorun.mv.141312分析<p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">病毒全名 Win32.Troj.Autorun.mv.141312 <p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">病毒长度 26462 <p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">威胁级别 ★★      <p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">中文名称杀软克星      <p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">病毒别名      <p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">病毒类型木马      <p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">病毒简介      <p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">这是一个木马病毒。该病毒运行后，通过映像劫持的手段，会使著名杀软都无法打开使用。浏览不了与安全或"病毒"相关的网页。使用户无法通过正常的杀毒方式解决该问题。      <p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">关键字：映像劫持,自删除,无法使用杀软,安全网页被屏蔽      <p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">病毒行为：      <p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">1.病毒运行后，产生以下病毒文件 <div align="center"><table class="MsoNormalTable" cellspacing="0" cellpadding="0" width="400" border="1" style="WIDTH: 300pt; mso-cellspacing: 0cm; mso-padding-alt: 1.5pt 1.5pt 1.5pt 1.5pt;"><tbody><tr style="mso-yfti-irow: 0; mso-yfti-firstrow: yes; mso-yfti-lastrow: yes;"><td style="BORDER-RIGHT: #ece9d8; PADDING-RIGHT: 1.5pt; BORDER-TOP: #ece9d8; PADDING-LEFT: 1.5pt; BACKGROUND: #e6e6e6; PADDING-BOTTOM: 1.5pt; BORDER-LEFT: #ece9d8; PADDING-TOP: 1.5pt; BORDER-BOTTOM: #ece9d8;"><p class="MsoNormal" align="center" style="MARGIN: 0cm 0cm 0pt; LINE-HEIGHT: 130%; TEXT-ALIGN: center; mso-pagination: widow-orphan; tab-stops: 45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;">%Program Files%\meex.exe<p class="MsoNormal" align="center" style="MARGIN: 0cm 0cm 0pt; LINE-HEIGHT: 130%; TEXT-ALIGN: center; mso-pagination: widow-orphan; tab-stops: 45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;">%Program Files%\Common Files\Microsoft Shared\amartpg.inf<p class="MsoNormal" align="center" style="MARGIN: 0cm 0cm 0pt; LINE-HEIGHT: 130%; TEXT-ALIGN: center; mso-pagination: widow-orphan; tab-stops: 45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;">%Program Files%\Common Files\Microsoft Shared\havnepc.exe<p class="MsoNormal" align="center" style="MARGIN: 0cm 0cm 0pt; LINE-HEIGHT: 130%; TEXT-ALIGN: center; mso-pagination: widow-orphan; tab-stops: 45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;">%Program Files%\Common Files\System\bhekrgm.exe</td></tr></tbody></table></div><p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">2.病毒运行成功后，会自行删除病毒源文件。      <p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">3.在注册表中，病毒自行添加键值      <div align="center"><table class="MsoNormalTable" cellspacing="0" cellpadding="0" width="400" border="1" style="WIDTH: 300pt; mso-cellspacing: 0cm; mso-padding-alt: 1.5pt 1.5pt 1.5pt 1.5pt;"><tbody><tr style="mso-yfti-irow: 0; mso-yfti-firstrow: yes; mso-yfti-lastrow: yes;"><td style="BORDER-RIGHT: #ece9d8; PADDING-RIGHT: 1.5pt; BORDER-TOP: #ece9d8; PADDING-LEFT: 1.5pt; BACKGROUND: #e6e6e6; PADDING-BOTTOM: 1.5pt; BORDER-LEFT: #ece9d8; PADDING-TOP: 1.5pt; BORDER-BOTTOM: #ece9d8;"><p class="MsoNormal" align="center" style="MARGIN: 0cm 0cm 0pt; LINE-HEIGHT: 130%; TEXT-ALIGN: center; mso-pagination: widow-orphan; tab-stops: 45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;">HKCU\Software\ajjood<p class="MsoNormal" align="center" style="MARGIN: 0cm 0cm 0pt; LINE-HEIGHT: 130%; TEXT-ALIGN: center; mso-pagination: widow-orphan; tab-stops: 45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;">HKCU\Software\lbdwwd<p class="MsoNormal" align="center" style="MARGIN: 0cm 0cm 0pt; LINE-HEIGHT: 130%; TEXT-ALIGN: center; mso-pagination: widow-orphan; tab-stops: 45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;">HKLM\software\microsoft\windows NT\CurrentVersion\Image File Execution(映像劫持)</td></tr></tbody></table></div><p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">4.该病毒运行后，著名杀软不可使用(无法打开)，如毒霸、卡巴斯基等。      <p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">5.启动项被病毒纂改      <div align="center"><table class="MsoNormalTable" cellspacing="0" cellpadding="0" width="400" border="1" style="WIDTH: 300pt; mso-cellspacing: 0cm; mso-padding-alt: 1.5pt 1.5pt 1.5pt 1.5pt;"><tbody><tr style="mso-yfti-irow: 0; mso-yfti-firstrow: yes; mso-yfti-lastrow: yes;"><td style="BORDER-RIGHT: #ece9d8; PADDING-RIGHT: 1.5pt; BORDER-TOP: #ece9d8; PADDING-LEFT: 1.5pt; BACKGROUND: #e6e6e6; PADDING-BOTTOM: 1.5pt; BORDER-LEFT: #ece9d8; PADDING-TOP: 1.5pt; BORDER-BOTTOM: #ece9d8;"><p class="MsoNormal" align="center" style="MARGIN: 0cm 0cm 0pt; LINE-HEIGHT: 130%; TEXT-ALIGN: center; mso-pagination: widow-orphan; tab-stops: 45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;">启动项名:bhekrgm    对应路径:%Program Files%\Common Files\System\bhekrgm.exe<p class="MsoNormal" align="center" style="MARGIN: 0cm 0cm 0pt; LINE-HEIGHT: 130%; TEXT-ALIGN: center; mso-pagination: widow-orphan; tab-stops: 45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt;">启动项名:havnepc    对应路径:%Program Files%\Common Files\Microsoft Shared\havnepc.exe</td></tr></tbody></table></div><p class="MsoNormal" align="left" style="MARGIN: 0cm 0cm 0pt; TEXT-INDENT: 24pt; LINE-HEIGHT: 16.5pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">6.打开浏览器，如果有关于安全或者"病毒"字眼的网站全部被自行关闭。      MS最近中这个病毒的人都是装卡巴的用户呢~~~卡巴最大的缺点是对自身防御不足（笑…………）由于名声太大，枪打出头鸟嘛，也不安全哦。。。。。    
[此贴子已经被作者于2007-9-29 11:45:06编辑过]

隐形人_ 发表于 2007-9-28 18:14:00

树大招风阿~幸好我不用卡巴~ 偷着乐了~

AMD 发表于 2007-9-29 00:18:00

我就在用,应该没什么事

竹木刀 发表于 2007-9-29 18:08:00

聪明！%Program Files%\Common Files\System\这个目录确实比较薄弱，很多主动防御都没监视到，不过autorun的传播方式在HIPS下面威力还是有限的。

页: [1]

下沙论坛's Archiver

杀软克星Win32.Troj.Autorun.mv.141312分析