作者：清新阳光 ( http://hi.baidu.com/newcenturysun)
日期：2007/06/08 (转载请保留此申明)
刚刚发表了一个随机8位数Bing Du新变种Worm.Pabug.db的分析与查杀http://hi.baidu.com/newcenturysun/blog/item/3f7b424e42983908b3de0596.html 马上孤独更可靠告诉我他的一个变种会关闭winrar 测试了一下
这个变种比我那个更新一些 而且手段更恶劣
由于下载的木马相同 所以只写出这个变种的主程序的分析与查杀部分
病毒主要特征
1.破坏安全模式
2.结束常见杀毒软件以及反病毒工具进程
3.监控窗口
4.修改自动更新，Windows安全中心，Windows防火墙以及常见杀毒软件的服务的启动值
5.屏蔽显示隐藏文件
6.下载木马
7.IFEO映像劫持
8.向瑞星注册表监控发送允许的指令
File: 0A47CAC2.exe
Size: 33363 bytes
MD5: A785A2729BFBB5AF9BA644D578B8EECC
SHA1: E67B2189F46F3EED4C33355C3447FCD744C70156
CRC32: AA8896E7
病毒运行后
在C:\Program Files\Common Files\Microsoft Shared\MSInfo\下面释放一个同样由8个数字和字母组成的组合的文
件名的dll 和一个同名的dat 文件
我这里是C:\Program Files\Common Files\Microsoft Shared\MSInfo\41115BDD.dll
在C:\WINDOWS\Help\下面生成一个同样由8个数字和字母组成的组合的文件名的chm文件
在C:\WINDOWS\下面生成一个同样由8个数字和字母组成的组合的文件名的hlp文件
把C:\WINDOWS\system32\verclsid.exe重命名为verclsid.exe.bak然后删除C:\WINDOWS\system32\verclsid.exe
监视并关闭以下进程以及窗口
AntiVirus
Trojan
Firewall
Kaspersky
JiangMin
KV200
kxp
Rising
RAV
RFW
KAV200
KAV6
McAfe
Network Associates
TrustPort
Norton
Symantec
SYMANT~1
Norton SystemWorks
ESET
Grisoft
F-Pro
Alwil Software
ALWILS~1
F-Secure
ArcaBit
Softwin
ClamWin
DrWe
Fortine
anda Software
Vba3
Trend Micro
QUICKH~1
TRENDM~1
Quick Heal
eSaf
ewido
Prevx1
ersavg
Ikarus
Sopho
Sunbelt
PC-cilli
ZoneAlar
Agnitum
WinAntiVirus
AhnLab
Norma
surfsecret
Bullguard
BlackICE
Armor2net
360safe
SkyNet
k2007
Antiy Labs
LinDirMicro Lab
Filseclab
ast
System Safety Monitor
ProcessGuard
FengYun
Lavasoft
Defendio
kis6
Behead
sreng
IceSword
HijackThis
killbox
procexp
Magicset
EQSysSecure
ProSecurity
Yahoo!
Google
baidu
P4P
Sogou PXP
yaskp.sys
BDGuard.sys
超级兔子
木马
KSysFilt.sys
KSysCall.sys
AVK
K7
Zondex
blcorp
Tiny Firewall Pro
Jetico
HAURI
CA
kmx
PCClear_Plus
Novatix
Ashampoo
WinPatrol
Spy Cleaner Gold
CounterSpy
EagleEyeOS
Webroot
BufferZone
avp
AgentSvr
CCenter
Rav
RavMonD
RavStub
RavTask
rfwcfg
rfwsrv
RsAgent
Rsaupd
runiep
SmartUp
FileDsty
RegClean
360tray
360Safe
360rpt
kabaload
safelive
Ras
KASMain
KASTask
KAV32
KAVDX
KAVStart
KISLnchr
KMailMon
KMFilter
KPFW32
KPFW32X
KPFWSvc
KWatch9x
KWatch
KWatchX
TrojanDetector
UpLive.EXE
KVSrvXP
KvDetect
KRegEx
kvol
kvolself
kvupload
kvwsc
UIHost
IceSword
iparmo
mmsk
adam
MagicSet
PFWLiveUpdate
SREng
WoptiClean
scan32
shcfg32
mcconsol
HijackThis
mmqcj
Trojanwall
FTCleanerShell
loaddll.
rfwProxy
KsLoader
KvfwMcl
autoruns.
AppSvc32
ccSvcHst
isPwdSvc
symlcsvc
nod32kui
avgrssvc
RfwMain
KAVPFW
Iparmor
nod32krn
PFW
RavMon
KAVSetup
NAVSetup
SysSafe
QHSET
xsweep.
AvMonitor
UmxCfg
UmxFwHlp
UmxPol
UmxAgent
UmxAttachment
KPFW32
KPFW32X
KvXP_1
KVMonXP_1
KvReport
KVScan
KVStub
KvXP
KVMonXP
KVCenter
TrojDie
avp.com
krepair.COM
KaScrScn.SCR
Trojan
Virus
kaspersky
jiangmin
rising
ikaka
duba
kingsoft
360safe
木马
木馬
病毒
杀毒
殺毒
查毒
防毒
反病毒
专杀
專殺
卡巴
江民
瑞星
卡卡社区
金山毒霸
毒霸
金山
社区
360安全
恶意软件
流氓软件
举报
报警
杀软
殺軟
防駭
微点
MSInfo
WinRAR
KvNative
bsmain
aswBoot
注意最后几个
微点
MSInfo
WinRAR
KvNative
bsmain
aswBoot
是病毒新变化的部分
可恨就可恨在它把带有MSInfo的窗口也列入了监控的范围
测试中winrar有时可以打开 但一用winrar找C:\Program Files\Common Files\Microsoft Shared\MSInfo下面的那
两个文件时 马上由于窗口带有MSInfo而被关闭
而且Icesword 开启后也会被强制最小化
注册表相关操作
删除
HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}
破坏安全模式
修改
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue值
为0x00000000
HKU\S-1-5-21-1085031214-1078145449-839522115-500
\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden为0x00000002
HKU\S-1-5-21-1085031214-1078145449-839522115-500
\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SuperHidden为0x00000001
屏蔽显示隐藏文件
修改
HKLM\SYSTEM\ControlSet001\Services\HookUrl\Start为0x00000004
HKLM\SYSTEM\ControlSet001\Services\mProcRs\Start为0x00000004
HKLM\SYSTEM\ControlSet001\Services\RfwProxySrv\Start为0x00000004
HKLM\SYSTEM\ControlSet001\Services\RfwService\StartHKLM\SYSTEM\ControlSet001\Services\HookUrl\Start为
0x00000004
HKLM\SYSTEM\ControlSet001\Services\RsFwDrv\Start为0x00000004
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Start为0x00000004
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Epoch\Epoch为0x0000008B
HKLM\SYSTEM\ControlSet001\Services\wscsvc\Start为0x00000004
HKLM\SYSTEM\ControlSet001\Services\wuauserv\Start为0x00000004
HKLM\SYSTEM\ControlSet002\Services\HookUrl\Start为0x00000004
HKLM\SYSTEM\ControlSet002\Services\mProcRs\Start为0x00000004
HKLM\SYSTEM\ControlSet002\Services\RfwProxySrv\Start为0x00000004
HKLM\SYSTEM\ControlSet002\Services\RsFwDrv\Start为 0x00000004
HKLM\SYSTEM\ControlSet002\Services\PFW\Start为 0x00000004
HKLM\SYSTEM\ControlSet002\Services\avgwlntf\Start为 0x00000004
破坏常见杀毒软件防火墙以及windows安全中心 windows防火墙 windows自动更新
添加IFEO映像劫持项
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krepair.COM
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.EXE.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zxsweep.exe
指向C:\Program Files\Common Files\Microsoft Shared\MSInfo\下的那个dat文件
其他木马下载行为同上篇分析http://hi.baidu.com/newcenturysun/blog/item/3f7b424e42983908b3de0596.html
解决方法：
上个方法中用winrar重命名的方法 对于这个已经失效
不过我们只需在这之前再作一些工作就可以了
1.首先我们先下载Process Explorer这个软件
地址
http://dl.pconline.com.cn/html_2/1/59/id=6395&pn=0.html
下载下来的是压缩包 直接使用右键解压到XX文件夹
尽量不要双击打开
2.然后重命名procexp.exe 运行之
双击Explorer进程
单击 Threads
找类似8位随机字母和数字组合成的dll 应该有很多个，记住名字
3.分别选中Threads中的各个dll 单击下面的suspend
直到选中每个dll时 原先那个suspend都变成了resume
不要关闭process explorer
4.接下来可以打开winrar利用我们的重命名大法了
打开WinRAR 工具 查看文件
在上面的地址栏中 进入c:\program files\common files\microsoft shared\msinfo目录
在winrar中右键点击随机8位数字的那个dll和那个dat文件 重命名
5.重启计算机
6.恢复映像劫持
这里我们使用autoruns这个软件 http://www.skycn.com/soft/17567.html
由于这个软件也被映像劫持了 所以我们随便把他改个名字
打开这个软件后 找到Image hijack (映像劫持）
删除除了Your Image File Name Here without a pathSymbolic Debugger for Windows 2000 Microsoft
Corporation c:\windows\system32\ntsd.exe
以外的所有项目
7.此时我们就可以打开sreng了
打开sreng
系统修复 高级修复 点击修复安全模式 在弹出的对话框中点击是
8.恢复显示隐藏文件
把下面的 代码拷入记事本中然后另存为1.reg文件
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="@shell32.dll,-30500"
"Type"="radio"
"CheckedValue"=dword:00000001
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51105"
双击1.reg把这个注册表项导入
9.双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹" 并清除"隐藏受保护的操作系统文
件（推荐）"前面的钩。在提示确定更改时，单击“是” 然后确定
删除c:\program files\common files\microsoft shared\msinfo下面你刚刚重命名的那两个文件(一个dll一个dat)
10.删除各个分区下面的autorun.inf和8位随机数的exe
注意：一定不要双击 也不能右键打开（因为那个autorun.inf编辑的比较巧妙，所以右键菜单无原先的auto等字样） 所以一定用winrar删除
木马部分由于和上篇分析相同，请参考上篇分析http://hi.baidu.com/newcenturysun/blog/item/3f7b424e42983908b3de0596.html
