病毒名称：game8.exe
病毒大小：26,154 字节
加壳方式：Upack 0.3.9 beta2s -> Dwing [Overlay]
脱壳大小：88,064 字节
编写语言：Borland Delphi v3.0 *
病毒预警：3级
病毒指纹：
SHA-160 : 406414F2773FFC68B7E6A072042DD87FB7133904
MD5 : E069C3EF0C41B86AB48D00BE66D097DD
RIPEMD-160 : 4A96D08DFE08B0DF44E7FDC60DA75825CC10AFDF
CRC-32 : C86EC7DA
命名对照：
http://scanner.virus.org/
| ArcaVir |
1.0.4 |
Trojan.Psw.Onlinegames.Tu |
3.39794 secs |
| avast! |
3.0.0 |
Clean |
0.00478077 secs |
| AVG Anti Virus |
7.5.47 |
Clean |
2.68099 secs |
| BitDefender |
7.1 |
Clean |
4.70251 secs |
| CAT QuickHeal |
9.00 |
Clean |
4.4323 secs |
| ClamAV |
0.90/3270 |
Clean |
0.208995 secs |
| Dr. Web |
4.33.0 |
Clean |
8.75378 secs |
| F-PROT |
4.6.7 |
Clean |
1.62262 secs |
| F-Secure |
1.02 |
Clean |
0.209508 secs |
| H+BEDV AntiVir |
2.1.10-40 |
Clean |
6.05688 secs |
| McAfee Virusscan |
5.10.0 |
New Malware.n |
1.95304 secs |
| NOD32 |
2.51.1 |
Clean |
3.49587 secs |
| Norman Virus Control |
5.70.01 |
W32/Suspicious_U.gen |
6.74328 secs |
| Panda |
9.00.00 |
Clean |
1.56817 secs |
| Sophos Sweep |
4.17.0 |
Mal/Packer |
5.28013 secs |
| Trend Micro |
8.310-1002 |
Clean |
0.499315 secs |
| VBA32 |
3.12.0 |
Clean |
2.82012 secs |
| VirusBuster |
1.3.3 |
Packed/Upack |
2.1315 secs |
http://www.virustotal.com
| AhnLab-V3 |
2007.5.16.1 |
05.18.2007 |
no virus found |
| AntiVir |
7.4.0.23 |
05.18.2007 |
no virus found |
| Authentium |
4.93.8 |
05.18.2007 |
no virus found |
| Avast |
4.7.997.0 |
05.18.2007 |
no virus found |
| AVG |
7.5.0.467 |
05.19.2007 |
no virus found |
| BitDefender |
7.2 |
05.20.2007 |
no virus found |
| CAT-QuickHeal |
9.00 |
05.18.2007 |
(Suspicious) - DNAScan |
| ClamAV |
devel-20070416 |
05.19.2007 |
no virus found |
| DrWeb |
4.33 |
05.19.2007 |
no virus found |
| eSafe |
7.0.15.0 |
05.17.2007 |
suspicious Trojan/Worm |
| eTrust-Vet |
30.7.3644 |
05.19.2007 |
no virus found |
| Ewido |
4.0 |
05.19.2007 |
Trojan.OnLineGames.tu |
| FileAdvisor |
1 |
05.20.2007 |
no virus found |
| Fortinet |
2.85.0.0 |
05.20.2007 |
suspicious |
| F-Prot |
4.3.2.48 |
05.18.2007 |
no virus found |
| F-Secure |
6.70.13030.0 |
05.18.2007 |
W32/Suspicious_U.gen.dropper |
| Ikarus |
T3.1.1.7 |
05.20.2007 |
Trojan-Dropper.Win32.Agent.ane |
| Kaspersky |
4.0.2.24 |
05.20.2007 |
Trojan-PSW.Win32.OnLineGames.tu |
| McAfee |
5034 |
05.18.2007 |
New Malware.n |
| Microsoft |
1.2503 |
05.20.2007 |
VirTool:Win32/Obfuscator.C |
| NOD32v2 |
2277 |
05.18.2007 |
no virus found |
| Norman |
5.80.02 |
05.18.2007 |
W32/Suspicious_U.gen |
| Panda |
9.0.0.4 |
05.19.2007 |
Suspicious file |
| Prevx1 |
V2 |
05.20.2007 |
no virus found |
| Sophos |
4.17.0 |
05.18.2007 |
Mal/Packer |
| Aditional Information |
| File size: 26154 bytes |
| MD5: e069c3ef0c41b86ab48d00be66d097dd |
| SHA1: 406414f2773ffc68b7e6a072042dd87fb7133904 |
| packers: UPACK |
| |
文章作者：[G-AVR]孤单每一天
文章地址：http://hi.baidu.com/renlangliu/blog/item/8cb8094c7c0369f8d72afc2a.html
测试平台：win2000PROSP4+VM
病毒运行后释放msport.dll/fksdy.dll/wgptl.dll/wtrmm.dll/hreax.dll到%systemroot%\system32目录下，调用SetWindowsHookEx函数挂接explorer.exe，使得父进程为explorer.exe启动的的进行全部进行注入，并添加注册表启动项，释放批处理文件删除病毒自身。病毒使用了线程互守，使得单线程无法被结束，rootkit自身的注册表启动项，达到无法找出启动项的目的（有启动项存在，键值为空）
注册表启动项：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}><C:\WINNT\system32\msacn.dll>
反汇编察看似乎病毒有操作ｈｏｓｔ文件的行为，2000下没有运行成功
.Upack:004030FA mov ecx, offset s_DriversEtcHos ; "drivers\\etc\\hosts"
病毒清除：
使用ＳＣ打开explorer.exe进程，选中“禁止线程创建”，全部选择以上的病毒线程，右键点击“全局卸载指定模块”即可清除该病毒，ＳＣ请到我的网盘下载，使用教程请参见以前的文章。
