病毒指紋：

SHA-160             : DA14DDB10D14C568B62176AAB738B0C479A06863
MD5                 : C505733FFDDA0394D404BD5BB652C1A6
RIPEMD-160          : 410EF9736AD4966094C096E57B477B7572B7ED9C
CRC-32              : FF6E4568

病毒大?。?3,900 字節(jié)

連接網(wǎng)絡(luò)下載病毒：

輸入地址：61.152.255.252
對(duì)應(yīng)地址：上海市電信IDC

在本機(jī)隨機(jī)生成如下病毒文件：

meex.com、rmwaccq.exe、wojhadp.exe、nqgphqd.exe、autorun.inf

下載運(yùn)行如下文件：

1A11.exe、2B12.exe、3C13.exe、2B12.exe

隨機(jī)生成hiv文件進(jìn)行進(jìn)程互守

破壞安全模式；

.Upack:00408184 s_SystemControl db 'SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}',0
.Upack:00408184                                              ; DATA XREF: sub_407CF4+6B o
.Upack:004081D9                      align 4
.Upack:004081DC s_T                  db 0FFh,0FFh,0FFh,0FFh,'T',0
.Upack:004081E2                      align 4
.Upack:004081E4 s_SystemContr_0 db 'SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}',0
.Upack:004081E4                                              ; DATA XREF: sub_407CF4+7A o
.Upack:00408239                      align 4
.Upack:0040823C s_X                  db 0FFh,0FFh,0FFh,0FFh,'X',0
.Upack:00408242                      align 4
.Upack:00408244 s_SystemCurrent db 'SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}',0
.Upack:00408244                                              ; DATA XREF: sub_407CF4+89 o
.Upack:0040829D                      align 10h
.Upack:004082A0 s_X_0                db 0FFh,0FFh,0FFh,0FFh,'X',0
.Upack:004082A6                      align 4
.Upack:004082A8 s_SystemCurre_0 db 'SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}',0
.Upack:004082A8                                              ; DATA XREF: sub_407CF4+98 o
.Upack:00408301                      align 4
.Upack:00408304                      dd 0FFFFFFFFh, 0Ch

破壞隱藏文件選項(xiàng)：
.Upack:0040830C s_Checkedvalue       db 'CheckedValue',0          ; DATA XREF: sub_407CF4+A7 o
.Upack:00408319                      align 4
.Upack:0040831C s_Q                  db 0FFh,0FFh,0FFh,0FFh,'Q',0
.Upack:00408322                      align 4
.Upack:00408324 s_SoftwareMicro db 'software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall',0


開(kāi)啟自動(dòng)播放；

.Upack:00408524 s_SoftwareMic_4 db 'SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer',0
.Upack:00408524                                              ; DATA XREF: sub_407CF4+201 o
.Upack:00408560 ; char s_Nodrivetypeau[]
.Upack:00408560 s_Nodrivetypeau db 'NoDriveTypeAutoRun',0 ; DATA XREF: sub_407CF4+21A o

關(guān)閉并禁用AVP、wuauserv、wscsvc'、RsRavMon、RsCCenter、RSPPSYS服務(wù)


.Upack:004085CC ; char s_SystemCurre_5[]
.Upack:00408600 s_SystemCurre_6 db 'SYSTEM\CurrentControlSet\Services\RSPPSYS',0
.Upack:00408600                                            ; DATA XREF: sub_407CF4+2D9 o
.Upack:0040862A                    align 4
.Upack:0040862C ; char s_SystemCurre_7[]
.Upack:0040862C s_SystemCurre_7 db 'SYSTEM\CurrentControlSet\Services\RsCCenter',0
.Upack:0040862C                                            ; DATA XREF: sub_407CF4+30F o
.Upack:00408658 ; char s_SystemContr_1[]
.Upack:00408658 s_SystemContr_1 db 'SYSTEM\ControlSet001\Services\RsCCenter',0
.Upack:00408658                                            ; DATA XREF: sub_407CF4+345 o
.Upack:00408680 ; char s_SystemContr_2[]
.Upack:00408680 s_SystemContr_2 db 'SYSTEM\ControlSet001\Services\RsRavMon',0
.Upack:00408680                                            ; DATA XREF: sub_407CF4+37B o
.Upack:004086A7                    align 4
.Upack:004086A8 ; char s_SystemContr_5[]
.Upack:004086A8 s_SystemContr_5 db 'SYSTEM\ControlSet001\Services\wscsvc',0
.Upack:004086A8                                            ; DATA XREF: sub_407CF4+3B1 o
.Upack:004086CD                    align 10h
.Upack:004086D0 ; char s_SystemContr_3[]
.Upack:004086D0 s_SystemContr_3 db 'SYSTEM\ControlSet001\Services\wuauserv',0
.Upack:004086D0                                            ; DATA XREF: sub_407CF4+3E7 o
.Upack:004086F7                    align 4
.Upack:004086F8 ; char s_SystemContr_4[]
.Upack:004086F8 s_SystemContr_4 db 'SYSTEM\ControlSet002\Services\AVP',0
.Upack:004086F8                                            ; DATA XREF: sub_407CF4+41D o

對(duì)Ｎ多的安全工具、系統(tǒng)程序以及殺毒軟件做映像劫持（IFEO）

由于太多就不列出了，和以前的病毒樣本劫持的一樣，具體可以參見(jiàn)好友余弦函數(shù)的文章。

解決方法

使用procexp.exe暫停病毒兩個(gè)進(jìn)程，運(yùn)行里面鍵入“system32”后按時(shí)間排列圖標(biāo)找到病毒文件后刪除：

重命名autoruns打開(kāi)找到映像劫持項(xiàng)只保留Your Image File Name Here without a path項(xiàng)其他全部刪除

打開(kāi)acdsee刪除每個(gè)盤(pán)符下的病毒文件和autorun.inf腳本，切忌不要使用右鍵的打開(kāi)和資源管理器，

[AutoRun]
open=nqgphqd.exe
shell\open=打開(kāi)(&O)
shell\open\Command=nqgphqd.exe
shell\open\Default=1
shell\explore=資源管理器(&X)
shell\explore\Command=nqgphqd.exe

修復(fù)安全模式和隱藏文件的注冊(cè)表如下（將如下文件保存為reg文件雙擊導(dǎo)入注冊(cè)表）：

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Type"="radio"
"CheckedValue"=dword:00000001

病毒用腳本插入了這兩個(gè)常規(guī)命令，由于病毒生成的文件名隨機(jī)，而且進(jìn)程標(biāo)識(shí)符（ＰＩＤ）也是隨機(jī)變化的，所以只能夠貼圖來(lái)寫(xiě)解決方法了。

最新評(píng)論