| 词条 | Win32.Troj.QQPass.doD |
| 释义 | § 病毒别名： 处理时间：2007-02-06 威胁级别：★ 中文名称： 病毒类型：木马 影响系统：Win 9x/ME,Win 2000/NT,Win XP,Win 2003 § 病毒行为: 这是一个盗取QQ帐号密码的木马病毒。 1、复制自身到如下路径： %system%\\severe.exe %system%\\jusodl.exe %system%\\drivers\\pnvifj.exe %system%\\drivers\\conime.exe 释放病毒文件到%system%\\jusodl.dll 2、在每个磁盘根目录下生成如下病毒文件，当用户双击盘符时会激活病毒OSO.EXE、autorun.inf 3、改写hosts文件，屏蔽如下安全网站： 127.0.0.1 localhost 127.0.0.1 mmsk.cn 127.0.0.1 ikaka.com 127.0.0.1 safe.qq.com 127.0.0.1 360safe.com 127.0.0.1 www.mmsk.cn 127.0.0.1 www.ikaka.com 127.0.0.1 tool.ikaka.com 127.0.0.1 www.360safe.com 127.0.0.1 zs.kingsoft.com 127.0.0.1 forum.ikaka.com 127.0.0.1 up.rising.com.cn 127.0.0.1 scan.kingsoft.com 127.0.0.1 kvup.jiangmin.com 127.0.0.1 reg.rising.com.cn 127.0.0.1 update.rising.com.cn 127.0.0.1 update7.jiangmin.com 127.0.0.1 download.rising.com.cn 127.0.0.1 dnl-us1.kaspersky-labs.com 127.0.0.1 dnl-us2.kaspersky-labs.com 127.0.0.1 dnl-us3.kaspersky-labs.com 127.0.0.1 dnl-us4.kaspersky-labs.com 127.0.0.1 dnl-us5.kaspersky-labs.com 127.0.0.1 dnl-us6.kaspersky-labs.com 127.0.0.1 dnl-us7.kaspersky-labs.com 127.0.0.1 dnl-us8.kaspersky-labs.com 127.0.0.1 dnl-us9.kaspersky-labs.com 127.0.0.1 dnl-us10.kaspersky-labs.com 127.0.0.1 dnl-eu1.kaspersky-labs.com 127.0.0.1 dnl-eu2.kaspersky-labs.com 127.0.0.1 dnl-eu3.kaspersky-labs.com 127.0.0.1 dnl-eu4.kaspersky-labs.com 127.0.0.1 dnl-eu5.kaspersky-labs.com 127.0.0.1 dnl-eu6.kaspersky-labs.com 127.0.0.1 dnl-eu7.kaspersky-labs.com 127.0.0.1 dnl-eu8.kaspersky-labs.com 127.0.0.1 dnl-eu9.kaspersky-labs.com 127.0.0.1 dnl-eu10.kaspersky-labs.com 4、修改如下注册表项开机自动启动： 【HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run】 "pnvifj"="C:\\WINDOWS\\system32\\jusodl.exe" 【HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run】 "jusodl"="C:\\WINDOWS\\system32\\severe.exe" 【HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon】 "Shell"="Explorer.exe C:\\WINDOWS\\system32\\drivers\\conime.exe" 修改如下项，隐藏病毒文件： 【HKLM\\software\\microsoft\\windows\\currentversion\\explorer\\advanced\\folder\\hidden\\showall】 CheckedValue="0" 修改如下键值，使正常文件的运行路径指向病毒文件： HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\MagicSet.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Rav.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\avp.com\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\avp.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\KRegEx.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\KvDetect.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\KvXP.kxp\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\TrojDie.kxp\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\KVMonXP.kxp\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\IceSword.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\mmsk.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\WoptiClean.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\kabaload.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\360Safe.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\runiep.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\iparmo.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\adam.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\RavMon.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\QQDoctor.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\SREng.EXE\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Ras.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\msconfig.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\regedit.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\regedit.com\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\msconfig.com\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\PFWLiveUpdate.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\EGHOST.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\OD32.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe" 5、查找含有如下字符串的窗口，找到则将其关闭： 杀毒、专杀、病毒、木马、注册表。 停止并禁用如下安全服务： srservice sharedaccess KVWSC KVSrvXP kavsvc RsRavMon RsCCenter RsRavMon 终止如下安全进程： "cmd.exe" "net.exe" "sc1.exe" "net1.exe" "PFW.exe" "Kav.exe" "KVOL.exe" "KVFW.exe" "adam.exe" "qqav.exe" "qqkav.exe" "TBMon.exe" "kav32.exe" "kvwsc.exe" "CCAPP.exe" "KRegEx.exe" "kavsvc.exe" "VPTray.exe" "RAVMON.exe" "EGHOST.exe" "KavPFW.exe" "SHSTAT.exe" "RavTask.exe" "TrojDie.kxp" "Iparmor.exe" "MAILMON.exe" "MCAGENT.exe" "KAVPLUS.exe" "RavMonD.exe" "Rtvscan.exe" "Nvsvc32.exe" "KVMonXP.exe" "Kvsrvxp.exe" "CCenter.exe" "KpopMon.exe" "RfwMain.exe" "KWATCHUI.exe" "MCVSESCN.exe" "MSKAGENT.exe" "kvolself.exe" "KVCenter.kxp" "kavstart.exe" "RAVTIMER.exe" "RRfwMain.exe" "FireTray.exe" "UpdaterUI.exe" "KVSrvXp_1.exe" "RavService.exe" 7、寻找QQ登陆窗口，记录键盘，获得用户密码后通过自身的邮件引擎发送出去。 |
| 随便看 |
百科全书收录594082条中文百科知识，基本涵盖了大多数领域的百科知识，是一部内容开放、自由的电子版百科全书。