病毒名称：“QQ大盗”变种NW(Win32.Troj.QQPass.nw)威胁级别为一星级，它是木马类型的病毒。能影响Win 9x/ME,Win 2000/NT,Win XP,Win 2003 。该病毒会关闭大量杀毒软件的监控进程以掩护自身，同时获取QQ用户的登录窗口，将窃取的信息通过邮件发送给木马种植者。该病毒运行后，会释放severe.exe等多个病毒文件并修改注册表，还会搜寻并关闭含有“杀毒、专杀、木马”等字符串的窗口，和终止多个杀毒软件的保护进程。

简介

病毒行为(1、复制自身到如下路径： 2、双击盘符激活病毒： 3、改写hosts文件，屏蔽如下安全网站： 4、修改如下注册表项开机自动启动： 5、查找 6、终止如下安全进程： 7、寻找QQ登陆窗口：)

简介

这是一个盗取QQ帐号密码的木马病毒。

病毒行为

1、复制自身到如下路径：

%system%\\severe.exe

%system%\\jusodl.exe

%system%\\drivers\\pnvifj.exe

%system%\\drivers\\conime.exe

释放病毒文件到%system%\\jusodl.dll

2、双击盘符激活病毒：

在每个磁盘根目录下生成如下病毒文件，当用户双击盘符时会激活病毒

OSO.EXE、autorun.inf

3、改写hosts文件，屏蔽如下安全网站：

127.0.0.1 localhost

127.0.0.1 mmsk.cn

127.0.0.1 ikaka.com

127.0.0.1 safe.qq.com

127.0.0.1 360safe.com

127.0.0.1 www.mmsk.cn

127.0.0.1 www.ikaka.com

127.0.0.1 tool.ikaka.com

127.0.0.1 www.360safe.com

127.0.0.1 zs.kingsoft.com

127.0.0.1 forum.ikaka.com

127.0.0.1 up.rising.com.cn

127.0.0.1 scan.kingsoft.com

127.0.0.1 kvup.jiangmin.com

127.0.0.1 reg.rising.com.cn

127.0.0.1 update.rising.com.cn

127.0.0.1 update7.jiangmin.com

127.0.0.1 download.rising.com.cn

127.0.0.1 dnl-us1.kaspersky-labs.com

127.0.0.1 dnl-us2.kaspersky-labs.com

127.0.0.1 dnl-us3.kaspersky-labs.com

127.0.0.1 dnl-us4.kaspersky-labs.com

127.0.0.1 dnl-us5.kaspersky-labs.com

127.0.0.1 dnl-us6.kaspersky-labs.com

127.0.0.1 dnl-us7.kaspersky-labs.com

127.0.0.1 dnl-us8.kaspersky-labs.com

127.0.0.1 dnl-us9.kaspersky-labs.com

127.0.0.1 dnl-us10.kaspersky-labs.com

127.0.0.1 dnl-eu1.kaspersky-labs.com

127.0.0.1 dnl-eu2.kaspersky-labs.com

127.0.0.1 dnl-eu3.kaspersky-labs.com

127.0.0.1 dnl-eu4.kaspersky-labs.com

127.0.0.1 dnl-eu5.kaspersky-labs.com

127.0.0.1 dnl-eu6.kaspersky-labs.com

127.0.0.1 dnl-eu7.kaspersky-labs.com

127.0.0.1 dnl-eu8.kaspersky-labs.com

127.0.0.1 dnl-eu9.kaspersky-labs.com

127.0.0.1 dnl-eu10.kaspersky-labs.com

4、修改如下注册表项开机自动启动：

[HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run]

"pnvifj"="C:\\WINDOWS\\system32\\jusodl.exe"

[HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run]

"jusodl"="C:\\WINDOWS\\system32\\severe.exe"

[HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon]

"Shell"="Explorer.exe C:\\WINDOWS\\system32\\drivers\\conime.exe"

修改如下项，隐藏病毒文件：

[HKLM\\software\\microsoft\\windows\\currentversion\\explorer\\advanced\\folder\\hidden\\showall]

CheckedValue="0"

修改如下键值，使正常文件的运行路径指向病毒文件：

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\MagicSet.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Rav.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\avp.com\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\avp.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\KRegEx.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\KvDetect.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\KvXP.kxp\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\TrojDie.kxp\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\KVMonXP.kxp\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\IceSword.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\mmsk.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\WoptiClean.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\kabaload.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\360Safe.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\runiep.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\iparmo.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\adam.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\RavMon.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\QQDoctor.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\SREng.EXE\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Ras.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\msconfig.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\regedit.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\regedit.com\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\msconfig.com\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\PFWLiveUpdate.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\EGHOST.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\OD32.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

5、查找

查找含有如下字符串的窗口，找到则将其关闭：

杀毒、专杀、病毒、木马、注册表。

停止并禁用如下安全服务：

srservice

sharedaccess

KVWSC

KVSrvXP

kavsvc

RsRavMon

RsCCenter

RsRavMon

6、终止如下安全进程：

"cmd.exe"

"net.exe"

"sc1.exe"

"net1.exe"

"PFW.exe"

"Kav.exe"

"KVOL.exe"

"KVFW.exe"

"adam.exe"

"qqav.exe"

"qqkav.exe"

"TBMon.exe"

"kav32.exe"

"kvwsc.exe"

"CCAPP.exe"

"KRegEx.exe"

"kavsvc.exe"

"VPTray.exe"

"RAVMON.exe"

"EGHOST.exe"

"KavPFW.exe"

"SHSTAT.exe"

"RavTask.exe"

"TrojDie.kxp"

"Iparmor.exe"

"MAILMON.exe"

"MCAGENT.exe"

"KAVPLUS.exe"

"RavMonD.exe"

"Rtvscan.exe"

"Nvsvc32.exe"

"KVMonXP.exe"

"Kvsrvxp.exe"

"CCenter.exe"

"KpopMon.exe"

"RfwMain.exe"

"KWATCHUI.exe"

"MCVSESCN.exe"

"MSKAGENT.exe"

"kvolself.exe"

"KVCenter.kxp"

"kavstart.exe"

"RAVTIMER.exe"

"RRfwMain.exe"

"FireTray.exe"

"UpdaterUI.exe"

"KVSrvXp_1.exe"

"RavService.exe"

7、寻找QQ登陆窗口：

寻找QQ登陆窗口，记录键盘，获得用户密码后通过自身的邮件引擎发送出去。