概述

病毒行为

概述

病毒别名： 处理时间：2007-02-06 威胁级别：★

中文名称： 病毒类型：木马 影响系统：Win 9x/ME,Win 2000/NT,Win XP,Win 2003

病毒行为

这是一个盗取QQ帐号密码的木马病毒。

1、复制自身到如下路径：

%system%\\severe.exe

%system%\\jusodl.exe

%system%\\drivers\\pnvifj.exe

%system%\\drivers\\conime.exe

释放病毒文件到%system%\\jusodl.dll

2、在每个磁盘根目录下生成如下病毒文件，当用户双击盘符时会激活病毒

OSO.EXE、autorun.inf

3、改写hosts文件，屏蔽如下安全网站：

127.0.0.1 localhost

127.0.0.1 mmsk.cn

127.0.0.1 ikaka.com

127.0.0.1 safe.qq.com

127.0.0.1 360safe.com

127.0.0.1 www.mmsk.cn

127.0.0.1 www.ikaka.com

127.0.0.1 tool.ikaka.com

127.0.0.1 www.360safe.com

127.0.0.1 zs.kingsoft.com

127.0.0.1 forum.ikaka.com

127.0.0.1 up.rising.com.cn

127.0.0.1 scan.kingsoft.com

127.0.0.1 kvup.jiangmin.com

127.0.0.1 reg.rising.com.cn

127.0.0.1 update.rising.com.cn

127.0.0.1 update7.jiangmin.com

127.0.0.1 download.rising.com.cn

127.0.0.1 dnl-us1.kaspersky-labs.com

127.0.0.1 dnl-us2.kaspersky-labs.com

127.0.0.1 dnl-us3.kaspersky-labs.com

127.0.0.1 dnl-us4.kaspersky-labs.com

127.0.0.1 dnl-us5.kaspersky-labs.com

127.0.0.1 dnl-us6.kaspersky-labs.com

127.0.0.1 dnl-us7.kaspersky-labs.com

127.0.0.1 dnl-us8.kaspersky-labs.com

127.0.0.1 dnl-us9.kaspersky-labs.com

127.0.0.1 dnl-us10.kaspersky-labs.com

127.0.0.1 dnl-eu1.kaspersky-labs.com

127.0.0.1 dnl-eu2.kaspersky-labs.com

127.0.0.1 dnl-eu3.kaspersky-labs.com

127.0.0.1 dnl-eu4.kaspersky-labs.com

127.0.0.1 dnl-eu5.kaspersky-labs.com

127.0.0.1 dnl-eu6.kaspersky-labs.com

127.0.0.1 dnl-eu7.kaspersky-labs.com

127.0.0.1 dnl-eu8.kaspersky-labs.com

127.0.0.1 dnl-eu9.kaspersky-labs.com

127.0.0.1 dnl-eu10.kaspersky-labs.com

4、修改如下注册表项开机自动启动：

[HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run]

"pnvifj"="C:\\WINDOWS\\system32\\jusodl.exe"

[HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run]

"jusodl"="C:\\WINDOWS\\system32\\severe.exe"

[HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon]

"Shell"="Explorer.exe C:\\WINDOWS\\system32\\drivers\\conime.exe"

修改如下项，隐藏病毒文件：

[HKLM\\software\\microsoft\\windows\\currentversion\\explorer\\advanced\\folder\\hidden\\showall]

CheckedValue="0"

修改如下键值，使正常文件的运行路径指向病毒文件：

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\MagicSet.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Rav.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\avp.com\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\avp.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\KRegEx.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\KvDetect.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\KvXP.kxp\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\TrojDie.kxp\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\KVMonXP.kxp\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\IceSword.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\mmsk.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\WoptiClean.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\kabaload.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\360Safe.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\runiep.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\iparmo.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\adam.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\RavMon.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\QQDoctor.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\SREng.EXE\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Ras.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\msconfig.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\regedit.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\regedit.com\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\msconfig.com\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\PFWLiveUpdate.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\EGHOST.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\OD32.exe\\Debugger "C:\\WINDOWS\\system32\\drivers\\pnvifj.exe"

5、查找含有如下字符串的窗口，找到则将其关闭：

杀毒、专杀、病毒、木马、注册表。

停止并禁用如下安全服务：

srservice

sharedaccess

KVWSC

KVSrvXP

kavsvc

RsRavMon

RsCCenter

RsRavMon

终止如下安全进程：

"cmd.exe"

"net.exe"

"sc1.exe"

"net1.exe"

"PFW.exe"

"Kav.exe"

"KVOL.exe"

"KVFW.exe"

"adam.exe"

"qqav.exe"

"qqkav.exe"

"TBMon.exe"

"kav32.exe"

"kvwsc.exe"

"CCAPP.exe"

"KRegEx.exe"

"kavsvc.exe"

"VPTray.exe"

"RAVMON.exe"

"EGHOST.exe"

"KavPFW.exe"

"SHSTAT.exe"

"RavTask.exe"

"TrojDie.kxp"

"Iparmor.exe"

"MAILMON.exe"

"MCAGENT.exe"

"KAVPLUS.exe"

"RavMonD.exe"

"Rtvscan.exe"

"Nvsvc32.exe"

"KVMonXP.exe"

"Kvsrvxp.exe"

"CCenter.exe"

"KpopMon.exe"

"RfwMain.exe"

"KWATCHUI.exe"

"MCVSESCN.exe"

"MSKAGENT.exe"

"kvolself.exe"

"KVCenter.kxp"

"kavstart.exe"

"RAVTIMER.exe"

"RRfwMain.exe"

"FireTray.exe"

"UpdaterUI.exe"

"KVSrvXp_1.exe"

"RavService.exe"

7、寻找QQ登陆窗口，记录键盘，获得用户密码后通过自身的邮件引擎发送出去。