病毒简述

系统修改

发作现象

病毒简述

病毒别名：

处理时间：

威胁级别：★★

中文名称：

病毒类型：木马

影响系统：Win9x/Win2000/WinXP/Win2003

病毒行为:

编写工具： Delphi

传染条件:

发作条件:

系统修改

释放文件到 %System%

jxhwxj.dll 和 c:filedebug

修改注册表，添加：

[HKEY_CLASSES_ROOTQPWorkFile]

[HKEY_CLASSES_ROOTQPWorkFile]

"EFile"="052034074052039074047117050044088244174069155003143226175040196060132196115114202169224193030068236097086176002045218004223"

[HKEY_CLASSES_ROOTQPWorkFile]

"DFile"="051036066052037069063176050034084104161066198094084009070246077096139208096164230189003123109239045161109039040061175072044099"

[HKEY_CLASSES_ROOTQPWorkFile]

"UC"="052039077052039077039086050045093239037049154173172027136176"

[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHook]

[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHook]

@="Maihook7003"

[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHookClsid]

[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHookClsid]

@=""

[HKEY_CLASSES_ROOTCLSID]

[HKEY_CLASSES_ROOTCLSID]

@="Maihook7003"

[HKEY_CLASSES_ROOTCLSIDInprocServer32]

[HKEY_CLASSES_ROOTCLSIDInprocServer32]

@="C:\\WINDOWS\\SYSTEM\\RJXHWXJ.DLL"

[HKEY_CLASSES_ROOTCLSIDInprocServer32]

"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOTCLSIDProgID]

[HKEY_CLASSES_ROOTCLSIDProgID]

@="RJXHWXJ.ShellExecuteHook"

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionexplorerShellExecuteHooks]

""="Maihook7003"

[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]

[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]

"EFile"="052034074052039074047117050044088244174069155003143226175040196060132196115114202169224193030068236097086176002045218004223"

[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]

"DFile"="051036066052037069063176050034084104161066198094084009070246077096139208096164230189003123109239045161109039040061175072044099"

[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]

"UC"="052039077052039077039086050045093239037049154173172027136176"

[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHook]

[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHook]

@="Maihook7003"

[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHookClsid]

[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHookClsid]

@=""

[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID]

[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID]

@="Maihook7003"

[HKEY_LOCAL_MACHINESoftwareCLASSESCLSIDInprocServer32]

[HKEY_LOCAL_MACHINESoftwareCLASSESCLSIDInprocServer32]

@="C:\\WINDOWS\\SYSTEM\\RJXHWXJ.DLL"

[HKEY_LOCAL_MACHINESoftwareCLASSESCLSIDInprocServer32]

"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINESoftwareCLASSESCLSIDProgID]

[HKEY_LOCAL_MACHINESoftwareCLASSESCLSIDProgID]

@="RJXHWXJ.ShellExecuteHook"

发作现象

盗窃边锋、QQ密码，并发送给木马作者的邮箱。可以杀常见国产杀毒软件的进程。