2.手动删除文件
"%Documents and Settings%\Administrator\Application Data\svschost.exe"
"%Documents and Settings%\Administrator\Application Data\ctfmon.exe"
"%Documents and Settings%\Administrator\Application Data\tempV0_n9[k4]k-o.tmp"
目录"*:\DATABLOCK(*为移动磁盘盘符)"及其中所有文件
"*:\autorun.inf(*为移动磁盘盘符)"
3.手动删除键值项
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Firewall"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Firewall"
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\Microsoft Windows Firewall"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe"
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ctfmon.exe"
变量声明:
%SystemDriver% 系统所在分区,通常为“C:\”
%SystemRoot% WINDODWS所在目录,通常为“C:\Windows”
%Documents and Settings% 用户文档目录,通常为“C:\Documents and Settings”
%Temp% 临时文件夹,通常为“C:\Documents and Settings\当前用户名称\Local Settings\Temp”
%ProgramFiles% 系统程序默认安装目录,通常为:“C:\ProgramFiles”作者: pioneer 时间: 2012-9-27 09:39 标题: 后门程序Backdoor.Win32.IRCBot.fyc
病毒分析:
1.设置键值项"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA" = 0,禁用用户账户控制功能。
2.创建名字为"V0_n9[k4]k-o"的互斥对象,防止重复运行。
3.获取系统目录,向文件"C:\WINDOWS\system32\drivers\etc\hosts"写入病毒数据,屏蔽对指定网络的访问,如"avg.com"、"avp.com"、"download.mcafee.com"、"kaspersky-labs.com"、"viruslist.com"、"bitdefender.com"、"liveupdate.symantecliveupdate.com"、"my-etrust.com"、"updates.symantec.com"、"virscan.org"等。
4.将自身拷贝重命名为"C:\Documents and Settings\Administrator\Application Data\svschost.exe",设置文件属性为只读、系统、隐藏。
5.创建新进程,执行文件"C:\Documents and Settings\Administrator\Application Data\svschost.exe"。
6."C:\Documents and Settings\Administrator\Application Data\svschost.exe"执行之后:
创建新线程,每隔一秒钟执行步骤(1)(2):
(1)设置键值项"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Firewall" = "C:\Documents and Settings\Administrator\Application Data\svschost.exe"、
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Firewall" = "C:\Documents and
Settings\Administrator\Application Data\svschost.exe",实现病毒开机自启动。
(2)设置键值项"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\List\Microsoft Windows Firewall" = "C:\Documents and
Settings\Administrator\Application Data\svschost.exe",将病毒文件添加到防火墙授权访问列表。
(3)将自身拷贝重命名为"C:\Documents and Settings\Administrator\Application Data\ctfmon.exe",设置文件属性为只读、系统、隐藏。
(4)设置键值项"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe" = "C:\Documents and Settings\Administrator\Application Data\ctfmon.exe"、
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe" = "C:\Documents and
Settings\Administrator\Application Data\ctfmon.exe",实现病毒开机自启动。
(5)设置键值项"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\List\ctfmon.exe" = "C:\Documents and Settings\Administrator\
Application Data\ctfmon.exe",将病毒文件添加到防火墙授权访问列表。
(6)创建进程快照,查找进程"svschost.exe",将病毒数据写入该进程地址空间并执行。
创建新线程,执行步骤(7)(8):
(7)试图关闭标题为"Windows Security Alert"、"BitDefender Firewall Alert"的窗口。
(8)遍历所有可移动设备,并在其中创建目录"*:\DATABLOCK\System(*为移动磁盘盘符)"及文件"*:\DATABLOCK\System\Desktop.ini"、"*:\autorun.inf",并将自身拷贝重命名为"*:\DATABLOCK\System\DATABLOCK.EXE",之后设置该目录及文件属性为只读、系统、隐藏,以此通过可移动磁盘自动运行并传播。
(9)创建套接字,连接到远程主机"xlaa***.no-ip.info",获取计算机名、本地区域信息、操作系统版本等信息发送到该主机,并从该主机接收数据,受控于该主机。
(10)创建文件"C:\Documents and Settings\Administrator\Application Data\tempV0_n9[k4]k-o.tmp",写入记录数据。
病毒创建文件:
"%Documents and Settings%\Administrator\Application Data\svschost.exe"
"%Documents and Settings%\Administrator\Application Data\ctfmon.exe"
"%Documents and Settings%\Administrator\Application Data\tempV0_n9[k4]k-o.tmp"
"*:\DATABLOCK\System\Desktop.ini(*为移动磁盘盘符)"
"*:\autorun.inf(*为移动磁盘盘符)"
"*:\DATABLOCK\System\DATABLOCK.EXE(*为移动磁盘盘符)"
病毒修改文件:
"%SystemRoot%\system32\drivers\etc\hosts"
病毒修改注册表:
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Firewall"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Firewall"
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\Microsoft Windows Firewall"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe"
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ctfmon.exe"