Worm/Win32.AutoRun.etm
病毒标签：病毒名称： Worm/Win32.AutoRun.etm
病毒类型： 蠕虫
文件 MD5： 4AA1BD21CD37E822348E19CE4917323E
公开范围： 完全公开
危害等级： 4
文件长度： 40,630 字节
感染系统： Windows98以上版本
开发工具： Borland Delphi 6.0 - 7.0
加壳类型： Upack 0.3.9 beta2s -> Dwing
病毒描述：该病毒为蠕虫类，病毒运行后复制自身到系统目录下，并衍生病毒文件；修改注册表，添加启动项，降低ie浏览器的安全性能，锁定“文件夹选项”中对隐藏文件的显隐选择，连接网络下载病毒文件，并执行；病毒运行完毕后删除自身。
行为分析-本地行为：1、文件运行后会释放以下文件
%System%jjxzajcj32dl.dll 63,488 字节[随机文件名]
%System%jjxzwzjy090118.exe 40,630 字节[随机文件名]
2、新增注册表
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL]
注册表值: "CheckedValue"
新建键值: DWORD: 0 (0)
原键值: DWORD: 1 (0x1)
描述：锁定“文件夹选项”中对隐藏文件的显隐选择
[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain]
注册表值: "Check_Associations"
类型： REG_SZ
值: "no"
描述：降低ie浏览器的安全性能
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
un]
注册表值: "dlmcjjcdfc"
类型： REG_SZ
值: "C:WINDOWSsystemjjxzwzjy090118.exe"
描述：启动项，使病毒文件随资源管理器启动
行为分析-网络行为：1、连接网络下载要下载的病毒列表
协议：TCP
域名或IP地址：www.a3168.com
列表地址：HTTP://www.a3168.com/mydown.asp?ver=090118&tgid=3&address=00-0C-29-9C-7B-01
列表内容：
begin
1,090120,10241,http://www.wew2223.cn/new/shengji.exe,120,1,180,1,10000,11,0,1,0,1
7,
2,0,34000,http://www.wew2223.cn/new/css.exe,10,0-24,,
2,0,47000,http://www.wew2223.cn/new/ggg.exe,30,0-24,,
2,90120,16000,http://www.wew2223.cn/new/30.exe,100,0-24,,
2,0,148000,http://www.wew2223.cn/new/msn180.exe,10,0-24,,
3,127.0.0.1,js.tongji.cn.yahoo.com
3,127.0.0.1,img.tongji.cn.yahoo.com
end
2、下载文件的危害说明：
http://www.wew2223.cn/new/shengji.exe
Worm/Win32.AutoRun.etn
http://www.wew2223.cn/new/css.exe
Rootkit/Win32.Agent.fvn
http://www.wew2223.cn/new/ggg.exe
Trojan/Win32.QQPass.eu[stealer]
http://www.wew2223.cn/new/30.exe
Trojan/Win32.VB.irf
http://www.wew2223.cn/new/msn180.exe
AdWare/Win32.AdMedia.ed[:not_virus]
注：%System32%是一个可变路径。病毒通过查询操作系统来决定当前System文件夹的位置。Windows2000/NT中默认的安装路径是C:WinntSystem32，windows95/98/me中默认的安装路径是C:WindowsSystem，windowsXP中默认的安装路径是C:WindowsSystem32。
%Temp% = C:Documents and SettingsAAAAALocal SettingsTemp 当前用户TEMP缓存变量
%Windir% WINDODWS所在目录
%DriveLetter% 逻辑驱动器根目录
%ProgramFiles% 系统程序默认安装目录
%HomeDrive% = C: 当前启动的系统的所在分区
%Documents and Settings% 当前用户文档根目录
清除方案：1、使用安天防线可彻底清除此病毒(推荐)，请点击下载。
点击此处免费下载安天防线(http://www.antiyfx.com/download.htm)。
2、手工清除请按照行为分析删除对应文件，恢复相关系统设置。
推荐使用ATool管理工具，
点击此处下载免费工具Atool(http://www.antiy.com/cn/download/atool.htm)。
(1) 使用安天防线工具中的“进程管理”关闭病毒进程
Ggg.exe；svteppsk.exe；IEXPLORER.EXE；dfcjj32tmp0.exe
(2) 删除病毒文件
%Windir%30.exe
%Windir%css.exe
%Windir%ggg.exe
%Windir%installreg.asp
%Windir%systemjjxzajcj32dl.dll
%Windir%systemjjxzwzjy090120.exe
%System32%40674985.dat
%System32%anymie360.dll
%System32%anymie360.exe
%System32%cjpoajni.dll
%System32%coebccid.dll
%System32%ddgjndgf.dll
%System32%dfcjj32tmp0.exe
%System32%dllcacheeep.sys
%System32%driverseep.sys
%System32%driversetchosts
%System32%fgjkccga.dll
%System32%gmgedabp.dll
%System32%ifigadlj.dll
%System32%lgloboec.dll
%System32%lpceeabp.dll
%System32%
bepjcll.dll
%System32%pknphokc.dll
%System32%sadfasdf.jpg
%System32%svtepps.dll
%System32%svteppsk.exe
%System32%sysdlwd2.dll
%System32%TnmgtjD.dll
%Windir%ver.txt
清空%Temp%
清空IE临时目录
(3) 恢复病毒修改的注册表项目，删除病毒添加的注册表项
HKEY_LOCAL_MACHINESOFTWAREMicrosoftDirectDrawMostRecentApplicationName
新: 字符串: "IEXPLORE.exe"
旧: 字符串: "mshta.exe"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindowsAppInit_DLLs
新: 字符串: "svtepps.dll"
旧: 字符串: ""
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALLCheckedValue
新: DWORD: 0 (0)
旧: DWORD: 1 (0x1)
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnceFlashPlayerUpdate
键值: 字符串: "C:WINDOWSsystem32MacromedFlashGetFlash.exe"
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{060EDAB9-2AD0-4AC4-BCBF-8EA541BE735B}InProcServer32@
键值: 字符串: "C:WINDOWSsystem32gmgedabp.dll"
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{2F20AD53-13A2-4340-8D4F-64EBBFDC98A7}InProcServer32@
键值: 字符串: "C:WINDOWSsystem32ifigadlj.dll"
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{3FDEB171-8F86-0004-0001-69B8DB553683}InProcServer32@
键值: 字符串: "C:WINDOWSsystem32sysmxd6.dll"
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{3FDEB171-8F86-0009-0001-69B8DB553683}InProcServer32@
键值: 字符串: "C:WINDOWSsystem32sysdlwd2.dll"
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{5058B8EC-9E4F-431F-8415-E2AD3569F02A}InProcServer32@
键值: 字符串: "C:WINDOWSsystem32lgloboec.dll"
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{59CEEAB9-A039-4185-B4E8-8E1E5FD7F9FB}InProcServer32@
键值: 字符串: "C:WINDOWSsystem32lpceeabp.dll"
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{7BE93C55-419A-40FA-8750-F4D2EBEF1847}InProcServer32@
键值: 字符串: "C:WINDOWSsystem32
bepjcll.dll"
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{9479184C-D769-4611-A992-526D8E72968D}InProcServer32@
键值: 字符串: "C:WINDOWSsystem32pknphokc.dll"
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{C398A372-7022-40B1-9715-9BA47E9C59E9}InProcServer32@
键值: 字符串: "C:WINDOWSsystem32cjpoajni.dll"
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{C8EBCC2D-1377-4E2B-951F-407D8E4DBD5C}InProcServer32@
键值: 字符串: "C:WINDOWSsystem32coebccid.dll"
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{DD037D0F-C51F-4870-9478-BD982536E415}InProcServer32@
键值: 字符串: "C:WINDOWSsystem32ddgjndgf.dll"
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{F034CC0A-377A-4247-A276-2D484EAA1229}InProcServer32@
键值: 字符串: "C:WINDOWSsystem32fgjkccga.dll"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{060EDAB9-2AD0-4AC4-BCBF-8EA541BE735B}
键值: <值未设置>
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{2F20AD53-13A2-4340-8D4F-64EBBFDC98A7}
键值: <值未设置>
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{3FDEB171-8F86-0004-0001-69B8DB553683}
键值: 字符串: ""
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{3FDEB171-8F86-0009-0001-69B8DB553683}
键值: 字符串: ""
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{5058B8EC-9E4F-431F-8415-E2AD3569F02A}
键值: <值未设置>
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{59CEEAB9-A039-4185-B4E8-8E1E5FD7F9FB}
键值: <值未设置>
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{7BE93C55-419A-40FA-8750-F4D2EBEF1847}
键值: <值未设置>
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{9479184C-D769-4611-A992-526D8E72968D}
键值: <值未设置>
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{C398A372-7022-40B1-9715-9BA47E9C59E9}
键值: <值未设置>
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{C8EBCC2D-1377-4E2B-951F-407D8E4DBD5C}
键值: <值未设置>
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{DD037D0F-C51F-4870-9478-BD982536E415}
键值: <值未设置>
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{F034CC0A-377A-4247-A276-2D484EAA1229}
键值: <值未设置>
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
un
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
unAlcmtr
键值: 字符串: "anymie360.exe"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
undlmcjjcdfc
键值: 字符串: "C:WINDOWSsystemjjxzwzjy090120.exe"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
unqq20009
键值: 字符串: "C:WINDOWSggg.exe"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad 60EDAB9
键值: 字符串: "{060EDAB9-2AD0-4AC4-BCBF-8EA541BE735B}"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad2F20AD53
键值: 字符串: "{2F20AD53-13A2-4340-8D4F-64EBBFDC98A7}"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad5058B8EC
键值: 字符串: "{5058B8EC-9E4F-431F-8415-E2AD3569F02A}"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad59CEEAB9
键值: 字符串: "{59CEEAB9-A039-4185-B4E8-8E1E5FD7F9FB}"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad7BE93C55
键值: 字符串: "{7BE93C55-419A-40FA-8750-F4D2EBEF1847}"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad9479184C
键值: 字符串: "{9479184C-D769-4611-A992-526D8E72968D}"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoadC398A372
键值: 字符串: "{C398A372-7022-40B1-9715-9BA47E9C59E9}"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoadC8EBCC2D
键值: 字符串: "{C8EBCC2D-1377-4E2B-951F-407D8E4DBD5C}"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoadDD037D0F
键值: 字符串: "{DD037D0F-C51F-4870-9478-BD982536E415}"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoadF034CC0A
键值: 字符串: "{F034CC0A-377A-4247-A276-2D484EAA1229}"
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesMediaCenterDescription
键值: 字符串: "Provides support for media palyer. This service can't be stoped."
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesMediaCenterDisplayName
键值: 字符串: "MS Media Control Center"
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesMediaCenterImagePath
键值: 字符串: "%SystemRoot%System32svchost.exe -k krnlsrvc"
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesMediaCenterObjectName
键值: 字符串: "LocalSystem"
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesMediaCenterParametersServiceDll
键值: 字符串: "C:WINDOWSsystem32TnmgtjD.dll"
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesMediaCenterStart
键值: DWORD: 2 (0x2)
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesSafeMon0DisplayName
键值: 字符串: "Safe Mon 360"
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesSafeMon0ImagePath
键值: 字符串: "??C:WINDOWSsystem3240674985.dat"
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesSafeMon0Start
键值: DWORD: 1 (0x1)