Win32.Troj.xfilter
病毒别名：
处理时间：
威胁级别：★★
中文名称：
病毒类型：木马
影响系统：Win9x/Win2000/WinXP/Win2003
病毒行为:
编写工具： Delphi
传染条件:
发作条件:
系统修改:
释放文件到 %System%
jxhwxj.dll 和 c:filedebug
修改注册表，添加：
[HKEY_CLASSES_ROOTQPWorkFile]
[HKEY_CLASSES_ROOTQPWorkFile]
"EFile"="052034074052039074047117050044088244174069155003143226175040196060132196115114202169224193030068236097086176002045218004223"
[HKEY_CLASSES_ROOTQPWorkFile]
"DFile"="051036066052037069063176050034084104161066198094084009070246077096139208096164230189003123109239045161109039040061175072044099"
[HKEY_CLASSES_ROOTQPWorkFile]
"UC"="052039077052039077039086050045093239037049154173172027136176"
[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHook]
[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHook]
@="Maihook7003"
[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHookClsid]
[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHookClsid]
@=""
[HKEY_CLASSES_ROOTCLSID]
[HKEY_CLASSES_ROOTCLSID]
@="Maihook7003"
[HKEY_CLASSES_ROOTCLSIDInprocServer32]
[HKEY_CLASSES_ROOTCLSIDInprocServer32]
@="C:WINDOWSSYSTEMRJXHWXJ.DLL"
[HKEY_CLASSES_ROOTCLSIDInprocServer32]
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOTCLSIDProgID]
[HKEY_CLASSES_ROOTCLSIDProgID]
@="RJXHWXJ.ShellExecuteHook"
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionexplorerShellExecuteHooks]
""="Maihook7003"
[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]
[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]
"EFile"="052034074052039074047117050044088244174069155003143226175040196060132196115114202169224193030068236097086176002045218004223"
[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]
"DFile"="051036066052037069063176050034084104161066198094084009070246077096139208096164230189003123109239045161109039040061175072044099"
[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]
"UC"="052039077052039077039086050045093239037049154173172027136176"
[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHook]
[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHook]
@="Maihook7003"
[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHookClsid]
[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHookClsid]
@=""
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID]
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID]
@="Maihook7003"
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSIDInprocServer32]
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSIDInprocServer32]
@="C:WINDOWSSYSTEMRJXHWXJ.DLL"
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSIDInprocServer32]
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSIDProgID]
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSIDProgID]
@="RJXHWXJ.ShellExecuteHook"
发作现象:
盗窃边锋、QQ密码，并发送给木马作者的邮箱。可以杀常见国产杀毒软件的进程。
特别说明: