Win32.Troj.QQPass.rq
威胁级别：★
病毒类型：木马
影响系统：Win 9x/ME,Win 2000/NT,Win XP,Win 2003
病毒行为:
该病毒是一个QQ盗号木马。建议电脑用户升级病毒库查杀该病毒，以免中毒造成损失。
1、生成的文件
C:WINNTsystem32QQhx.dat
C:WINNTsystem32axvvuu.exe
C:WINNTsystem32axvvuu.dll
C:WINNTsystem32
oruns.reg
D:sxs.exe
D:autorun.inf
2、添加注册表启动项
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
"aphkga" = "C:WINNTsystem32axvvuu.exe"
3、设置系统隐藏所有隐藏文件
HKLMsoftwaremicrosoftwindowscurrentversionexploreradvancedfolderhidde
nshowallCheckedValue SUCCESS "0"
4、尝试删除下列启动项
HKLMSoftwareMicrosoftWindowsCurrentVersionRunRavTask
HKLMSoftwareMicrosoftWindowsCurrentVersionRunKvMonXP
HKLMSoftwareMicrosoftWindowsCurrentVersionRunYLive.exe
HKLMSoftwareMicrosoftWindowsCurrentVersionRunyassistse
HKLMSoftwareMicrosoftWindowsCurrentVersionRunKAVPersonal50
HKLMSoftwareMicrosoftWindowsCurrentVersionRunNTdhcp
HKLMSoftwareMicrosoftWindowsCurrentVersionRunWinhoxt
HKLMSoftwareMicrosoftWindowsCurrentVersionRunaphkga
HKLMSoftwareMicrosoftWindowsCurrentVersionRunyes
5、添加d盘自动播放启动病毒
autorun.inf
------------------------------
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shellAutocommand=sxs.exe
------------------------------
6、该病毒在系统中安装类型为：WH_MOUSE，WH_KEYBOARD，WH_CALLWNDPROC的消息钩子
监视用户鼠标键盘等消息。其申请进程为：C:WINNTsystem32axvvuu.exe
7、结束下列进程
SKYNET_PERSONAL_FIREWALL
KingsoftAntivirusScanProgram
TBMon.exe
kav32.exe
kvwsc.exe
CCAPP.exe
conime.exe
EGHOST.exe
KRegEx.exe
kavsvc.exe
VPTray.exe
RAVMON.exe
KavPFW.exe
SHSTAT.exe
RavTask.exe
TrojDie.kxp
Iparmor.exe
MAILMON.exe
MCAGENT.exe
KAVPLUS.exe
RavMonD.exe
Rtvscan.exe
Nvsvc32.exe
KVMonXP.exe
Kvsrvxp.exe
CCenter.exe
KpopMon.exe
RfwMain.exe
KWATCHUI.exe
MCVSESCN.exe
MSKAGENT.exe
kvolself.exe
KVCenter.kxp
kavstart.exe
RAVTIMER.exe
RRfwMain.exe
FireTray.exe
UpdaterUI.exe
KVSrvXp_1.exe
RavService.exe