Win32.Troj.QQPass.nw
病毒别名： 处理时间：2007-02-06 威胁级别：★
中文名称： 病毒类型：木马 影响系统：Win 9x/ME,Win 2000/NT,Win XP,Win 2003
病毒行为:
这是一个盗取QQ帐号密码的木马病毒。
1、复制自身到如下路径：
%system%severe.exe
%system%jusodl.exe
%system%driverspnvifj.exe
%system%driversconime.exe
释放病毒文件到%system%jusodl.dll
2、在每个磁盘根目录下生成如下病毒文件，当用户双击盘符时会激活病毒
OSO.EXE、autorun.inf
3、改写hosts文件，屏蔽如下安全网站：
127.0.0.1 localhost
127.0.0.1 mmsk.cn
127.0.0.1 ikaka.com
127.0.0.1 safe.qq.com
127.0.0.1 360safe.com
127.0.0.1 www.mmsk.cn
127.0.0.1 www.ikaka.com
127.0.0.1 tool.ikaka.com
127.0.0.1 www.360safe.com
127.0.0.1 zs.kingsoft.com
127.0.0.1 forum.ikaka.com
127.0.0.1 up.rising.com.cn
127.0.0.1 scan.kingsoft.com
127.0.0.1 kvup.jiangmin.com
127.0.0.1 reg.rising.com.cn
127.0.0.1 update.rising.com.cn
127.0.0.1 update7.jiangmin.com
127.0.0.1 download.rising.com.cn
127.0.0.1 dnl-us1.kaspersky-labs.com
127.0.0.1 dnl-us2.kaspersky-labs.com
127.0.0.1 dnl-us3.kaspersky-labs.com
127.0.0.1 dnl-us4.kaspersky-labs.com
127.0.0.1 dnl-us5.kaspersky-labs.com
127.0.0.1 dnl-us6.kaspersky-labs.com
127.0.0.1 dnl-us7.kaspersky-labs.com
127.0.0.1 dnl-us8.kaspersky-labs.com
127.0.0.1 dnl-us9.kaspersky-labs.com
127.0.0.1 dnl-us10.kaspersky-labs.com
127.0.0.1 dnl-eu1.kaspersky-labs.com
127.0.0.1 dnl-eu2.kaspersky-labs.com
127.0.0.1 dnl-eu3.kaspersky-labs.com
127.0.0.1 dnl-eu4.kaspersky-labs.com
127.0.0.1 dnl-eu5.kaspersky-labs.com
127.0.0.1 dnl-eu6.kaspersky-labs.com
127.0.0.1 dnl-eu7.kaspersky-labs.com
127.0.0.1 dnl-eu8.kaspersky-labs.com
127.0.0.1 dnl-eu9.kaspersky-labs.com
127.0.0.1 dnl-eu10.kaspersky-labs.com
4、修改如下注册表项开机自动启动：
[HKLMSoftwareMicrosoftWindowsCurrentVersionRun]
"pnvifj"="C:WINDOWSsystem32jusodl.exe"
[HKLMSoftwareMicrosoftWindowsCurrentVersionRun]
"jusodl"="C:WINDOWSsystem32severe.exe"
[HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon]
"Shell"="Explorer.exe C:WINDOWSsystem32driversconime.exe"
修改如下项，隐藏病毒文件：
[HKLMsoftwaremicrosoftwindowscurrentversionexploreradvancedfolderhiddenshowall]
CheckedValue="0"
修改如下键值，使正常文件的运行路径指向病毒文件：
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsMagicSet.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsRav.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsavp.comDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsavp.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKRegEx.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKvDetect.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKvXP.kxpDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsTrojDie.kxpDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsKVMonXP.kxpDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsIceSword.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsmmsk.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsWoptiClean.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionskabaload.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Options360Safe.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Options
uniep.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsiparmo.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsadam.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsRavMon.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsQQDoctor.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsSREng.EXEDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsRas.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsconfig.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Options
egedit.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Options
egedit.comDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsconfig.comDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsPFWLiveUpdate.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsEGHOST.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution OptionsNOD32.exeDebugger "C:WINDOWSsystem32driverspnvifj.exe"
5、查找含有如下字符串的窗口，找到则将其关闭：
杀毒、专杀、病毒、木马、注册表。
停止并禁用如下安全服务：
srservice
sharedaccess
KVWSC
KVSrvXP
kavsvc
RsRavMon
RsCCenter
RsRavMon
终止如下安全进程：
"cmd.exe"
"net.exe"
"sc1.exe"
"net1.exe"
"PFW.exe"
"Kav.exe"
"KVOL.exe"
"KVFW.exe"
"adam.exe"
"qqav.exe"
"qqkav.exe"
"TBMon.exe"
"kav32.exe"
"kvwsc.exe"
"CCAPP.exe"
"KRegEx.exe"
"kavsvc.exe"
"VPTray.exe"
"RAVMON.exe"
"EGHOST.exe"
"KavPFW.exe"
"SHSTAT.exe"
"RavTask.exe"
"TrojDie.kxp"
"Iparmor.exe"
"MAILMON.exe"
"MCAGENT.exe"
"KAVPLUS.exe"
"RavMonD.exe"
"Rtvscan.exe"
"Nvsvc32.exe"
"KVMonXP.exe"
"Kvsrvxp.exe"
"CCenter.exe"
"KpopMon.exe"
"RfwMain.exe"
"KWATCHUI.exe"
"MCVSESCN.exe"
"MSKAGENT.exe"
"kvolself.exe"
"KVCenter.kxp"
"kavstart.exe"
"RAVTIMER.exe"
"RRfwMain.exe"
"FireTray.exe"
"UpdaterUI.exe"
"KVSrvXp_1.exe"
"RavService.exe"
7、寻找QQ登陆窗口，记录键盘，获得用户密码后通过自身的邮件引擎发送出去。