Trojan/PSW.Agent.cxh

王朝百科·作者佚名 2010-02-06

宽屏版字体: 小 | 中 | 大 | 超大

病毒名称 Trojan/PSW.Agent.cxh

病毒类型木马

危险级别 ★★

影响平台 Win 9X/ME/NT/2000/XP/2003

描述这是一个木马病毒。

Trojan/PSW.Agent.cxh“代理木马”变种cxh是一个盗取用户计算机上机密信息的木马程序。“代理木马”变种cxh运行后，自我复制到Windows目录下。修改注册表，实现开机自启。侦听黑客指令，盗取用户计算机上的机密信息，并将机密信息发送到黑客指定的邮箱里。

特征

病毒特征如下：

1、打开浏览器后，把主页修改成http://www.9505.com

2、会自动在桌面建立三个名称分别为"最酷手机铃声"、"最热音乐连播"、"最新手机图片"的html链接，地址是http://www.520tt.com/和http://www.ads3721.com/

3、该html链接删除之后过10秒左右又会新建

4、过几分钟就会弹出窗口直接进入网址http://www.ads3721.com/

5、如果访问本网站会导致直接进入网址http://www.ads3721.com/

6、如果在正常模式下用安全卫士查杀电脑会接着自动关机

扫描注册表结果

注册表

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]

<ctfmon.exe><C:WINDOWSsystem32ctfmon.exe> [(Verified)Microsoft Windows Publisher]

<bgswitch><C:WINDOWSsystem32gswitch.exe> []

<EXPLORER><C:Program FilesCommon FilesSystemwab32res.exe> [N/A]

<izxc9wqq><C:DOCUME~1ADMINI~1LOCALS~1Tempiexpl0re.exe> []

<df1iw><C:DOCUME~1ADMINI~1LOCALS~1Temp1explore.exe> []

<l><C:DOCUME~1ADMINI~1LOCALS~1TempServere.exe> []

<qw76gqfs7tl><C:DOCUME~1ADMINI~1LOCALS~1Tempwinlog0n.exe> []

[HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWindows]

<load><> [N/A]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]

<PHIME2002ASync><C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]

<PHIME2002A><C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]

<BigDogPath><C:WINDOWSVM_STI.EXE 10moons USB PC Camera (ZC0301PL)> [N/A]

<WebThunder><C:Program FilesThunder NetworkWebThunderWebThunder.exe> [(Verified)ShenZhen Thunder Networking Technologies Ltd.]

<TkBellExe><"C:Program FilesCommon FilesRealUpdate_OB

ealsched.exe" -osboot> [(Verified)"RealNetworks, Inc."]

<runeip><C:Program FilesRisingAntiSpyware

uniep.exe> [Beijing Rising Technology Co., Ltd.]

<RavTask><"C:Program FilesRisingRavRavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce]

<KKDelay><C:Program FilesRisingAntiSpywareRunOnce.exe> [Beijing Rising Technology Co., Ltd.]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogon]

<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]

<Userinit><C:WINDOWSsystem32userinit.exe,> [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWindows]

<AppInit_DLLs><> [N/A]

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogon]

<UIHost><logonui.exe> [(Verified)Microsoft Windows XP Publisher]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]

<><C:WINDOWSsystem32RavExt.dll> [Beijing Rising Technology Co., Ltd.]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad]

<WPDShServiceObj><C:WINDOWSsystem32WPDShServiceObj.dll> [(Verified)Microsoft Windows Component Publisher]

服务项

服务

[Help and Support / helpsvc][Stopped/Auto Start]

<C:WINDOWSSystem32svchost.exe -k netsvcs-->%WINDIR%PCHealthHelpCtrBinariespchsvc.dll><N/A>

[Human Interface Device Access / HidServ][Stopped/Disabled]

<C:WINDOWSSystem32svchost.exe -k netsvcs-->%SystemRoot%System32hidserv.dll><N/A>

[Rising Process Communication Center / RsCCenter][Running/Auto Start]

<"C:Program FilesRisingRavCCenter.exe"><Beijing Rising Technology Co., Ltd.>

[Rising RealTime Monitor / RsRavMon][Running/Auto Start]

<"C:PROGRAM FILESRISINGRAVRavmond.exe"><Beijing Rising Technology Co., Ltd.>

[Windows Driver Foundation - User-mode Driver Framework / WudfSvc][Stopped/Manual Start]

<C:WINDOWSsystem32svchost.exe -k WudfServiceGroup-->%SystemRoot%System32WUDFSvc.dll><Microsoft Corporation>