Trojan-PSW.Win32.QQPass.uw
病毒名称： Trojan-PSW.Win32.QQPass.uw
中文名称： QQ盗窃者
病毒类型： 木马类
文件 MD5： B1558FBAA833D098C84553D4986660B2
公开范围： 完全公开
危害等级： 5
文件长度： 加壳后 31,979 字节，脱壳后186,880 字节
感染系统： Win9X以上系统
开发工具： Borland Delphi 6.0 - 7.0
加壳类型： Upack 0.3.9 beta2s -> Dwing
命名对照： BitDefender Generic.PWStealer.F82FE48A
McAfee PWS-QQRob
病毒描述：
该病毒运行后，衍生病毒文件到系统目录下。添加注册表随机运行项以跟随系统启动来引导
病毒体。病毒体试图关闭掉若干安全软件的服务，并修改 host文件，试图阻截安全类软件升级。
此病毒会自动在移动设备中释放病毒副本，并添加Atuorun.inf文件来起到传播自身的目的。此
外，病毒会卸载有关瑞星产品的注册表键值，修改regedit.exe、msconfig.exe等文件映射路径，
此病毒为一个盗取QQ账号的病毒。
行为分析：
1 、衍生下列副本与文件：
%System32%severe.exe
%System32%xwwume.dll
%System32%xwwume.exe
%System32%driversjyoapg.com
% 移动设备 %servet.exe
% 移动设备 %autorun.inf
2 、新建注册表键值：
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution Options360Safe.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution Optionsadam.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution Optionsavp.comDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution Optionsavp.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsEGHOST.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsIceSword.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution Optionsiparmo.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution Optionskabaload.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsKRegEx.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsKvDetect.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsKVMonXP.kxpDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsKvXP.kxpDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsMagicSet.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution Optionsmmsk.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution Optionsmsconfig.comDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution Optionsmsconfig.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsNOD32.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsPFW.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsPFWLiveUpdate.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsQQDoctor.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsRas.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsRav.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsRavMon.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution Options
egedit.comDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution Options
egedit.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution Options
uniep.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsSREng.EXEDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsTrojDie.kxpDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion
Image File Execution OptionsWoptiClean.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindOWS%CurrentVersion
Runjyoapg
Value: String: "%WINDOWS%System32xwwume.exe"
3 、修改下列注册表键值：
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNT
CurrentVersionWinlogonShell
New: String: "Explorer.exe %WINDOWS%System32severe.exe"
Old: String: "Explorer.exe"
4 、修改 host 文件：
127.0.0.1 mmsk.cn
127.0.0.1 safe.qq.com
127.0.0.1 360safe.com
127.0.0.1 www.mmsk.cn
127.0.0.1 www.360safe.com
127.0.0.1 zs.kingsoft.com
127.0.0.1 forum.ikaka.com
127.0.0.1 up.rising.com.cn
127.0.0.1 scan.kingsoft.com
127.0.0.1 kvup.jiangmin.com
127.0.0.1 reg.rising.com.cn
127.0.0.1 update.rising.com.cn
127.0.0.1 update7.jiangmin.com
127.0.0.1 download.rising.com.cn
127.0.0.1 dnl-us1.kaspersky-labs.com
127.0.0.1 dnl-us2.kaspersky-labs.com
127.0.0.1 dnl-us3.kaspersky-labs.com
127.0.0.1 dnl-us4.kaspersky-labs.com
127.0.0.1 dnl-us5.kaspersky-labs.com
127.0.0.1 dnl-us6.kaspersky-labs.com
127.0.0.1 dnl-us7.kaspersky-labs.com
127.0.0.1 dnl-us8.kaspersky-labs.com
127.0.0.1 dnl-us9.kaspersky-labs.com
127.0.0.1 dnl-us10.kaspersky-labs.com
127.0.0.1 dnl-eu1.kaspersky-labs.com
127.0.0.1 dnl-eu2.kaspersky-labs.com
127.0.0.1 dnl-eu3.kaspersky-labs.com
127.0.0.1 dnl-eu4.kaspersky-labs.com
127.0.0.1 dnl-eu5.kaspersky-labs.com
127.0.0.1 dnl-eu6.kaspersky-labs.com
127.0.0.1 dnl-eu7.kaspersky-labs.com
注： % System% 是一个可变路径。病毒通过查询操作系统来决定当前 System 文件夹的位置。 Windows2000/NT 中默认的安装路径是 C:WinntSystem32 ， windows95/98/me 中默认的安装路径是 C:WindowsSystem ， windowsXP 中默认的安装路径是 C:WindowsSystem32 。
--------------------------------------------------------------------------------
清除方案：
1 、 使用安天木马防线可彻底清除此病毒 ( 推荐 )
2 、 手工清除请按照行为分析删除对应文件，恢复相关系统设置。
(1) 使用 安天木马防线 “进程管理”关闭病毒进程：
severe.exe
xwwume.exe
jyoapg.com
(2) 删除并恢复病毒添加与修改的注册表键值：
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution Options360Safe.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution Optionsadam.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution Optionsavp.comDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution Optionsavp.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsEGHOST.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsIceSword.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution Optionsiparmo.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution Optionskabaload.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsKRegEx.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsKvDetect.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsKVMonXP.kxpDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsKvXP.kxpDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsMagicSet.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution Optionsmmsk.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution Optionsmsconfig.comDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution Optionsmsconfig.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsNOD32.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsPFW.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution Options PFWLiveUpdate.exe
Debugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsQQDoctor.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsRas.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsRav.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsRavMon.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution Options
egedit.comDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution Options
egedit.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution Options
uniep.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsSREng.EXEDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsTrojDie.kxpDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent
VersionImage File Execution OptionsWoptiClean.exeDebugger
Value: String: "%WINDOWS%System32driversjyoapg.com"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindOWS%Current
VersionRunjyoapg
Value: String: "%WINDOWS%System32xwwume.exe"
(3) 删除病毒释放文件：
%System32%severe.exe
%System32%xwwume.dll
%System32%xwwume.exe
%System32%driversjyoapg.com
% 移动设备 %servet.exe
% 移动设备 %autorun.inf