Trojan-PSW.Win32.QQPass.uw

王朝百科·作者佚名  2010-02-19  
宽屏版  字体: 小|中|大|超大  

病毒名称： Trojan-PSW.Win32.QQPass.uw

中文名称： QQ盗窃者

病毒类型： 木马类

文件 MD5： B1558FBAA833D098C84553D4986660B2

公开范围： 完全公开

危害等级： 5

文件长度： 加壳后 31,979 字节，脱壳后186,880 字节

感染系统： Win9X以上系统

开发工具： Borland Delphi 6.0 - 7.0

加壳类型： Upack 0.3.9 beta2s -> Dwing

命名对照： BitDefender Generic.PWStealer.F82FE48A

McAfee PWS-QQRob

病毒描述：

该病毒运行后，衍生病毒文件到系统目录下。添加注册表随机运行项以跟随系统启动来引导

病毒体。病毒体试图关闭掉若干安全软件的服务，并修改 host文件，试图阻截安全类软件升级。

此病毒会自动在移动设备中释放病毒副本，并添加Atuorun.inf文件来起到传播自身的目的。此

外，病毒会卸载有关瑞星产品的注册表键值，修改regedit.exe、msconfig.exe等文件映射路径，

此病毒为一个盗取QQ账号的病毒。

行为分析：

1 、衍生下列副本与文件：

%System32%severe.exe

%System32%xwwume.dll

%System32%xwwume.exe

%System32%driversjyoapg.com

% 移动设备 %servet.exe

% 移动设备 %autorun.inf

2 、新建注册表键值：

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution Options360Safe.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution Optionsadam.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution Optionsavp.comDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution Optionsavp.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsEGHOST.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsIceSword.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution Optionsiparmo.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution Optionskabaload.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsKRegEx.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsKvDetect.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsKVMonXP.kxpDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsKvXP.kxpDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsMagicSet.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution Optionsmmsk.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution Optionsmsconfig.comDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution Optionsmsconfig.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsNOD32.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsPFW.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsPFWLiveUpdate.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsQQDoctor.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsRas.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsRav.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsRavMon.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution Options

egedit.comDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution Options

egedit.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution Options

uniep.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsSREng.EXEDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsTrojDie.kxpDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersion

Image File Execution OptionsWoptiClean.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindOWS%CurrentVersion

Runjyoapg

Value: String: "%WINDOWS%System32xwwume.exe"

3 、修改下列注册表键值：

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNT

CurrentVersionWinlogonShell

New: String: "Explorer.exe %WINDOWS%System32severe.exe"

Old: String: "Explorer.exe"

4 、修改 host 文件：

127.0.0.1 mmsk.cn

127.0.0.1 safe.qq.com

127.0.0.1 360safe.com

127.0.0.1 www.mmsk.cn

127.0.0.1 www.360safe.com

127.0.0.1 zs.kingsoft.com

127.0.0.1 forum.ikaka.com

127.0.0.1 up.rising.com.cn

127.0.0.1 scan.kingsoft.com

127.0.0.1 kvup.jiangmin.com

127.0.0.1 reg.rising.com.cn

127.0.0.1 update.rising.com.cn

127.0.0.1 update7.jiangmin.com

127.0.0.1 download.rising.com.cn

127.0.0.1 dnl-us1.kaspersky-labs.com

127.0.0.1 dnl-us2.kaspersky-labs.com

127.0.0.1 dnl-us3.kaspersky-labs.com

127.0.0.1 dnl-us4.kaspersky-labs.com

127.0.0.1 dnl-us5.kaspersky-labs.com

127.0.0.1 dnl-us6.kaspersky-labs.com

127.0.0.1 dnl-us7.kaspersky-labs.com

127.0.0.1 dnl-us8.kaspersky-labs.com

127.0.0.1 dnl-us9.kaspersky-labs.com

127.0.0.1 dnl-us10.kaspersky-labs.com

127.0.0.1 dnl-eu1.kaspersky-labs.com

127.0.0.1 dnl-eu2.kaspersky-labs.com

127.0.0.1 dnl-eu3.kaspersky-labs.com

127.0.0.1 dnl-eu4.kaspersky-labs.com

127.0.0.1 dnl-eu5.kaspersky-labs.com

127.0.0.1 dnl-eu6.kaspersky-labs.com

127.0.0.1 dnl-eu7.kaspersky-labs.com

注： % System% 是一个可变路径。病毒通过查询操作系统来决定当前 System 文件夹的位置。 Windows2000/NT 中默认的安装路径是 C:WinntSystem32 ， windows95/98/me 中默认的安装路径是 C:WindowsSystem ， windowsXP 中默认的安装路径是 C:WindowsSystem32 。

--------------------------------------------------------------------------------

清除方案：

1 、 使用安天木马防线可彻底清除此病毒 ( 推荐 )

2 、 手工清除请按照行为分析删除对应文件，恢复相关系统设置。

(1) 使用 安天木马防线 “进程管理”关闭病毒进程：

severe.exe

xwwume.exe

jyoapg.com

(2) 删除并恢复病毒添加与修改的注册表键值：

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution Options360Safe.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution Optionsadam.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution Optionsavp.comDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution Optionsavp.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsEGHOST.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsIceSword.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution Optionsiparmo.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution Optionskabaload.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsKRegEx.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsKvDetect.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsKVMonXP.kxpDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsKvXP.kxpDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsMagicSet.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution Optionsmmsk.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution Optionsmsconfig.comDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution Optionsmsconfig.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsNOD32.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsPFW.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution Options PFWLiveUpdate.exe

Debugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsQQDoctor.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsRas.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsRav.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsRavMon.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution Options

egedit.comDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution Options

egedit.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution Options

uniep.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsSREng.EXEDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsTrojDie.kxpDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrent

VersionImage File Execution OptionsWoptiClean.exeDebugger

Value: String: "%WINDOWS%System32driversjyoapg.com"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindOWS%Current

VersionRunjyoapg

Value: String: "%WINDOWS%System32xwwume.exe"

(3) 删除病毒释放文件：

%System32%severe.exe

%System32%xwwume.dll

%System32%xwwume.exe

%System32%driversjyoapg.com

% 移动设备 %servet.exe

% 移动设备 %autorun.inf

 
免责声明：本文为网络用户发布，其观点仅代表作者个人观点，与本站无关，本站仅提供信息存储服务。文中陈述内容未经本站证实，其真实性、完整性、及时性本站不作任何保证或承诺，请读者仅作参考，并请自行核实相关内容。
 
© 2005- 王朝百科 版权所有