Trojan-Spy.Win32.VB.oe

王朝百科·作者佚名 2010-02-19

宽屏版字体: 小|中|大|超大

病毒名称： Trojan-Spy.Win32.VB.oe

病毒类型：木马

文件 MD5： B61DF4379D30063FDFCA883E8B9FA2AC

公开范围：完全公开

危害等级：中

文件长度： 155,648 字节

感染系统： windows98以上版本

开发工具： Microsoft Visual Basic 5.0 / 6.0

加壳类型：无

命名对照： Symentec[]

Mcafee[]

病毒描述：

该病毒属木马类，病毒运行后复制自身到%system32%下，并衍生Microsoft Visual Basic所必须的控件mswinsck.ocx 到%system32%目录下，修改注册表，添加启动项，以达到随机启动的目的。

行为分析：

1、病毒运行后复制自身到%system32%下，并释放Microsoft Visual Basic所必须的控件：

%system32%mswinsck.ocx

%system32%病毒名.exe

2、修改注册表，添加启动项，以达到随机启动的目的：

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows

CurrentVersionRun

键值: 字串: "病毒名"="C:WINDOWSsystem32病毒名"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Control

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

Implemented Categories{0DE86A52-2BAA-11CF-A229-00AA003D7352}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{0DE86A53-2BAA-11CF-A229-00AA003D7352}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{0DE86A57-2BAA-11CF-A229-00AA003D7352}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{40FC6ED4-2438-11CF-A3DB-080036F12502}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{40FC6ED5-2438-11CF-A3DB-080036F12502}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

键值: 字串: "@"="C:WINDOWSsystem32MSWINSCK.OCX"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

键值: 字串: "ThreadingModel "="Apartment"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}MiscStatus

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}MiscStatus1

键值: 字串: "@"="132497"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{248DD896-BB45-11CF-9ABC

0080C7E7B78D}MiscStatus

键值: 字串: "@"="0"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}ProgID

键值: 字串: "@"="MSWinsock.Winsock.1"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Programmable

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}ToolboxBitmap32

键值: 字串: "@"="C:WINDOWSsystem32MSWINSCK.OCX, 1"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{248DD896-BB45-

11CF-9ABC-0080C7E7B78D}Version

键值: 字串: "@"="1.0"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

VersionIndependentProgID

键值: 字串: "@"="MSWinsock.Winsock"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD897-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="Winsock General Property Page Object"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD897-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

键值: 字串: "@"="C:WINDOWSsystem32MSWINSCK.OCX"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="IMSWinsockControl"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid32

键值: 字串: "@"="{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid

键值: 字串: "@"="{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "Version "="1.0"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="DMSWinsockControlEvents"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface{248DD893-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid32

键值: 字串: "@"="{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid

键值: 字串: "@"="{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "Version"="1.0"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.Winsock.1

键值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.Winsock.1CLSID

键值: 字串: "@"="{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.Winsock

键值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.WinsockCLSID

键值: 字串: "@"="{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.WinsockCurVer

键值: 字串: "@"="MSWinsock.Winsock.1"

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLi

b{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0win32

键值: 字串: """="C:WINDOWSsystem32MSWINSCK.OCX"

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0

键值: 字串: "@"="Microsoft Winsock Control 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0FLAGS

键值: 字串: "@"="2"

注：% System%是一个可变路径。病毒通过查询操作系统来决定当前System文件夹的位置。Windows2000/NT中默认的安装路径是C:WinntSystem32，windows95/98/me中默认的安装路径是C:WindowsSystem，windowsXP中默认的安装路径是C:WindowsSystem32。

--------------------------------------------------------------------------------

清除方案：

1、使用安天木马防线可彻底清除此病毒(推荐)。

2、手工清除请按照行为分析删除对应文件，恢复相关系统设置。

(1) 使用安天木马防线“进程管理”关闭病毒进程

(2) 删除病毒文件

%system32%mswinsck.ocx

%system32%病毒名.exe

(3) 恢复病毒修改的注册表项目，删除病毒添加的注册表项

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows

CurrentVersionRun

键值: 字串: "病毒名"="C:WINDOWSsystem32病毒名"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Control

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{0DE86A52-2BAA-11CF-A229-00AA003D7352}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{0DE86A53-2BAA-11CF-A229-00AA003D7352}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{0DE86A57-2BAA-11CF-A229-00AA003D7352}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

Implemented Categories{40FC6ED4-2438-11CF-A3DB-080036F12502}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Implemented Categories

{40FC6ED5-2438-11CF-A3DB-080036F12502}

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

键值: 字串: "@"="C:WINDOWSsystem32MSWINSCK.OCX"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

键值: 字串: "ThreadingModel "="Apartment"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}MiscStatus

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}MiscStatus1

键值: 字串: "@"="132497"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}MiscStatus

键值: 字串: "@"="0"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}ProgID

键值: 字串: "@"="MSWinsock.Winsock.1"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Programmable

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}ToolboxBitmap32

键值: 字串: "@"="C:WINDOWSsystem32MSWINSCK.OCX, 1"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}Version

键值: 字串: "@"="1.0"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}VersionIndependentProgID

键值: 字串: "@"="MSWinsock.Winsock"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD897-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="Winsock General Property Page Object"

HKEY_LOCAL_MACHINESOFTWAREClassesCLSID

{248DD897-BB45-11CF-9ABC-0080C7E7B78D}InprocServer32

键值: 字串: "@"="C:WINDOWSsystem32MSWINSCK.OCX"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="IMSWinsockControl"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid32

键值: 字串: "@"="{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid

键值: 字串: "@"="{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD892-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "Version "="1.0"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}

键值: 字串: "@"="DMSWinsockControlEvents"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid32

键值: 字串: "@"="{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}ProxyStubClsid

键值: 字串: "@"="{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesInterface

{248DD893-BB45-11CF-9ABC-0080C7E7B78D}TypeLib

键值: 字串: "Version"="1.0"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.Winsock.1

键值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.Winsock.1CLSID

键值: 字串: "@"="{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.Winsock

键值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.WinsockCLSID

键值: 字串: "@"="{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINESOFTWAREClassesMSWinsock.WinsockCurVer

键值: 字串: "@"="MSWinsock.Winsock.1"

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC

0080C7E7B78D}1.0win32

键值: 字串: """="C:WINDOWSsystem32MSWINSCK.OCX"

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0

键值: 字串: "@"="Microsoft Winsock Control 6.0"

HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib

{248DD890-BB45-11CF-9ABC-0080C7E7B78D}1.0FLAGS

键值: 字串: "@"="2"