注册
登录
| 关键词： CurrentVersion Microsoft Software Windows Execution Options Image exeHKLM File 文件 |
File: oyo.exeSize: 430080 bytesMD5: 2C068E6CC68ABAC97FB2011313A0AF36SHA1: CC3E94456CE02B8A1DEF89D4296F0B4DBA15794FCRC32: 5D3156A81.生成如下文件%system32%\oyo.exe各个分区下面生成autorun.inf和oyo.exe运行后通过cmd命令打开被运行的病毒所在盘cmd.exe /c explorer X:\默认为cmd.exe /c explorer C:\2.注册表变化在HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run下面创建<rav><C:\WINDOWS\system32\oyo.exe>的启动项目修改[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]"CheckedValue"=dword:00000000破坏显示隐藏文件删除HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}HKU\S-1-5-21-448539723-1580436667-725345543-1003破坏显示隐藏文件IFEO映像劫持一些杀毒软件 指向病毒文件HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.comHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.comHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.comHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxpHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe3.感染行为感染除以下目录的exe和scr文件WINDOWSWINNTCOMMON FILES感染方式应该是文件头寄生，但被感染文件经简单修复后文件图标也发生了变化，如图。具体感染方式还请高手指教！清除办法：下载冰刃http://mail.ustc.edu.cn/~jfpan/download/IceSword122cn.zipsreng http://download.kztechs.com/files/sreng2.zip1.把Icesword.exe改名打开冰刃 在进程中结束oyo.exe点击左下角的文件 按钮 删除如下文件%system32%\oyo.exe以及各个分区下面的autorun.inf和oyo.exe2.打开sreng启动项目 注册表 删除如下项目HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run下面的<rav><C:\WINDOWS\system32\oyo.exe> []删除所有红色的IFEO项sreng中 系统修复-高级修复-修复安全模式sreng中 系统修复-Windows shell/IE-勾选显示隐藏文件－修复3.使用杀毒软件修复受感染的exe文件（目前还没有能够修复文件的...） |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
