U盘病毒CMD32.exe分析手动解决
[table=98%][tr][td]U盘病毒CMD32.exe分析手动解决[/td][/tr][tr][td]发布时间：2007-7-18 12:18:43 发布人：小路[/td][/tr][tr][td][font=宋体, Verdana, Arial, Helvetica, sans-serif][size=14px]详细资料:
文件变化:
释放文件
%Windows%\CMD32.exe
%System%\voice.cpl
%System%\timedate.cpl
各分区根目录释放
X:\autorun.inf
autorun.inf 内容
[table=500,#ffffff][tr][td][autorun]
Open=EvilDay.exe
shellexecute=EvilDay.exe
shell\打开(&O)\command=EvilDay.exe
shell=打开(&O)
shell\2\=浏览(&B)
shell\2\Command=EvilDay.exe
shell\3\=资源管理器(&X)
shell\3\Command=EvilDay.exe[/td][/tr][/table]
修改注册表:
病毒创建启动项
[table=500,#ffffff][tr][td][HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NOTEPAD"="%Windows%\CMD32.exe"[/td][/tr][/table]修改自动播放禁用设置
[table=500,#ffffff][tr][td][HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:0000005b[/td][/tr][/table]禁用"显示所有文件和文件夹"
[table=500,#ffffff][tr][td][HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000000[/td][/tr][/table]禁用"注册表编辑器"
[table=500,#ffffff][tr][td][HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000001[/td][/tr][/table]其他行为:
使用命令启动自动播放服务
net start ShellHWDetection
删除hips软件 GhostSecuritySuite 主程序
%ProgramFiles%\GhostSecuritySuite\gss.exe
修改系统时间
1937-07-07
12:00
创建 [b]Image File Execution Options[/b] 劫持安全相关程序,当被劫持程序运行,实际运行的是病毒主程序.
[table=500,#ffffff][tr][td][HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Twister.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SNATask.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysWarn.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sloemnit.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FilMsg.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gss.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.EXE]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RvaMon.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rva.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPMain.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPMon.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC1.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC2.exe][/td][/tr][/table]
结束安全软件相关进程,以及VMware tools
[table=500,#ffffff][tr][td]SysWarn.exe
snatry.exe
sloemnit.exe
SNATask.exe
VMwareUser.exe
snaregmn.exe
vmsrvc.exe
vmusrvc.exe
FilMsg.exe
Twister.exe
gss.exe
KAVStart.EXE
KWatch.EXE[/td][/tr][/table]清除方法:
1.结束进程
%Windows%\CMD32.exe
2.删除病毒文件
%Windows%\CMD32.exe
%System%\voice.cpl
%System%\timedate.cpl
X:\autorun.inf
3. 修改回系统时间
4. 重启计算机
下载SREng
打开sreng-系统修复-windows shell/ie-全选-修复-
5.删除病毒创建的注册表
[table=500,#ffffff][tr][td][HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NOTEPAD"
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"[/td][/tr][/table]
6.修改注册表,修复被禁用的"自动播放"
[table=500,#ffffff][tr][td][HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:00000091[/td][/tr][/table]7.删除 [b]Image File Execution Options[/b] 映像劫持项
[table=500,#ffffff][tr][td][HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Twister.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SNATask.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysWarn.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sloemnit.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FilMsg.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gss.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.EXE]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RvaMon.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rva.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPMain.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPMon.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC1.exe]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC2.exe][/td][/tr][/table][/size][/font]
[/td][/tr][/table] 这个应该是前段时间比较火的IFEO劫持病毒吧
今天发现了个U盘病毒 不仅隐藏较深 而且还删U盘上的文件 真BT ha ohao:) :)
页:
[1]