遭遇通过U盘传播的蠕虫Worm.Win32.Agent.aj/setup.exe等

桃扇骨 2024-02-17 13:54 50阅读 0赞

**endurer** 原创  
2007-04-03 第**1**版

昨天一位网友的电脑在接入U盘后，瑞星注册表监控提示有程序试图修改注册表……现在使用QQ，QQ都提示有错误，要重装一次才能用……让偶帮助检查。

到 [http://endurer.ys168.com][http_endurer.ys168.com]下载 IceSword，发现可疑进程：c:/windows/system32/ime/svchost.exe，终止了。

下载 pe\_xscan 扫描 log，经过在线网页分析，发现如下可疑项：  
/===  
pe\_xscan 07-03-17 by Purple Endurer  
2007-4-2 20:21:16  
Windows XP Service Pack 2(5.1.2600)  
管理员用户组

C:/autorun.inf  
/-----  
\[AutoRun\]  
open=setup.exe  
shellexecute=setup.exe  
shell/Auto/command=setup.exe  
\-----/  
D:/autorun.inf  
/-----  
\[AutoRun\]  
open=setup.exe  
shellexecute=setup.exe  
shell/Auto/command=setup.exe  
\-----/  
E:/autorun.inf  
/-----  
\[AutoRun\]  
open=setup.exe  
shellexecute=setup.exe  
shell/Auto/command=setup.exe  
\-----/  
F:/autorun.inf  
/-----  
\[AutoRun\]  
open=setup.exe  
shellexecute=setup.exe  
shell/Auto/command=setup.exe  
\-----/

O23 - 服务: 00 () - C:/WINDOWS/System32/drivers/213617.sys(引导)

O23 - 服务: ADProt (ADProt) - system32/drivers/ADProt.sys(引导)

SHOWALL Value isn't 1  
===/

由于病毒写注册表的操作被瑞星拦截了，所有没有在注册表中发现可疑启动项。

/---  
文件说明符 : c:/setup.exe  
属性 : -SH-  
获取文件版本信息大小失败!  
创建时间 : 2007-4-3 13:58:42  
修改时间 : 2007-3-28 16:40:24  
访问时间 : 2007-4-2 0:0:0  
大小 : 6041 字节 5.921 KB  
MD5 : 019b1d0fe70dbdf7a857d4475c13bd79  
\---/

Kaspersky 报为 **Worm.Win32.Agent.aj**。

用WinRAR删除各盘上的autorun.inf

在 C:/windows/system32 下发现：internt.exe.rar、progmon.exe，及c:/windows/system32/ime/svchost.exe，文件大小均与setup.exe相同，Kaspersky 报的病毒名也相同，都删除了。

参照：[【系统修复系列之】如何 显示所有的文件和文件夹][Link 1]

修复：SHOWALL Value isn't 1

卸载QQ，重启电脑后，到腾讯网站下载QQ安装程序重装QQ……

检查网友电脑中的瑞星，病毒库是2007-03-29的，晕！升级……

发现一些EXE文件的最后修改时间也变为2007-4-2，将其中一个文件 SurfingPlus.exe 上传在线扫描，结果为：

STATUS: SCANNING

File "SurfingPlus.exe" received on 04.02.2007 at 15:12:50 (CET) is being scanned by VirusTotal in this moment. Results will be shown as they're generated.

<table> 
 <thead> 
 <tr> 
 <td>Antivirus</td> 
 <td>Version</td> 
 <td align="center">Update</td> 
 <td>Result</td> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td>AhnLab-V3</td> 
 <td>2007.4.2.2</td> 
 <td align="center">04.02.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>AntiVir</td> 
 <td>7.3.1.47</td> 
 <td align="center">04.02.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>Authentium</td> 
 <td>4.93.8</td> 
 <td align="center">03.31.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>Avast</td> 
 <td>4.7.936.0</td> 
 <td align="center">04.02.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>AVG</td> 
 <td>7.5.0.447</td> 
 <td align="center">04.01.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>BitDefender</td> 
 <td>7.2</td> 
 <td align="center">04.02.2007</td> 
 <td>Win32.Vimes.A</td> 
 </tr> 
 <tr> 
 <td>CAT-QuickHeal</td> 
 <td>9.00</td> 
 <td align="center">04.02.2007</td> 
 <td>(Suspicious) - DNAScan</td> 
 </tr> 
 <tr> 
 <td>ClamAV</td> 
 <td>devel-20070312</td> 
 <td align="center">04.02.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>DrWeb</td> 
 <td>4.33</td> 
 <td align="center">04.02.2007</td> 
 <td>Trojan.Starter.174</td> 
 </tr> 
 <tr> 
 <td>eSafe</td> 
 <td>7.0.15.0</td> 
 <td align="center">04.02.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>eTrust-Vet</td> 
 <td>30.6.3527</td> 
 <td align="center">03.31.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>Ewido</td> 
 <td>4.0</td> 
 <td align="center">04.02.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>FileAdvisor</td> 
 <td>1</td> 
 <td align="center">04.02.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>Fortinet</td> 
 <td>2.85.0.0</td> 
 <td align="center">04.02.2007</td> 
 <td>suspicious</td> 
 </tr> 
 <tr> 
 <td>F-Prot</td> 
 <td>4.3.1.45</td> 
 <td align="center">03.30.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>F-Secure</td> 
 <td>6.70.13030.0</td> 
 <td align="center">04.02.2007</td> 
 <td>Virus.Win32.Downloader.c</td> 
 </tr> 
 <tr> 
 <td>Ikarus</td> 
 <td>T3.1.1.3</td> 
 <td align="center">04.02.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>Kaspersky</td> 
 <td>4.0.2.24</td> 
 <td align="center">04.02.2007</td> 
 <td>Virus.Win32.Downloader.c</td> 
 </tr> 
 <tr> 
 <td>McAfee</td> 
 <td>4997</td> 
 <td align="center">03.31.2007</td> 
 <td>New Win32.g2</td> 
 </tr> 
 <tr> 
 <td>Microsoft</td> 
 <td>1.2306</td> 
 <td align="center">04.02.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>NOD32v2</td> 
 <td>2162</td> 
 <td align="center">04.02.2007</td> 
 <td>Win32/Whld.A</td> 
 </tr> 
 <tr> 
 <td>Norman</td> 
 <td>5.80.02</td> 
 <td align="center">04.02.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>Panda</td> 
 <td>9.0.0.4</td> 
 <td align="center">04.01.2007</td> 
 <td>Suspicious file</td> 
 </tr> 
 <tr> 
 <td>Prevx1</td> 
 <td>V2</td> 
 <td align="center">04.02.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>Sophos</td> 
 <td>4.16.0</td> 
 <td align="center">03.30.2007</td> 
 <td>no virus found</td> 
 </tr> 
 <tr> 
 <td>Sunbelt</td> 
 <td>2.2.907.0</td> 
 <td align="center">03.31.2007</td> 
 <td>VIPRE.Suspicious</td> 
 </tr> 
 </tbody> 
</table>

Aditional Information

File size: 295936 bytes

MD5: bbdf55d55995011871a8ff0597ce011a

SHA1: 4377108fbf7a1af533609b38e7a5956746678ed0

Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics*.*

[http_endurer.ys168.com]: http://endurer.ys168.com/
[Link 1]: http://endurer.blogchina.com/2590659.html