遭遇Trojan-Spy.Win32.Delf.uv,Trojan.PSW.Win32.XYOnline,Trojan.PSW.Win32.ZhengTu等1

﹏ヽ暗。殇╰゛Y 2024-02-17 14:05 22阅读 0赞

**endurer** 原创

2007-08-14 第**1**版

昨晚一位网友说他的电脑中了病毒，金山毒霸不停的提示发现病毒WinForm2.dll，使用一段时间后会弹出倒计时关机对话框，让偶通过QQ远程协助。

让网友重启到带网络连接的安全模式，刚连上就出现了倒计时关机对话框，用shutdown -a命令停止了。

下载 pe\_xscan 扫描 log 并分析，发现如下可疑项：

F2 - REG: system.ini: UserInit=C:/WINDOWS/system32/Userinit.exe

O4 - HKCU/../Run: \[blin\] "C:/Documents and Settings/h/blin/blin.exe" -background 1  
C:/autorun.inf  
/-----  
\[autorun\]  
open=auto.exe  
shell/open=打开(&O)  
shell/open/Command=auto.exe  
hell/explore=资源管理器(&X)  
shell/explore/Command="auto.exe"  
\-----/  
D:/autorun.inf  
/-----  
\[autorun\]  
open=auto.exe  
shell/open=打开(&O)  
shell/open/Command=auto.exe  
hell/explore=资源管理器(&X)  
shell/explore/Command="auto.exe"  
\-----/  
E:/autorun.inf  
/-----  
\[autorun\]  
open=auto.exe  
shell/open=打开(&O)  
shell/open/Command=auto.exe  
hell/explore=资源管理器(&X)  
shell/explore/Command="auto.exe"  
\-----/  
F:/autorun.inf  
/-----  
\[autorun\]  
open=auto.exe  
shell/open=打开(&O)  
shell/open/Command=auto.exe  
hell/explore=资源管理器(&X)  
shell/explore/Command="auto.exe"  
\-----/

O23 - 服务: 46427F5F (46427F5F) - C:/WINDOWS/system32/61611F9E.EXE -46427F5F(自动)  
O23 - 服务: BB7005AC (BB7005AC) - C:/WINDOWS/system32/1CC3706C.EXE -k(自动)  
O23 - 服务: dmmuykip (dmmuykip) - System32/DRIVERS/dmmuykip.sys| ? | 1.6.9.1084| ?| ? | 1.8.0.1096 | Yahoo! China Corporation| ?| ?| ?(引导)  
O23 - 服务: NPF (Netgroup Packet Filter) - system32/drivers/npf.sys | WinPcap Netgroup Packet Filter Driver | 3, 1, 0, 27 | npf | Copyright ? 2005 CACE Technologies. Copyright ? 2003-2005 NetGroup, Politecnico di Torino. | 3, 1, 0, 27 | CACE Technologies | | NPF + TME | npf.sys(手动)

O24 - ShlExecHook: \[\] - \{40117B96-998D-4D80-8F89-5E9DBD9F3460\} = C:/Program Files/Internet Explorer/PLUGINS/WinSys64.Sys  
O24 - ShlExecHook: \[8\] - \{813AF41A-21B1-131B-1BFC-D2A90DF4A2B8\} = C:/WINDOWS/system32/WinForm2.dll  
O24 - ShlExecHook: \[WindowsVista\] - \{3495D328-661A-4FB0-BA67-8ACDD1704D1E\} = C:/WINDOWS/system32/temp\[3\].dll  
O24 - ShlExecHook: \[9\] - \{913AF41A-21B1-131B-1BFC-D2A90DF4A2B9\} = C:/WINDOWS/system32/xyhpri.dll  
O24 - ShlExecHook: \[7\] - \{759AFD5B-159F-ACD8-954C-ACD545FA6587\} = C:/WINDOWS/system32/jzgpri.dll  
O24 - ShlExecHook: \[3\] - \{36368135-64FA-BC34-DA32-DCF4FD431C93\} = C:/WINDOWS/system32/qhcpri.dll  
O24 - ShlExecHook: \[D\] - \{D1351752-5628-1547-FFAB-BADC13512AFD\} = C:/WINDOWS/system32/ztmpri.dll  
O24 - ShlExecHook: \[5\] - \{54123FF1-8371-9834-9021-184518451FA5\} = C:/WINDOWS/system32/qjepri.dll  
O24 - ShlExecHook: \[7\] - \{7A65498A-7653-9801-1647-987114AB7F47\} = C:/WINDOWS/system32/zxgpri.dll  
O24 - ShlExecHook: \[2\] - \{252D2432-37A2-324F-2A54-21BF5CF2F1A2\} = C:/WINDOWS/system32/jhapri.dll

HKLM/SHOWALL 值非1  
===/

恶意程序使用了Shell Execute Hook（O24），所以在安全模式下仍然启动了……  
用WinRAR检查C、D、E，F盘，没有发现 auto.exe，检查金山毒霸的隔离区，发现是被隔离了，不过毒霸没有删除autorun.inf，换成瑞星是会自动删除autorun.inf的，只能手动删除了。  
接下来的处理，留待下回分解……