遭遇Worm.UsbSpy.a/Worm.Win32.Delf.aj

墨蓝 2024-04-20 11:17 72阅读 0赞

**endurer**　原创  
  
2006-09-12 第**1**版

有一位朋友，他把移动硬盘接到电脑上使用，上午还正常，但下午用时则有数据保护的出错提示信息。

该朋友电脑使用的是Win XP SP2，因未联网，所以不能从网上下载 HijackThis 等软件来分析。

打任务管理器，发现一个名为wincfgs.exe的进程，图标为一个黄色问号，十分可疑，终止了。

打开命令提示符窗口搜索文件：  
/------------  
C:/Documents and Settings/user>attrib /wincfgs\*.\* /s  
SHR C:/Windows/system32/wincfgs.exe  
\------------/  
文件在C:/Windows/system32中，具有系统、隐藏、只读属性，用WinRAR打包备份后删除。

打开注册表编辑器，搜索包含“wincfgs”的项目，发现  
/------------  
\[HKEY\_CURRENT\_USER/Software/Microsoft/Windows NT/CurrentVersion/Windows\]  
"load"="C://windows//system32//wincfgs.exe"  
\------------/

再检查移动硬盘，在根目录下发现autorun.inf。文件内容如下：  
/----------  
\[autorun\]  
open=./RECYCLER/RECYCLER/autorun.exe

shell/1=Open  
shell/1/Command=./RECYCLER/RECYCLER/autorun.exe  
shell/2/=Browser  
shell/2/Command=./RECYCLER/RECYCLER/autorun.exe

shellexecute=./RECYCLER/RECYCLER/autorun.exe  
\----------/  
居然有个文件autorun.exe藏在回收站里。  
用fc命令比较，autorun.exe 与 前面发现的wincfgs.exe完全相同。

瑞星报为 **Worm.UsbSpy.a**。

STATUS: FINISHED

Complete scanning result of "wincfgs.exe", received in VirusTotal at 09.12.2006, 06:40:13 (CET).

<table> 
 <thead> 
  <tr> 
   <td>Antivirus</td> 
   <td>Version</td> 
   <td align="center">Update</td> 
   <td>Result</td> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>AntiVir</td> 
   <td>7.1.1.16</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">Worm/Delf.AJ.1</td> 
  </tr> 
  <tr> 
   <td>Authentium</td> 
   <td>4.93.8</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">W32/Sillyworm.RE</td> 
  </tr> 
  <tr> 
   <td>Avast</td> 
   <td>4.7.844.0</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">Win32:Delf-AQT</td> 
  </tr> 
  <tr> 
   <td>AVG</td> 
   <td>386</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">Worm/Delf.GW</td> 
  </tr> 
  <tr> 
   <td>BitDefender</td> 
   <td>7.2</td> 
   <td align="center">09.12.2006</td> 
   <td style="COLOR: red">Trojan.Agent.AAE</td> 
  </tr> 
  <tr> 
   <td>CAT-QuickHeal</td> 
   <td>8.00</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">Worm.Delf.aj</td> 
  </tr> 
  <tr> 
   <td>ClamAV</td> 
   <td>devel-20060426</td> 
   <td align="center">09.12.2006</td> 
   <td style="COLOR: red">Worm.Delf-21</td> 
  </tr> 
  <tr> 
   <td>DrWeb</td> 
   <td>4.33</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">Trojan.MulDrop.3780</td> 
  </tr> 
  <tr> 
   <td>eTrust-InoculateIT</td> 
   <td>23.72.122</td> 
   <td align="center">09.12.2006</td> 
   <td style="COLOR: red">Win32/USBSpy.1pk!Trojan</td> 
  </tr> 
  <tr> 
   <td>eTrust-Vet</td> 
   <td>30.3.3071</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">Win32/Bypuss.A</td> 
  </tr> 
  <tr> 
   <td>Ewido</td> 
   <td>4.0</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">Worm.Delf.aj</td> 
  </tr> 
  <tr> 
   <td>Fortinet</td> 
   <td>2.77.0.0</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">W32/Delf.AJ!worm</td> 
  </tr> 
  <tr> 
   <td>F-Prot</td> 
   <td>3.16f</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">W32/Sillyworm.RE</td> 
  </tr> 
  <tr> 
   <td>F-Prot4</td> 
   <td>4.2.1.29</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">W32/Sillyworm.RE</td> 
  </tr> 
  <tr> 
   <td>Ikarus</td> 
   <td>0.2.65.0</td> 
   <td align="center">09.11.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Kaspersky</td> 
   <td>4.0.2.24</td> 
   <td align="center">09.12.2006</td> 
   <td style="COLOR: red">Worm.Win32.Delf.aj</td> 
  </tr> 
  <tr> 
   <td>McAfee</td> 
   <td>4849</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">Generic MultiDropper.b</td> 
  </tr> 
  <tr> 
   <td>Microsoft</td> 
   <td>1.1560</td> 
   <td align="center">09.12.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>NOD32v2</td> 
   <td>1.1750</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">Win32/Delf.AJ</td> 
  </tr> 
  <tr> 
   <td>Norman</td> 
   <td>5.90.23</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">W32/Delf.OMO</td> 
  </tr> 
  <tr> 
   <td>Panda</td> 
   <td>9.0.0.4</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">Adware/Look2Me</td> 
  </tr> 
  <tr> 
   <td>Sophos</td> 
   <td>4.09.0</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">W32/Delf-CRK</td> 
  </tr> 
  <tr> 
   <td>Symantec</td> 
   <td>8.0</td> 
   <td align="center">09.12.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>TheHacker</td> 
   <td>5.9.8.209</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">W32/Delf.aj</td> 
  </tr> 
  <tr> 
   <td>UNA</td> 
   <td>1.83</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">Worm.Win32.Delf</td> 
  </tr> 
  <tr> 
   <td>VBA32</td> 
   <td>3.11.1</td> 
   <td align="center">09.12.2006</td> 
   <td style="COLOR: red">Worm.Win32.Delf.aj</td> 
  </tr> 
  <tr> 
   <td>VirusBuster</td> 
   <td>4.3.7:9</td> 
   <td align="center">09.11.2006</td> 
   <td style="COLOR: red">Worm.Delf.AZX</td> 
  </tr> 
 </tbody> 
</table>

Aditional Information

File size: 47104 bytes

MD5: 07adddef653a702b9a11edbcee07e82b

SHA1: 97729f6df1cd96b61e3e2bc1a841adf1720e2ec5