Analysis and detection of the malicious udisc virus oso.exe

Virus name: Worm. Pabug. ck
Size: 38,132 bytes
MD5: 2391109c40ccb0f982b86af86cfbc900
Shelling method: FSG2.0
Programming Language: Delphi
Transmission Mode: Spread through mobile media or malicious web scripts


The behavior is as follows:

File Creation:
% Systemroot % \ system32 \ gfosdg.exe
% Systemroot % \ system32 \ gfosdg. dll
% Systemroot % \ system32 \ severe.exe
% Systemroot % \ system32 \ drivers \ mpnxyl.exe
% Systemroot % \ system32 \ drivers \ conime.exe
% Systemroot % \ system32 \ hx1.bat
% Systemroot % \ system32 \ noruns. reg
X: \ OSO.exe
X: \ autorun. inf
X indicates a non-system drive letter.
% Systemroot % is the environment variable. For Windows XP system installed on drive C, the default path is C: \ WINDOWS Folder. The following assumptions are used for analysis.

Creation process:
% Systemroot % \ system32 \ gfosdg.exe
% Systemroot % \ system32 \ severe.exe
% Systemroot % \ system32 \ drivers \ conime.exe

Use the net stop command to end possible anti-virus software services

Call SC .exe,
Config [corresponding service] start = disabled
Disable these services

Ended and Disabled services include:
Srservice
Sharedaccess (this is the built-in firewall-note)
KVWSC
KVSrvXP
Kavsvc
RsRavMon
RsCCenter

When the rising service is completed, the virus is handled as a prompt is displayed:
Use the FindWindowA function to capture the window titled "rising prompt"
Use the FindWindowExA function to find the "Yes (& Y)" button.
Use the SendMessageA function to send information to the system, which is equivalent to pressing this button

1 2 3 4 5 Next Page

[Content navigation]
Page 1: Analysis and Removal of the virus oso.exe	Page 1: Analysis and Removal of the virus oso.exe
Page 1: Analysis and Removal of the virus oso.exe	Page 1: Analysis and Removal of the virus oso.exe
Page 1: Analysis and Removal of the virus oso.exe