Manually delete syswin7z. JMP syswin7z. sys Trojan

Virus name: Trojan-PSW.Win32.QQPass.ajo (Kaspersky)
Virus alias: worm. win32.pabug. CF (rising star), win32.troj. qqpasst. ah.110771 (drug overlord)
Virus size: 32,948 bytes
Shelling method: UPX
Sample MD5: 772f4dfc995f7c1ad6d1978691190cde
Sample sha1: e9d2bcc5666a3433d5ef8cc836c4579f03f8b6cc
Associated Virus:
Transmission Mode: Spread through malicious web pages, other trojan downloads, USB flash drives, and mobile hard drives

Technical Analysis
============

After the trojan is run, copy itself:

Code:
% ProgramFiles % \ Internet Explorer \ plugins \ syswin7z. JMP
% ProgramFiles % \ Internet Explorer \ plugins \ winsys8z. sys

Create shellexecutehooks startup information:

Code:
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ shellexecutehooks]
"{F81F75C9-F974-4772-B72D-F28CBCD98C5F}" = ""

[Hkey_classes_root \ CLSID \ {F81F75C9-F974-4772-B72D-F28CBCD98C5F} \ inprocserver32]
@ = "% ProgramFiles % \ Internet Explorer \ plugins \ syswin7z. sys"
Code:
[HKEY_CURRENT_USER \ Software \ Tencent \ deta3]
"Ft"

Find the local edisk and generate it in its root directory:
The autorun.infand autorun.exe files attempt to spread through the USB flash drive.

After the trojan virus runs, it automatically selects friends randomly from the user's QQ to form a temporary discussion group. It sends "www.fxxxxx.cn/1651.rar" to the group's friends. Here, my photos help me remember them. Files opened by other users in the discussion group may be infected with viruses. Trojan Horses access the network to download other viruses, Trojans, or [url = http://www.pxue.com/tag/93/1.html#maliciousProgram[/Url] to the temporary directory and run it.

Clear steps
============

1. Delete the shellexecutehooks item created by the Trojan (Start Menu-run-Enter "Regedit" to go to the Registry, locate the description options, and follow the prompts to operate ):
Code:

Code:
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ shellexecutehooks]
"{F81F75C9-F974-4772-B72D-F28CBCD98C5F }"

[Hkey_classes_root \ CLSID \ {F81F75C9-F974-4772-B72D-F28CBCD98C5F}]

2. restart the computer

3. Delete the trojan file:

Code:
% ProgramFiles % \ Internet Explorer \ plugins \ syswin7z. JMP
% ProgramFiles % \ Internet Explorer \ plugins \ winsys8z. sys

If an edisk exists, delete:

Code:
E: \ autorun. inf
E: \ autorun.exe

4. Delete the Registry Information (choose "start"> "run" and enter "Regedit" to go to the Registry, locate the description options, and follow the prompts to perform the operation ):

Code:
[HKEY_CURRENT_USER \ Software \ Tencent \ deta3]