Virus fingerprint:
sha-160:da14ddb10d14c568b62176aab738b0c479a06863
Md5:c505733ffdda0394d404bd5bb652c1a6
ripemd-160:410ef9736ad4966094c096e57b477b7572b7ed9c
crc-32:ff6e4568
Virus size: 43,900 bytes
Connect network Download virus:
Enter Address: 61.152.255.252
Correspondence Address: Shanghai Telecom IDC
The following virus files are generated randomly on this computer:
Meex.com, Rmwaccq.exe, Wojhadp.exe, Nqgphqd.exe, Autorun.inf
Download run the following file:
1A11.exe, 2B12.exe, 3C13.exe, 2B12.exe
Randomly generate HIV files for process mutual keeping
Destroy the Safe mode;
. upack:00408184 S_systemcontrol db ' system\controlset001\control\safeboot\minimal\{ 4d36e967-e325-11ce-bfc1-08002be10318} ', 0
. upack:00408184; DATA xref:sub_407cf4+6b o
. UPACK:004081D9 Align 4
. UPACK:004081DC s_t db 0ffh,0ffh,0ffh,0ffh, ' T ', 0
. Upack:004081e2 Align 4
. UPACK:004081E4 s_systemcontr_0 db ' system\controlset001\control\safeboot\network\{ 4d36e967-e325-11ce-bfc1-08002be10318} ', 0
. Upack:004081e4; DATA xref:sub_407cf4+7a o
. upack:00408239 Align 4
. upack:0040823c s_x db 0ffh,0ffh,0ffh,0ffh, ' X ', 0
. upack:00408242 Align 4
. upack:00408244 s_systemcurrent db ' system\currentcontrolset\control\safeboot\minimal\{ 4d36e967-e325-11ce-bfc1-08002be10318} ', 0
. upack:00408244; DATA xref:sub_407cf4+89 o
. upack:0040829d Align 10h
. UPACK:004082A0 s_x_0 db 0ffh,0ffh,0ffh,0ffh, ' X ', 0
. UPACK:004082A6 Align 4
. UPACK:004082A8 s_systemcurre_0 db ' system\currentcontrolset\control\safeboot\network\{ 4d36e967-e325-11ce-bfc1-08002be10318} ', 0
. Upack:004082a8; DATA xref:sub_407cf4+98 o
. upack:00408301 Align 4
. upack:00408304 DD 0FFFFFFFFh, 0Ch
To destroy hidden file options:
. upack:0040830c s_checkedvalue db ' CheckedValue ', 0; DATA xref:sub_407cf4+a7 o
. upack:00408319 Align 4
. upack:0040831c s_q db 0ffh,0ffh,0ffh,0ffh, ' Q ', 0
. upack:00408322 Align 4
. upack:00408324 S_softwaremicro db ' software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\ ShowAll ', 0
Turn on automatic playback;
. upack:00408524 s_softwaremic_4 db ' Software\microsoft\windows\currentversion\policies\explorer ', 0
. upack:00408524; DATA xref:sub_407cf4+201 o
. upack:00408560; Char s_nodrivetypeau[]
. upack:00408560 S_nodrivetypeau db ' NoDriveTypeAutoRun ', 0; DATA xref:sub_407cf4+21a o
Close and disable AVP, wuauserv, Wscsvc ', Rsravmon, Rsccenter, Rsppsys services
. upack:004085cc; Char s_systemcurre_5[]
. upack:00408600 s_systemcurre_6 db ' System\currentcontrolset\services\rsppsys ', 0
. upack:00408600; DATA xref:sub_407cf4+2d9 o
. UPACK:0040862A Align 4
. upack:0040862c; Char s_systemcurre_7[]
. upack:0040862c s_systemcurre_7 db ' System\currentcontrolset\services\rsccenter ', 0
. upack:0040862c; DATA xref:sub_407cf4+30f o
. upack:00408658; Char s_systemcontr_1[]
. upack:00408658 s_systemcontr_1 db ' System\controlset001\services\rsccenter ', 0
. upack:00408658; DATA xref:sub_407cf4+345 o
. upack:00408680; Char s_systemcontr_2[]
. upack:00408680 s_systemcontr_2 db ' System\controlset001\services\rsravmon ', 0
. upack:00408680; DATA xref:sub_407cf4+37b o
. Upack:004086a7 Align 4
. UPACK:004086A8; Char s_systemcontr_5[]
. UPACK:004086A8 s_systemcontr_5 db ' System\controlset001\services\wscsvc ', 0
. UPACK:004086A8; DATA xref:sub_407cf4+3b1 o
. UPACK:004086CD Align 10h
. upack:004086d0; Char s_systemcontr_3[]
. upack:004086d0 s_systemcontr_3 db ' System\controlset001\services\wuauserv ', 0
. upack:004086d0; DATA xref:sub_407cf4+3e7 o
. UPACK:004086F7 Align 4
. Upack:004086f8; Char s_systemcontr_4[]
. Upack:004086f8 s_systemcontr_4 db ' SYSTEM\CONTROLSET002\SERVICES\AVP ', 0
. Upack:004086f8; DATA xref:sub_407cf4+41d o
Image hijacking for n-plus security tools, System programs, and antivirus software (IFEO)
Because too much is not listed, and the previous virus samples hijacked the same, you can see the friend cosine function of the article.
Solving method
Use Procexp.exe to suspend virus two process, run inside type "system32" after the time arranges the icon to find the virus file to delete after deleting:
Rename autoruns open Find image hijacking only keep Your image File Name here without a path item all other delete
Open ACDSee Delete the virus files and Autorun.inf scripts under each letter , and avoid using the right key to open and resource manager,
[AutoRun]
Open=nqgphqd.exe
Shell\open= Open (&o)
Shell\open\command=nqgphqd.exe
Shell\open\default=1
Shell\explore= Resource Manager (&X)
Shell\explore\command=nqgphqd.exe
The registry for repairing Safe mode and hidden files is as follows (save the following file as a reg file and double-click the Import Registry):
Windows Registry Editor Version 5.00
[hkey_local_machine\system\controlset001\control\safeboot\minimal\{4d36e967-e325-11ce-bfc1-08002be10318}]
@= "DiskDrive"
[hkey_local_machine\system\controlset001\control\safeboot\network\{4d36e967-e325-11ce-bfc1-08002be10318}]
@= "DiskDrive"
[Hkey_local_machine\software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall]
"Regpath" = "software\\microsoft\\windows\\currentversion\\explorer\\advanced"
"Type" = "Radio"
"CheckedValue" =dword:00000001
The virus uses script to insert these two general commands, because the virus produces the file name is random, and the process identifier (PID) is also random change, so can only map to write the solution.
