19.EXE,PAGEFILE.PIF kill pagefile.pif virus auto.inf_ virus

File:19.exe
size:33495 bytes
File version:0.00.0204
Modified:2007 year December 29, 21:23:18
md5:4b2be9775b6ca847fb2547dd75025625
Sha1:2660f88591ad4da8849a3a56f357e7dfb9694d45
crc32:2a485241
Writing language: VB

1. After the virus runs, the following copies and documents are derived:


Quote:
%systemroot%\debug\debugprogram.exe
%systemroot%\system32\command.pif
%systemroot%\system32\dxdiag.com
%systemroot%\system32\finder.com
%systemroot%\system32\msconfig.com
%systemroot%\system32\regedit.com
%systemroot%\system32\rundll32.com
%systemroot%\1.com
%systemroot%\exeroute.exe
%systemroot%\explorer.com
%systemroot%\finder.com
%systemroot%\services. Exe
D:\autorun.inf
D:\pagefile.pif


2. Promote your own permissions and try to end a process with the following keywords

Quote:
360tray*
ravmon*
ccenter*
trojdie*
kpop*
ssistse*
agentsvr*
kv*
kreg*
iefind*
iparmor*
uphc*
rulewize*
fygt*
rfwsrv*
rfwma*
trojan*
Svi.exe


3. Tamper with many file associations so that when you open these files, you start the virus.

Quote:
Hklm\software\classes\.bfc\shellnew\command: "%systemroot%\system32\rundll32.com%SystemRoot%\system32\ Syncui.dll,briefcase_create%2!d! %1
Hklm\software\classes\clsid\{871c5380-42a0-1069-a2ea-08002b30309d}\shell\openhomepage\command\: "" C:\Program Files\Internet explorer\iexplore.com ""
hklm\software\classes\drive\shell\find\command\: "%systemroot%\explorer.com"
hklm\software\classes\dunfile\shell\open\command\: "%systemroot%\system32\rundll32.com NETSHELL." Dll,invokedunfile%1 "
hklm\software\classes\htmlfile\shell\print\command\: "Rundll32.com%systemroot%\system32\mshtml.dll,printhtml"%1 ""
hklm\software\classes\inffile\shell\install\command\: "%systemroot%\system32\rundll32.com setupapi, InstallHinfSection DefaultInstall 132%1 "
hklm\software\classes\unknown\shell\openas\command\: "%systemroot%\system32\finder.com%SystemRoot%\system32\ Shell32.dll,openas_rundll%1 "(Open Unknown program can start virus, sweat ...) ）
Hklm\software\clients\startmenuinternet\iexplore.pif\shell\open\command\: "" "C:\Program files\common~1\ Iexplore.pif ""

(Change the point file of IE on the start program)
Hklm\software\classes\.lnk\shellnew\command: "rundll32.com appwiz.cpl,newlinkhere%1"
Hklm\software\classes\applications\iexplore.exe\shell\open\command\: "" "C:\Program files\internet Explorer\ Iexplore.com '%1 '
hklm\software\classes\cplfile\shell\cplopen\command\: "rundll32.com shell32.dll,control_rundll"%1 ",%*"
Hklm\software\classes\ftp\shell\open\command\: "" "C:\Program files\internet explorer\iexplore.com"%1 "
Hklm\software\classes\htmlfile\shell\open\command\: "" "C:\Program files\internet explorer\iexplore.com"-nohome "
Hklm\software\classes\htmlfile\shell\opennew\command\: "" "C:\Program files\common~1\iexplore.pif"%1 "
Hklm\software\classes\http\shell\open\command\: "" "C:\Program files\common~1\iexplore.pif"-nohome "
hklm\software\classes\internetshortcut\shell\open\command\: "Finder.com shdocvw.dll,openurl%l"
hklm\software\classes\scrfile\shell\install\command\: "Finder.com desk.cpl,installscreensaver%l"
Hklm\software\classes\scriptletfile\shell\generate typelib\command\: "C:\WINDOWS\system32\finder.com" C:\WINDOWS \system32\scrobj.dll,generatetypelib "%1" "
hklm\software\classes\telnet\shell\open\command\: "Finder.com url.dll,telnetprotocolhandler%l"
Hklm\software\clients\startmenuinternet\: "Iexplore.pif"
...


Add a new file association to the winfiles to point to C:\WINDOWS\ExERoute.exe
and tamper with EXE file association hklm\software\classes\.exe\: "Winfiles"


4. Revise


Quote:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
The {shell} value is Explorer.exe 1


5. Connect the network to steal the legendary world and other games account password

Purge method:


1. Decompression IceSword Icesword.exe renamed to icesword.com operation
Process one column ends%systemroot%\services. Exe

Click on the lower left corner of the file button to delete the following files
%systemroot%\debug\debugprogram.exe
%systemroot%\system32\command.pif
%systemroot%\system32\dxdiag.com
%systemroot%\system32\finder.com
%systemroot%\system32\msconfig.com
%systemroot%\system32\regedit.com
%systemroot%\system32\rundll32.com
%systemroot%\1.com
%systemroot%\exeroute.exe
%systemroot%\explorer.com
%systemroot%\finder.com
%systemroot%\services. Exe
D:\autorun.inf
D:\pagefile.pif
2. Change the Sreng extension to bat and run

System Repair-file association repair


3. Repair System
Open the system disk and run directly%systemroot%\system32\regedit.exe
Restore the registry that was modified by the virus


Quote:
Hklm\software\classes\.lnk\shellnew\command: "Rundll32.exe appwiz.cpl,newlinkhere%1"
Hklm\software\classes\applications\iexplore.exe\shell\open\command\: "" "C:\Program files\internet Explorer\ Iexplore.exe '%1 '
hklm\software\classes\cplfile\shell\cplopen\command\: "Rundll32.exe shell32.dll,Control_RunDLL"%1 ",%*"
hklm\software\classes\cplfile\shell\cplopen\command\: "Rundll32.exe shell32.dll,Control_RunDLL"%1 ",%*"
Hklm\software\classes\htmlfile\shell\open\command\: "" "C:\Program files\internet Explorer\iexplore.exe"-nohome "
Hklm\software\classes\htmlfile\shell\opennew\command\: "" "C:\Program files\internet Explorer\iexplore.exe"%1 "
Hklm\software\classes\http\shell\open\command\: "" "C:\Program files\internet Explorer\iexplore.exe"-nohome "
hklm\software\classes\internetshortcut\shell\open\command\: "Rundll32.exe shdocvw.dll,openurl%l"
hklm\software\classes\scrfile\shell\install\command\: "Rundll32.exe desk.cpl,installscreensaver%l"
hklm\software\classes\scrfile\shell\install\command\: "Rundll32.exe desk.cpl,installscreensaver%l"
hklm\software\classes\telnet\shell\open\command\: "Rundll32.exe url.dll,telnetprotocolhandler%l"
hklm\software\classes\telnet\shell\open\command\: "Rundll32.exe url.dll,telnetprotocolhandler%l"
hklm\software\classes\drive\shell\find\command\: "%SystemRoot%\Explorer.exe"
Hklm\software\classes\clsid\{871c5380-42a0-1069-a2ea-08002b30309d}\shell\openhomepage\command\: "" C:\Program Files\Internet Explorer\iexplore.exe ""
hklm\software\classes\drive\shell\find\command\: "%SystemRoot%\Explorer.exe"
hklm\software\classes\dunfile\shell\open\command\: "%systemroot%\system32\rundll32." EXE Netshell. Dll,invokedunfile%1 "
hklm\software\classes\htmlfile\shell\print\command\: "Rundll32.exe%systemroot%\system32\mshtml.dll,printhtml"%1 ""
hklm\software\classes\inffile\shell\install\command\: "%systemroot%\system32\rundll32.exe setupapi, InstallHinfSection DefaultInstall 132%1 "
hklm\software\classes\unknown\shell\openas\command\: "%systemroot%\system32\rundll32.exe%SystemRoot%\system32\ Shell32.dll,openas_rundll%1 "


Delete Hklm\software\classes\winfiles entire subkey
Modify HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
The {shell} value is Explorer.exe