File size:18593 bytes
Md5:c595bc161e1d64b4d8f4d84139ef02b0
Sha1:100e8a9ae7034b41443e4ddaa46f175adb70eb06
Virus Name: Unknown
Test time: 2007-3-10
Update Time: Tomorrow night, this analysis log will be updated,
After running the virus sample, automatically remove the virus itself, automatically release the virus to the%system% directory
%system%\del.bat
%system%\msgcom.dll
%system%\1.exe
%system%\2.exe
%system%\3.exe
%system%\4.exe
%system%\5.exe
%system%\6.exe
To create a startup item:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Nt\currentversion\winlogon\notify\cmdmant
<WinlogonNotify:cmdmant><msgcom.dll>
Modify Explorer.exe its memory, Explorer.exe attempt to obtain network access. 202.88.90.186, trying to start%system%\1.exe
%system%\2.exe
%system%\3.exe
%system%\4.exe
%system%\5.exe
%system%\6.exe
%system%\1.exe analysis is as follows:
After the Explorer.exe starts 1.EXE, automatically deletes itself
Releasing virus files
%system%\wsvbs.dll
%windows%\wsvbs.exe
Create a startup item
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<wsttrs><%windows%\wsvbs.exe>
%system%\2.exe analysis is as follows
After the Explorer.exe starts 2.EXE,
Releasing virus files
%system%\mppds.dll
%windows%\mppds.exe
Create a startup item
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<mppds><%windows%\mppds.exe>
%system%\3.exe analysis is as follows
After the Explorer.exe starts 3.EXE,
Releasing virus files
%program files%\internet explorer\plugins\system2.jmp
%program files%\internet Explorer\plugins\systemkb.sys
%system%\4.exe analysis is as follows:
After the Explorer.exe starts 4.EXE, automatically deletes itself
Releasing virus files
%system%\wsttrs.dll
%windows%\wsttrs.exe
Create a startup item
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<wsttrs><%windows%\wsttrs.exe>
%system%\5.exe analysis is as follows:
After the Explorer.exe starts 5.EXE, automatically deletes itself
Release the virus files and insert the processes.
%windows%\608769.bmp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
<AppInit_DLLs><608769M.BMP>
%system%\6.exe analysis is as follows:
After the Explorer.exe starts 6.EXE,
Releasing virus files
C:\Documents and Settings\ your username \local Settings\temp\ie888.exe
C:\Documents and Settings\ your username \local Settings\temp\iim.dll
C:\Documents and Settings\ your username \local Settings\temp\packet.dll
C:\Documents and Settings\ your username \local Settings\temp\wanpacket.dll
%program files%\internet Explorer\plugins\systemkb.bak
%system%\drivers\npf.sys
Modify the hosts content and add the following
58.215.65.136 hyap98.com
58.215.65.136 www.hyap98.com
60.169.1.178 www.82087871.com
60.169.1.178 47555.cn
60.169.1.178 nc.47555.cn
60.169.1.178 cn.47555.cn
60.169.1.178 crsky.47555.cn
60.169.1.178 www.47555.cn
60.169.1.178 baibu.com
60.169.1.178 www.baidu.com
60.169.1.178 dgufida.com.cn
60.169.1.178 88.our2000.com
60.169.1.178 new.eyliao.com
60.169.1.178 sybaby.a78.zgsj.com
Attached Sreng log,
Start Project
Registration Form
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<svc><C:\DOCUME~1\MIB\LOCALS~1\Temp\ie888.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<wsvbs><C:\windows\wsvbs.exe>
<mppds><C:\windows\mppds.exe>
<wsttrs><C:\windows\wsttrs.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><608769M.BMP>
<{754fb7d8-b8fe-4810-b363-a788cd060f1f}><c:\program files\internet Explorer\plugins\systemkb.sys> [N/ A
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Nt\currentversion\winlogon\notify\cmdmant]
<WinlogonNotify:cmdmant><msgcom.dll>
Running processes
[pid:700] [\?? \c:\windows\system32\winlogon.exe]
[C:\windows\608769M. BMP] [n/A, n/a]
[C:\WINDOWS\system32\msgcom.dll] [N/A, n/a]
[pid:752] [C:\windows\system32\services.exe
[C:\windows\608769M. BMP]
[pid:764] [C:\windows\system32\lsass.exe]
[C:\windows\608769M. BMP] [n/A, n/a]
[pid:932] [C:\windows\system32\svchost.exe]
[C:\windows\608769M. BMP] [n/A, n/a]
[pid:1020] [C:\windows\system32\svchost.exe
[C:\windows\608769M. BMP] [n/A, n/a]
[pid:1116] [C:\windows\System32\svchost.exe]
[C:\windows\608769M. BMP] [n/A, n/a]
[pid:1408] [C:\windows\system32\svchost.exe]
[C:\windows\608769M. BMP] [n/A, n/a]
[pid:1456] [C:\windows\system32\svchost.exe]
[C:\windows\608769M. BMP] [n/A, n/a]
The workaround is as follows:
1. Start---run---input---regedit---expand sequentially
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Delete
<svc>
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete
<wsvbs>
<mppds>
<wsttrs>
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Delete
<{754FB7D8-B8FE-4810-B363-A788CD060F1F}>
Delete
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Nt\currentversion\winlogon\notify\cmdmant]
<WinlogonNotify:cmdmant>
2. Restart Computer
3. Delete the following files
%system%\del.bat
%system%\msgcom.dll
%system%\wsvbs.dll
%windows%\wsvbs.exe
%system%\mppds.dll
%windows%\mppds.exe
%program files%\internet explorer\plugins\system2.jmp
%program files%\internet Explorer\plugins\systemkb.sys
%system%\wsttrs.dll
%windows%\wsttrs.exe
C:\Documents and Settings\ your username \local Settings\temp\ie888.exe
C:\Documents and Settings\ your username \local Settings\temp\iim.dll
C:\Documents and Settings\ your username \local Settings\temp\packet.dll
C:\Documents and Settings\ your username \local Settings\temp\wanpacket.dll
%program files%\internet Explorer\plugins\systemkb.bak
%system%\drivers\npf.sys
%system%\3.exe
%system%\6.exe
System32\drivers\etc\hosts
Use Notepad to open the Hosts file, delete the following content
58.215.65.136 hyap98.com
58.215.65.136 www.hyap98.com
60.169.1.178 www.82087871.com
60.169.1.178 47555.cn
60.169.1.178 nc.47555.cn
60.169.1.178 cn.47555.cn
60.169.1.178 crsky.47555.cn
60.169.1.178 WWW47555CN
60.169.1.178 baibu.com
60.169.1.178 www.baidu.com
60.169.1.178 dgufida.com.cn
60.169.1.178 88.our2000.com
60.169.1.178 new.eyliao.com
60.169.1.178 sybaby.a78.zgsj.com
%windows%\608769m. Bmp
To my e-disk download dedicated kill.
http://free5.ys168.com/?ufwihgu168
(< because the SSM monitor to the desktop process is not very understand, there is a problem with this network connectivity analysis, will be updated tomorrow night, also please correct, the contents are as follows, thank you)
Process:
Path: C:\WINDOWS\explorer.exe
pid:1988
Information: Windows Explorer (Microsoft Corporation)
Network information:
IP Address: 222.88.90.186
Trusted areas: No
Protocol: TCP
