AV Terminator adopts redirect hijacking technique

The virus utilizes the IFEO technique of redirect hijacking, make a large number of anti-virus software and security-related tools can not run, will destroy the safe mode, so that the poisoned users can not be in safe mode to kill the virus, will download a large number of viruses to user computers to steal users valuable information and some accounts, can be transmitted through Removable storage media.

1. Generate Files

%programfiles%\Common Files\Microsoft Shared\MSInfo\{随机8位字母+数字名字}.datC:\Program Files\Common Files\Microsoft Shared\MSInfo\{随机8位字母+数字名字}.dll%windir%\{随机8位字母+数字名字}.hlp%windir%\Help\{随机8位字母+数字名字}.chm也有可能生成如下文件%sys32dir%\{随机字母}.exe替换%sys32dir%\verclsid.exe文件

2. Generate the following registry key to enable the virus to start up with the system.

HKEY_CLASSES_ROOT\CLSID\"随机CLSID"\\InprocServer32 "病毒文件全路径"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\"随机CLSID" "病毒文件全路径"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks "生成的随机CLSID" ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "随机字符串" "病毒文件全路径"

3. The following registry key is generated for file image hijacking, which attempts to prevent the associated security software from running and executing the virus body.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\360rpt.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\360safe.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\360tray.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\adam.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\agentsvr.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\appsvc32.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\autoruns.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\avgrssvc.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\avmonitor.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
options\avp.com Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\avp.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\ccenter.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\ccsvchst.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\filedsty.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\ftcleanershell.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\hijackthis.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\icesword.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\iparmo.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\iparmor.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\ispwdsvc.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kabaload.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
OPTIONS\KASCRSCN.SCR Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kasmain.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kastask.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kav32.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kavdx.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kavpfw.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kavsetup.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kavstart.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kislnchr.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kmailmon.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kmfilter.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kpfw32.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kpfw32x.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kpfwsvc.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kregex.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
options\krepair.com Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\ksloader.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvcenter.kxp Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvdetect.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvfwmcl.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvmonxp.kxp Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvmonxp_1.kxp Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvol.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvolself.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvreport.kxp Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvscan.kxp Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvsrvxp.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvstub.kxp Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvupload.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvwsc.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvxp.kxp Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kvxp_1.kxp Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kwatch.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kwatch9x.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\kwatchx.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\loaddll.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\magicset.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\mcconsol.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\mmqczj.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\mmsk.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\navsetup.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\nod32krn.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\nod32kui.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\pfw.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\pfwliveupdate.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\qhset.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\ras.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\rav.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\ravmon.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\ravmond.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\ravstub.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\ravtask.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\regclean.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\rfwcfg.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\rfwmain.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\rfwproxy.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\rfwsrv.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\rsagent.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\rsaupd.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\runiep.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\safelive.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\scan32.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\shcfg32.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\smartup.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\sreng.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\symlcsvc.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\syssafe.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\trojandetector.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\trojanwall.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\trojdie.kxp Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\uihost.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\umxagent.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\umxattachment.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\umxcfg.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\umxfwhlp.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\umxpol.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\uplive.exe.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\wopticlean.exe Debugger "full path to virus files"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\zxsweep.exe Debugger "full path to virus files"
Hkey_local_machine\system\currentcontrolset\services\wscsvc Start dword:00000004

4. Modify the following registry to prevent hidden files from being displayed.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden dword:00000002
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL CheckedValue dword:00000000

5. Modify the startup type of the following services to prevent Windows from being updated and the system's own firewall.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess Start dword:00000004
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv Start dword:00000004

6. Delete the following registry key so that users cannot enter Safe mode.

HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_CURRENT_USER\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}

7. Connect Network Download virus:

hxxp://www.webxxx.com/xxx.exe

8. Close the anti-virus software real-time monitoring window, such as rising, Kabbah, by automatically clicking the "Skip" button to escape the killing.

9. Try to close the window that contains the following keywords:

Anti
AgentSvr
CCenter
Rsaupd
SmartUp
FileDsty
RegClean
360tray
360safe
kabaload
safelive
KASTask
KPFW32
KPFW32X
KvXP_1
KVMonXP_1
KvReport
KvXP
KVMonXP
nter
TrojDie
avp.com
KRepair.COM
Trojan
KvNative
Virus
Filewall
Kaspersky
JiangMin
RavMonD
RavStub
RavTask
adam
cSet
PFWliveUpdate
mmqczj
Trojanwall
Ras.exe
runiep.exe
avp.exe
PFW.exe
rising
ikaka
.duba
kingsoft
木马
社区
aswBoot
...

10. Inject Explorer.exe and TIMPlatform.exe bounce connection to escape the firewall's internal wall audit.

11. Hide the virus process, but it can be displayed by ending the desktop process.

12. Generate files on hard disk partitions: Autorun.inf and random letters + numbers of virus replicators, and modify "NoDriveTypeAutoRun" to enable viruses to propagate with removable storage media.