Encounter Trojan-Spy.Win32.Delf.uv, Trojan. psw. win32.xyonline, Trojan. psw. win32.zhengtu and so on 1

Encounter Trojan-Spy.Win32.Delf.uv, Trojan. psw. win32.xyonline, Trojan. psw. win32.zhengtu and so on 1

EndurerOriginal

1Version

Last night, a netizen said that his computer was infected with viruses. Kingsoft drug overlord kept prompting to find winform2.dll. After a period of time, the countdown shutdown dialog box will pop up, asking me to remotely assist him through QQ.

Let the netizens restart to the safe mode with network connection. The countdown shutdown dialog box appears just after the connection, and the shutdown-a command is used to stop.

Download pe_xscan to scan logs and analyze the logs. The following suspicious items are found:

/=
Pe_xscan 07-07-24 by Purple endurer

Windows XP Service Pack 2 (5.1.2600)
Administrator user group
[System process] * 0
C:/program files/Internet Explorer/plugins/winsys64.sys | 15:31:54
C:/Windows/system32/jhapri. dll | 15:31:54
C:/Windows/system32/zxupli. dll | 15:31:54
C:/Windows/system32/qjepri. dll | 15:31:54
C:/Windows/system32/ztmpri. dll | 15:31:54
C:/Windows/system32/qhcpri. dll | 15:31:53
C:/Windows/system32/jzupli. dll | 15:31:53
C:/Windows/system32/xyhpri. dll | 15:31:53
C:/Windows/system32/winform2.dll |
C:/Windows/system32/winlogon.exe * 452 | MICROSOFT (r) Windows (r) Operating System | 5.1.2600.2180 | Windows NT logon application | (c) Microsoft Corporation. all rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Winlogon. exe
C:/Windows/system32/winform2.dll |
C:/Windows/system32/lsass.exe * 512 | MICROSOFT? Windows? Operating System | 5.1.2600.2180 | LSA shell (export version) |? Microsoft Corporation. All Rights Reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Lsass.exe
C:/Windows/system32/winform2.dll |
C:/Windows/system32/svchost.exe * 660 | MICROSOFT? Windows? Operating System | 5.1.2600.2180 | generic host process for Win32 services |? Microsoft Corporation. All Rights Reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Svchost.exe
C:/Windows/system32/winform2.dll |
C:/Windows/explorer. EXE * 1456 | MICROSOFT (r) Windows (r) Operating System | 6.00.2900.2180 | Windows Explorer | (c) Microsoft Corporation. all rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Explorer | EXPLORER. EXE
C:/Windows/system32/winform2.dll |
C:/Windows/system32/xyhpri. dll | 15:31:53
C:/Windows/system32/jzupli. dll | 15:31:53
C:/Windows/system32/qhcpri. dll | 15:31:53
C:/Windows/system32/ztmpri. dll | 15:31:54
C:/Windows/system32/qjepri. dll | 15:31:54
C:/Windows/system32/zxupli. dll | 15:31:54
C:/Windows/system32/jhapri. dll | 15:31:54
C:/program files/Internet Explorer/plugins/winsys64.sys | 15:31:54
C:/kav2007/kav32.exe * 1968 | Kingsoft Internet Security | 7, 6, 0, 19 | KingSoft Antivirus | copyright (c) 2000-2007 Kingsoft corporation. all rights reserved. | 2007, 7, 23,229 | Kingsoft corporation | Kingsoft | kav32 | kav32.exe
C:/Windows/system32/winform2.dll |
C:/Windows/system32/xyhpri. dll | 15:31:53
C:/Windows/system32/jzupli. dll | 15:31:53
C:/Windows/system32/qhcpri. dll | 15:31:53
C:/Windows/system32/ztmpri. dll | 15:31:54
C:/Windows/system32/qjepri. dll | 15:31:54
C:/Windows/system32/zxupli. dll | 15:31:54
C:/Windows/system32/jhapri. dll | 15:31:54
C:/program files/Internet Explorer/plugins/winsys64.sys | 15:31:54
C:/Windows/system32/conime.exe * 812 | MICROSOFT? Windows? Operating System | 5.1.2600.2180 | console IME |? Microsoft Corporation. All Rights Reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Console | conime. exe
C:/program files/Internet Explorer/plugins/winsys64.sys | 15:31:54
C:/Windows/system32/jhapri. dll | 15:31:54
C:/Windows/system32/zxupli. dll | 15:31:54
C:/Windows/system32/qjepri. dll | 15:31:54
C:/Windows/system32/ztmpri. dll | 15:31:54
C:/Windows/system32/qhcpri. dll | 15:31:53
C:/Windows/system32/jzupli. dll | 15:31:53
C:/Windows/system32/xyhpri. dll | 15:31:53
C:/Windows/system32/xyhins.exe * 980 | 22:48:14, 2007-8-11
C:/Windows/system32/winform2.dll |
C:/Windows/system32/xyhpri. dll | 15:31:53
C:/Windows/system32/jzgins.exe * 1092 | 15:12:30, 2007-8-11
C:/Windows/system32/winform2.dll |
C:/Windows/system32/jzupli. dll | 15:31:53
C:/Windows/system32/qhcins.exe * 504 | 22:24:24, 2007-8-11
C:/Windows/system32/winform2.dll |
C:/Windows/system32/qhcpri. dll | 15:31:53
C:/Windows/system32/ztmins.exe * 1320 | 15:22:34
C:/Windows/system32/winform2.dll |
C:/Windows/system32/ztmpri. dll | 15:31:54
C:/Windows/system32/qjeins.exe * 1372 | 19:47:24
C:/Windows/system32/jzupli. dll | 15:31:53
C:/Windows/system32/qjepri. dll | 15:31:54
C:/Windows/system32/zxgins.exe * 920 |
C:/Windows/system32/qhcpri. dll | 15:31:53
C:/Windows/system32/zxupli. dll | 15:31:54
C:/Windows/system32/jhains.exe * 1528 |
C:/Windows/system32/jzupli. dll | 15:31:53
C:/Windows/system32/jhapri. dll | 15:31:54
C:/Windows/system32/ctfmon.exe * 164 | MICROSOFT? Windows? Operating System | 5.1.2600.2180 | CTF loader |? Microsoft Corporation. All Rights Reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Ctfmon. exe
C:/Windows/system32/winform2.dll |
C:/program files/Internet Explorer/plugins/winsys64.sys | 15:31:54
C:/Windows/system32/jhapri. dll | 15:31:54
C:/Windows/system32/zxupli. dll | 15:31:54
C:/Windows/system32/qjepri. dll | 15:31:54
C:/Windows/system32/ztmpri. dll | 15:31:54
C:/Windows/system32/qhcpri. dll | 15:31:53
C:/Windows/system32/jzupli. dll | 15:31:53
C:/Windows/system32/xyhpri. dll | 15:31:53
C:/program files/Internet Explorer/iexplore.exe * 1536 | MICROSOFT (r) Windows (r) Operating System | 6.00.2900.2180 | Internet Explorer | (c) Microsoft Corporation. all rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Iexplore. exe
C:/Windows/system32/zxupli. dll | 15:31:54
C:/program files/Internet Explorer/plugins/winsys64.sys | 15:31:54
C:/Windows/system32/jhapri. dll | 15:31:54
C:/Windows/system32/qjepri. dll | 15:31:54
C:/Windows/system32/ztmpri. dll | 15:31:54
C:/Windows/system32/qhcpri. dll | 15:31:53
C:/Windows/system32/jzupli. dll | 15:31:53
C:/Windows/system32/xyhpri. dll | 15:31:53
C:/Windows/system32/winform2.dll |

F2-Reg: system. ini: userinit = C:/Windows/system32/userinit.exe

O4-hkcu/../run: [Blin] "C:/Documents and Settings/h/Blin/blin.exe"-Background 1
C:/autorun. inf
/-----
[Autorun]
Opentracing auto.exe
Shell/open = open (& O)
Shell/Open/command#auto.exe
Hell/explore = Resource Manager (& X)
Shell/cmde/command = "auto.exe"
-----/
D:/autorun. inf
/-----
[Autorun]
Opentracing auto.exe
Shell/open = open (& O)
Shell/Open/command#auto.exe
Hell/explore = Resource Manager (& X)
Shell/cmde/command = "auto.exe"
-----/
E:/autorun. inf
/-----
[Autorun]
Opentracing auto.exe
Shell/open = open (& O)
Shell/Open/command#auto.exe
Hell/explore = Resource Manager (& X)
Shell/cmde/command = "auto.exe"
-----/
F:/autorun. inf
/-----
[Autorun]
Opentracing auto.exe
Shell/open = open (& O)
Shell/Open/command#auto.exe
Hell/explore = Resource Manager (& X)
Shell/cmde/command = "auto.exe"
-----/

O23-service: 46427f5f (46427f5f)-C:/Windows/system32/61611f9e. exe-46427f5f (automatic)
O23-service: bb7005ac (bb7005ac)-C:/Windows/system32/1cc3706c. exe-K (automatic)
O23-service: dmmuykip (dmmuykip)-system32/Drivers/dmmuykip. sys |? | 1.6.9.1084 |? |? | 1.8.0.1096 | Yahoo! China Corporation |? |? |? (Guide)
O23-service: NPF (netgroup Packet Filter)-system32/Drivers/NPF. sys | Winpcap netgroup Packet Filter Driver | 3, 1, 0, 27 | NPF | copyright? 2005 cace technologies. Copyright? 2003-2005 netgroup, Politecnico di Torino. | 3, 1, 0, 27 | cace technologies | NPF + tme | NPF. sys (manual)

O24-shlexechook: []-{40117b96-998d-4d80-8f89-5e9dbd9f3460} = C:/program files/Internet Explorer/plugins/winsys64.sys
O24-shlexechook: [8]-{813af41a-21b1-108b-1bfc-d2a90df4a2b8} = C:/Windows/system32/winform2.dll
O24-shlexechook: [windowsvista]-{3495d328-661a-4fb0-ba67-8acdd1704d1e} = C:/Windows/system32/temp [3]. dll
O24-shlexechook: [9]-{913af41a-21b1-108b-1bfc-d2a90df4a2b9} = C:/Windows/system32/xyhpri. dll
O24-shlexechook: [7]-{759afd5b-159f-acd8-954c-acd545fa6587} = C:/Windows/system32/jzupli. dll
O24-shlexechook: [3]-{36347135-64fa-bc34-da32-dcf4fd431c93} = C:/Windows/system32/qhcpri. dll
O24-shlexechook: [d]-{D1351752-5628-1547-FFAB-BADC13512AFD} = C:/Windows/system32/ztmpri. dll
O24-shlexechook: [5]-{4153ff1-8371-9834-9021-184518451fa5} = C:/Windows/system32/qjepri. dll
O24-shlexechook: [7]-{7a65498a-7653-9801-1647-987114ab7f47} = C:/Windows/system32/zxupli. dll
O24-shlexechook: [2]-{252d2432-37a2-324f-2a54-21bf5cf2f1a2} = C:/Windows/system32/jhapri. dll

The HKLM/showall value is not 1.
===/

The malicious program uses shell execute hook (o24), so it still starts in security mode ......
Use WinRAR to check the C, D, E, and F disks. No auto.exe is found. Check the isolation zone of Kingsoft's drug overlord and find that it is isolated. However, the drug overlord did not delete Autorun. INF. If it is changed to rising, Autorun will be automatically deleted. INF can only be deleted manually.
Next, let's wait for the next decomposition ......