Analysis of new AV terminator anti-virus software technical mechanism

Source: Internet
Author: User

Recent interception of the latest AV terminator, the variant using RING3 hook technology directly remove antivirus software, hijacked a number of web sites to prevent anti-virus software updates. Special kill procedure tense production, test pass will be released in time, the old version of AV Terminator kill after running automatically upgrade.

The following is a detailed analysis of the report:

Virus Name: win32.troj.avkiller.hd.212992

Viruses use Wh_callwndproc type hooks to inject themselves into other processes

**释放文件**
C:\WINDOWS\system32\nfxphzn.jbt 该文件为kernel32.dll的拷贝
c:\WINDOWS\system32\yqia.btl 该文件为病毒自身的拷贝
**下载文件**
w3.hao5555.com/v3/pic.bmp
w3.hao5555.com/v3/Riched32.dll
w3.hao5555.com/v3/search.asp
w3.hao5555.com/bd.dll
**修改的注册表**
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"xphz"="{1b5f93d7-93d7-0a4e-4e82-93d71b5f93d7}"
[HKEY_CLASSES_ROOT\CLSID\{1b5f93d7-93d7-0a4e-4e82-93d71b5f93d7}\InprocServer32]
@="C:\\WINDOWS\\system32\\yqia.btl""ThreadingModel"="Apartment"
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System]
"DisableCMD"=dword:00000001
**挂接函数**
RegEnumValueA
RegEnumValueW -- 目的为隐藏病毒添加的注册表键值
CreateFileA
CreateFileW -- 目的为保护病毒释放的文件
**卸载组件**
regsvr32.exe /u /s wshom.ocx

The virus itself calls the Createfilea and Createfilew functions through NFXPHZN.JBT, and after the virus injects the other processes in the system,

(1) Create a thread to protect its added registry key values from being deleted;

(2) End the anti-virus software process;

(3) Damage is done by filling the first two bytes of the zwcreatefile with 0;

(4) and attempts to delete the following files (mainly anti-virus software and rogue Software Removal Tool driver, program files)

   "mmskskin.dll"
"KKClean.dll"
"VirUnk.def"
"AntiActi.dll"
"Rsaupd.exe"
"Iereset.dll"
"Libclsid.dat"
"KNetWch.SYS"
"CleanHis.dll"
"WoptiClean.sys"
"kakalib.def"
"libdll.dat"
"kkinst.ini"
"KASearch.DLL"
"KAVBootC.sys"
"Ras.exe"
"iehelp.exe"
"trojandetector.exe"
"KAConfig.DLL"
"KAVPassp.DLL"
"hsfw.dll"

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.