Inst.exe,setup.exe Trojan Trojan-PSW.Win32.Magania.cjy Solution

Trojan Trojan-PSW.Win32.Magania.cjy.
Inst.exe,setup.exe
Backdoor/agent. apnf
Virus: Trojan-PSW.Win32.Magania.cjy
Virus Type: Trojan
Jiangmin anti-virus 10.00.650 backdoor/agent. apnf 1.395
NOD32 2.70.10 a variant of Win32/psw. OnlineGames. NFF Trojan 4.185

The virus is a new variant of the magnia virus. a dll is released to steal the account and password of online games through hook and memory interception. After running the program, some AV images will be released and opened, and viruses will be released to the program files and WINDOWS \ Help directories.

Behavior Analysis
Release files after running:
C: \ Program Files \ inst.exe
Date: PM
Size: 103,163 bytes
C: \ Program Files \ inst.txt
Date: 11-29-2007 pm
Size: 0 bytes
C: \ Program Files \ setup.exe
Date: 12-28-2007 pm
Size: 76,388 bytes
C: \ Program Files \ mypic \ 2006924192650605.jpg
Date: 7-19-2007 6: 28 AM
Size: 7,613 bytes
C: \ Program Files \ mypic \ 2006924192732323.jpg
Date: 7-19-2007 6: 28 AM
Size: 7,649 bytes
C: \ Program Files \ mypic \ 2006924192810432.jpg
Date: 7-19-2007 6: 28 AM
Size: 7,598 bytes
C: \ Program Files \ mypic \ 2006924192810821.jpg
Date: 7-19-2007 6: 28 AM
Size: 13,258 bytes
C: \ Program Files \ mypic \ 2006924192841718.jpg
Date: 7-19-2007 6: 28 AM
Size: 7,702 bytes
C: \ windows \ 1.bat
Date: 1-4-2008 pm
Size: 96 bytes
C: \ windows \ HELP \ f3c74e3fa248. dll
Date: 1-4-2003 pm
Size: 60,928 bytes
C: \ windows \ HELP \ f3c74e3fa248.exe
Date: 12-28-2007 pm
Size: 76,388 bytes
All images are AV images.

Run after release question
C: \ windows \ HELP \ f3c74e3fa248. dll
C: \ windows \ HELP \ f3c74e3fa248.exe
Steal the password of a game account.

Create a service to start the service:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \

CurrentVersion \ Explorer \ shellexecutehooks "{1dbd6574-d6d0-4782-94c3-69619e719765 }"
Type: REG_SZ
Data: C: \ WINDOWS \ HELP \ f3c74e3fa248. dll

Solution:
Delete an object:
C: \ Program Files \ inst.exe
C: \ Program Files \ inst.txt
C: \ Program Files \ setup.exe
C: \ Program Files \ mypic \ 2006924192650605.jpg
C: \ Program Files \ mypic \ 2006924192732323.jpg
C: \ Program Files \ mypic \ 2006924192810432.jpg
C: \ Program Files \ mypic \ 2006924192810821.jpg
C: \ Program Files \ mypic \ 2006924192841718.jpg
C: \ windows \ 1.bat
C: \ windows \ HELP \ f3c74e3fa248. dll
C: \ windows \ HELP \ f3c74e3fa248.exe

Delete the Registry Startup project:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \

CurrentVersion \ Explorer \ shellexecutehooks \ {1dbd6574-d6d0-4782-94c3-69619e719765}