Kvmon.exe remote Control Virus Removal Guide _ virus killing

AV name:

Jinshan Poison PA (win32.troj.unknown.a.412826)

AVG (GENERIC9.AQHK)

Dr. Ann V3 (Win-trojan/hupigon.gen)


Shell way: not


Written Language: Delphi


File md5:a79d8dddadc172915a3603700f00df8c


Virus type: Remote control


Behavioral Analysis:


1, release the virus file:


C:\WINDOWS\Kvmon.dll 361984 bytes

C:\WINDOWS\Kvmon.exe 412829 bytes


2, modify the registry, boot:


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

(registry value) Userinit

REG_SZ, "C:\WINDOWS\system32\userinit.exe,"

Modified to REG_SZ, "C:\windows\system32\userinit.exe,c:\windows\kvmon.exe–ini


3, start IE process, and inject Kvmon.dll into them.


4. Add the Registration form:


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup

(registry value) Beizhu = REG_SZ, "online"

(registry value) Info = REG_SZ, "http://www.5311x0.com/vip/6880579/ip.txt>46821973> online > Remote online host >25>0>1080>guest >123456> "


5, read the above registry key, rebound connection outside, accept hacker control.


6, complete release, call cmd.exe delete old files.


Workaround:


1, open the Task Manager, the end of the visible IE process (iexplore.exe), and then disconnect the network.


2. Start-run-regedit.exe open registry to:


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

(registry value) Userinit


Click Modify, modify to: C:\WINDOWS\system32\userinit.exe,


Note that commas can not be omitted, if it is 2000/nt system, then: C:\WINnt\system32\userinit.exe,


3, delete the file:


C:\WINDOWS\Kvmon.dll 361984 bytes

C:\WINDOWS\Kvmon.exe 412829 bytes