QQ Tail Infoms.ime Solution _ Virus killing

Profile ID: CISRT2007002
Virus name: TROJAN.WIN32.DELF.RF (Kaspersky)
Virus alias: Trojan.QQMSG.Liumazi (Rising)
win32.troj.qqmsginfo.28688 (Poison PA)
Virus size: 27,900 bytes
Adding Shell way: UPX
Sample md5:b95d1102bcddfa26fb9a3f40129d2353
Sample SHA1:0E52CBCC5FEDF47408BAD58AA1F0AAF9E00EEAE2
Discovery Time: 2007.1
Update Time: 2007.1
Associated virus:
Transmission mode: QQ message, malicious Web page, other virus download


Technical analysis
==========

This is a QQ tail trojan, run release DLL library file:

Code:

%ProgramFiles%\Common Files\Microsoft Shared\msinfo\infoms.ime


To create Shellexecutehooks startup information:



Code:
[Hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{c217767f-e340-49b8-85d3-3a72b9cd652f}" = ""

[Hkey_classes_root\clsid\{c217767f-e340-49b8-85d3-3a72b9cd652f}\inprocserver32]
@= "%ProgramFiles%\Common Files\Microsoft Shared\msinfo\infoms.ime"


Send information to QQ friends:


Quote:
Look at this website and talk about
http://8788.www-qq.cn


Cleanup steps

1. Delete the Trojan Shellexecutehooks startup information:



Code:
[Hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{c217767f-e340-49b8-85d3-3a72b9cd652f}" = ""

[hkey_classes_root\clsid\{c217767f-e340-49b8-85d3-3a72b9cd652f}]


2. Restart your computer

3. Delete Trojan file:

Code:
%ProgramFiles%\Common Files\Microsoft Shared\msinfo\infoms.ime