Service0.exe analysis and removal methods to provide virus killing

Main behavior:


1, release the file:


C:\WINDOWS\Fonts\Service0.jpg 640106 bytes (backup file)

C:\WINDOWS\system32\Service0.exe 640106 bytes

C:\WINDOWS\system32\Service0.dll 134656 bytes


2, registration for the system services:


Hkey_local_machine\system\currentcontrolset\services\gressep0

(registry value) DisplayName = REG_SZ, "Gressep0"

(registry value) ErrorControl = REG_DWORD, 1

(registry value) ImagePath = REG_EXPAND_SZ, "C:\windows\system32\Service0.exe"

(registry value) ObjectName = REG_SZ, "LocalSystem"

(registry value) Start = REG_DWORD, 2

(registry value) Type = REG_DWORD, 272


3, recording keyboard and other operations.


4, Service0.dll injection IEXPLORE.EXE, reverse connection wshk***.vicp.net.


Workaround:


1. Download Sreng (can be downloaded to down.45it.com). Disconnect from the network when you are connected.


2. End IE process. Use Sreng to remove service items: gressep0


3. Restart the computer and delete the file:


C:\WINDOWS\Fonts\Service0.jpg 640106 bytes (backup file)

C:\WINDOWS\system32\Service0.exe 640106 bytes

C:\WINDOWS\system32\Service0.dll 134656 bytes