Shameless random 7-bit character name virus killing method _ virus killing

Source: Internet
Author: User
Tags safe mode
Virus fingerprint:

sha-160:da14ddb10d14c568b62176aab738b0c479a06863
Md5:c505733ffdda0394d404bd5bb652c1a6
ripemd-160:410ef9736ad4966094c096e57b477b7572b7ed9c
crc-32:ff6e4568

Virus size: 43,900 bytes

Connect network Download virus:

Enter Address: 61.152.255.252
Correspondence Address: Shanghai Telecom IDC

The following virus files are generated randomly on this computer:

Meex.com, Rmwaccq.exe, Wojhadp.exe, Nqgphqd.exe, Autorun.inf

Download run the following file:

1A11.exe, 2B12.exe, 3C13.exe, 2B12.exe

Randomly generate HIV files for process mutual keeping

Destroy the Safe mode;

. upack:00408184 S_systemcontrol db ' system\controlset001\control\safeboot\minimal\{ 4d36e967-e325-11ce-bfc1-08002be10318} ', 0
. upack:00408184; DATA xref:sub_407cf4+6b o
. UPACK:004081D9 Align 4
. UPACK:004081DC s_t db 0ffh,0ffh,0ffh,0ffh, ' T ', 0
. Upack:004081e2 Align 4
. UPACK:004081E4 s_systemcontr_0 db ' system\controlset001\control\safeboot\network\{ 4d36e967-e325-11ce-bfc1-08002be10318} ', 0
. Upack:004081e4; DATA xref:sub_407cf4+7a o
. upack:00408239 Align 4
. upack:0040823c s_x db 0ffh,0ffh,0ffh,0ffh, ' X ', 0
. upack:00408242 Align 4
. upack:00408244 s_systemcurrent db ' system\currentcontrolset\control\safeboot\minimal\{ 4d36e967-e325-11ce-bfc1-08002be10318} ', 0
. upack:00408244; DATA xref:sub_407cf4+89 o
. upack:0040829d Align 10h
. UPACK:004082A0 s_x_0 db 0ffh,0ffh,0ffh,0ffh, ' X ', 0
. UPACK:004082A6 Align 4
. UPACK:004082A8 s_systemcurre_0 db ' system\currentcontrolset\control\safeboot\network\{ 4d36e967-e325-11ce-bfc1-08002be10318} ', 0
. Upack:004082a8; DATA xref:sub_407cf4+98 o
. upack:00408301 Align 4
. upack:00408304 DD 0FFFFFFFFh, 0Ch

To destroy hidden file options:
. upack:0040830c s_checkedvalue db ' CheckedValue ', 0; DATA xref:sub_407cf4+a7 o
. upack:00408319 Align 4
. upack:0040831c s_q db 0ffh,0ffh,0ffh,0ffh, ' Q ', 0
. upack:00408322 Align 4
. upack:00408324 S_softwaremicro db ' software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\ ShowAll ', 0


Turn on automatic playback;

. upack:00408524 s_softwaremic_4 db ' Software\microsoft\windows\currentversion\policies\explorer ', 0
. upack:00408524; DATA xref:sub_407cf4+201 o
. upack:00408560; Char s_nodrivetypeau[]
. upack:00408560 S_nodrivetypeau db ' NoDriveTypeAutoRun ', 0; DATA xref:sub_407cf4+21a o

Close and disable AVP, wuauserv, Wscsvc ', Rsravmon, Rsccenter, Rsppsys services


. upack:004085cc; Char s_systemcurre_5[]
. upack:00408600 s_systemcurre_6 db ' System\currentcontrolset\services\rsppsys ', 0
. upack:00408600; DATA xref:sub_407cf4+2d9 o
. UPACK:0040862A Align 4
. upack:0040862c; Char s_systemcurre_7[]
. upack:0040862c s_systemcurre_7 db ' System\currentcontrolset\services\rsccenter ', 0
. upack:0040862c; DATA xref:sub_407cf4+30f o
. upack:00408658; Char s_systemcontr_1[]
. upack:00408658 s_systemcontr_1 db ' System\controlset001\services\rsccenter ', 0
. upack:00408658; DATA xref:sub_407cf4+345 o
. upack:00408680; Char s_systemcontr_2[]
. upack:00408680 s_systemcontr_2 db ' System\controlset001\services\rsravmon ', 0
. upack:00408680; DATA xref:sub_407cf4+37b o
. Upack:004086a7 Align 4
. UPACK:004086A8; Char s_systemcontr_5[]
. UPACK:004086A8 s_systemcontr_5 db ' System\controlset001\services\wscsvc ', 0
. UPACK:004086A8; DATA xref:sub_407cf4+3b1 o
. UPACK:004086CD Align 10h
. upack:004086d0; Char s_systemcontr_3[]
. upack:004086d0 s_systemcontr_3 db ' System\controlset001\services\wuauserv ', 0
. upack:004086d0; DATA xref:sub_407cf4+3e7 o
. UPACK:004086F7 Align 4
. Upack:004086f8; Char s_systemcontr_4[]
. Upack:004086f8 s_systemcontr_4 db ' SYSTEM\CONTROLSET002\SERVICES\AVP ', 0
. Upack:004086f8; DATA xref:sub_407cf4+41d o

Image hijacking for n-plus security tools, System programs, and antivirus software (IFEO)

Because too much is not listed, and the previous virus samples hijacked the same, you can see the friend cosine function of the article.

Solving method

Use Procexp.exe to suspend virus two process, run inside type "system32" after the time arranges the icon to find the virus file to delete after deleting:

Rename autoruns open Find image hijacking only keep Your image File Name here without a path item all other delete

Open ACDSee Delete the virus files and Autorun.inf scripts under each letter , and avoid using the right key to open and resource manager,

[AutoRun]
Open=nqgphqd.exe
Shell\open= Open (&o)
Shell\open\command=nqgphqd.exe
Shell\open\default=1
Shell\explore= Resource Manager (&X)
Shell\explore\command=nqgphqd.exe

The registry for repairing Safe mode and hidden files is as follows (save the following file as a reg file and double-click the Import Registry):

Windows Registry Editor Version 5.00

[hkey_local_machine\system\controlset001\control\safeboot\minimal\{4d36e967-e325-11ce-bfc1-08002be10318}]
@= "DiskDrive"


[hkey_local_machine\system\controlset001\control\safeboot\network\{4d36e967-e325-11ce-bfc1-08002be10318}]
@= "DiskDrive"

[Hkey_local_machine\software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall]
"Regpath" = "software\\microsoft\\windows\\currentversion\\explorer\\advanced"
"Type" = "Radio"
"CheckedValue" =dword:00000001

The virus uses script to insert these two general commands, because the virus produces the file name is random, and the process identifier (PID) is also random change, so can only map to write the solution.


Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.