Test.exe,vista.exe,a.jpg, flower. dll virus Analysis Solution

This virus is the latest variant of the previous dream lover (dark) Virus

1. After the virus runs, release the following files or copies.
% SystemRoot % \ system32 \ config \ systemprofile \ vista.exe
% SystemRoot % \ system32 \ a.jpg
% SystemRoot % \ system32 \ flower. dll
% SystemRoot % \ system32 \ vista.exe
Test.exe and autorun. inf

2. find SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ app paths \ istme. the key value of EXE is iexplore. EXE path, and then call IE to connect http: // www.3940 *. CN/TJ. ASP infection statistics

3. Enhance your permissions and disable the following processes:
360tray.exe
360safe.exe
Close the handle of the following process
Avp.exe

4.start A spoolsv.exe process, inject flower. DLL into it, and call urlmon. DLL for download.
Download http: // www. */muma935474/q.exe
Http: // www. */muma935474/w.exe
Http: // www. */muma935474/e.exe
Http: // www. */muma935474/r.exe
Http: // www. */muma935474/t.exe
Http: // www. */muma935474/y.exe
Http: // www. */muma935474/u.exe
Http: // www. */muma935474/I .exe
Http: // www. */muma935474/o.exe
Http: // www. */muma935474/10.exe ~ Http: // www. */muma935474/36.exe
Http: // www. */muma.exe
Http: // www. */muma1.exe
Http: // www. */muma2.exe
Http: // www. */muma3.exe

To c: \ Documents and Settings \, the name is taga.exe ~ Tagg.exe tagaa.exe ~ Taggg.exe tagaaa.exe ~ Tagggg.exe tagaaaa.exe ~ Tagcccc.exe md5a.exe ~ Md5g.exe md5aa.exe ~ Md5gg.exe md5aaa.exe ~ Md5bbb.exe
Download interval: 2000 ms

However, almost all download links are invalid, and several download viruses are infected.

5. Close the window with the following words
Firewall
Anti-Virus
Jiang min
Kingsoft
Trojan
Super patrol
NOD32
Security
Main thread
Micropoints

6. Add an image hijacking project to hijack some anti-virus software. Security Tools and some popular viruses direct to % SystemRoot % \ system32 \ vista.exe
360rpt.exe
360safe.exe
360tray.exe
Adam.exe
Agentsvr.exe
Appdllman.exe
Appsvc32.exe
Auto.exe
Autorun.exe
Autoruns.exe
Avgrssvc.exe
Avmonitor.exe
Avp.com
Avp.exe
Ccenter.exe
Ccsvchst.exe
Filedsty.exe
Ftcleanershell.exe
Guangd.exe
Hijackthis.exe
Icesword.exe
Iparmo.exe
Iparmor.exe
Ispwdsvc.exe
Kabaload.exe
Kascrscn. scr
Kasmain.exe
Kastask.exe
Kav32.exe
Kavdx.exe
Kavpfw.exe
Kavsetup.exe
Kavstart.exe
Kernelwind32.exe
Kislnchr.exe
Kmailmon.exe
Kmfilter.exe
Kpfw32.exe
Kpfw32x.exe
Kpfwsvc.exe
Kregex.exe
Krepair. com
Ksloader.exe
Kvcenter. KXP
Kvdetect.exe
Kvfwmcl.exe
Kvmonxp. KXP
Kvmonxp_1.kxp
Kvol.exe
Kvolself.exe
Kvreport. KXP
Kvsrvxp.exe
Kvstub. KXP
Kvupload.exe
Kvwsc.exe
Kvxp. KXP
Kwatch.exe
Kwatch9x.exe
Kwatchx.exe
Loaddll.exe
Logogo.exe
Magicset.exe
Mcconsol.exe
Mmqczj.exe
Mmsk.exe
Navsetup.exe
Nod32krn.exe
Nod32kui.exe
Pfw.exe
Pfwliveupdate.exe
Qhset.exe
Ras.exe
Rav.exe
Ravmon.exe
Ravmond.exe
Ravstub.exe
Ravtask.exe
Regclean.exe
Rfwcfg.exe
Rfwmain.exe
Rfwproxy.exe
Rfwsrv.exe
Rsagent.exe
Rsaupd.exe
Runiep.exe
Safelive.exe
Scan32.exe
Shw.32.exe
Smartup.exe
Sos.exe
Sreng.exe
Symlcsvc.exe
Syssafe.exe
Taskmgr.exe
Trojandetector.exe
Trojanwall.exe
Trojdie. KXP
Ufo.exe
Uihost.exe
Umxagent.exe
Umxattachment.exe
Umxcmd.exe
Umxfwhlp.exe
Umxpol.exe
Uplive. exe
Wopticlean.exe
Xp.exe
Zxsweep.exe

7. Destroy hidden files
Change the value of HKU \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Hidden to 0x00000002.

After the trojan is implanted, The Sreng log is as follows:
Start the project
Registry
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution options \ 360rpt.exe]
<Ifeo0000360rpt.exe]> <c: \ windows \ system32 \ vista.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution options \ 360safe.exe]
<Ifeo0000360safe.exe]> <c: \ windows \ system32 \ vista.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution options \ 360tray.exe]
<Ifeo0000360tray.exe]> <c: \ windows \ system32 \ vista.exe> [Microsoft Corporation]...
========================================
Service
[Windows/Windows] [running/disabled]
<C: \ windows \ windows.exe> <N/A>

Solution:
Download srengicesword: Download from down.45it.com

1. Decompress icesword and rename icesword to 1.com.
Click the file button in the lower left corner.
Delete the following file % SystemRoot % \ system32 \ config \ systemprofile \ vista.exe
% SystemRoot % \ system32 \ a.jpg
% SystemRoot % \ system32 \ flower. dll
% SystemRoot % \ system32 \ vista.exe
% SystemRoot % \ windows.exe
Test.exe and autorun. inf

2. Enable Sreng
Start the project registry
Delete all red ifeo Projects

System Repair-Windows Shell/ie All-selected repair