U disk virus VistaAA.exe Manual killing method _ virus killing

Modified:2008 year May 8, 18:52:32
md5:7009ac302c6d2c6aadede0d490d5d843
sha1:0e10da72367b8f03a4f16d875fea251d47908e1e
crc32:dce5ae5a

After virus runs:
1. Release a sbl.sys to the%system32%\drivers below, and copy a cover Beep.sys, then load the drive, restore SSDT hook, resulting in some anti-virus software active defense function failure.

2. End the process of many anti-virus software and security tools
Such as:

Quote:
360rpt.exe
360Safe.exe
360tray.exe
Avp.com
KASMain.exe
KASTask.exe
KAV32.exe
KAVDX.exe
KAVPFW.exe
Rav.exe
RavMon.exe
RavMonD.exe
...


3. Copy yourself under \config\systemprofile\ and%system32%

4. Start an IE process, connect the network
To http://***.kjxs.com/tj.asp for infection statistics

Download Http://***.kjxs.com/liehuo.rar to%system32%\contxt.dat the file should be a list of Trojans to download
But the link has expired.

5. Image hijacking a lot of anti-virus software and security tools and some other popular viruses:

Quote:
360rpt.exe
360Safe.exe
360tray.exe
45.exe
5784dfgi.exe
Adam.exe
AgentSvr.exe
Appdllman.exe
AppSvc32.exe
Auto.exe
AutoRun.exe
Autoruns.exe
Avgrssvc.exe
AvMonitor.exe
Avp.com
Avp.exe
CCenter.exe
CcSvcHst.exe
Cross.exe
Dfcxfg.exe
Discovery.exe
FileDsty.exe
FTCleanerShell.exe
FuckAAAAAAA.exe
Guangd.exe
HijackThis.exe
IceSword.exe
Iparmo.exe
Iparmor.exe
IsPwdSvc.exe
Kabaload.exe
Kascrscn.scr
KASMain.exe
KASTask.exe
KAV32.exe
KAVDX.exe
KAVPFW.exe
KAVSetup.exe
KAVStart.exe
Kernelwind32.exe
KISLnchr.exe
KMailMon.exe
KMFilter.exe
KPFW32.exe
KPFW32X.exe
KPFWSvc.exe
KRegEx.exe
Krepair.com
KsLoader.exe
Kvcenter.kxp
KvDetect.exe
KvfwMcl.exe
Kvmonxp.kxp
Kvmonxp_1.kxp
Kvol.exe
Kvolself.exe
Kvreport.kxp
KVSrvXP.exe
Kvstub.kxp
Kvupload.exe
Kvwsc.exe
Kvxp.kxp
KWatch.exe
KWatch9x.exe
KWatchX.exe
Loaddll.exe
Logogo.exe
MagicSet.exe
Mcconsol.exe
Mmqczj.exe
Mmsk.exe
NAVSetup.exe
Nod32krn.exe
Nod32kui.exe
Pagefile.exe
Pagefile.pif
PFW.exe
PFWLiveUpdate.exe
QHSET.exe
Ras.exe
Rav.exe
RavMon.exe
RavMonD.exe
RavStub.exe
RavTask.exe
RegClean.exe
Regedit. Exe
Regedit32. Exe
Rfwcfg.exe
RfwMain.exe
RfwProxy.exe
Rfwsrv.exe
RsAgent.exe
Rsaupd.exe
Runiep.exe
Safelive.exe
Scan32.exe
SDGames.exe
Servet.exe
Shcfg32.exe
SmartUp.exe
Sos.exe
SREng.exe
SSDtDiscovery.exe
Symlcsvc.exe
SysSafe.exe
Taskmgr.exe
Tnt. Exe
TrojanDetector.exe
Trojanwall.exe
Trojdie.kxp
TxoMoU.Exe
U.exe
UFO.exe
UIHost.exe
UmxAgent.exe
UmxAttachment.exe
UmxCfg.exe
UmxFwHlp.exe
UmxPol.exe
UpLive.EXE
USBoot.exe
WoptiClean.exe
Wsyscheck.exe
XP.exe
Xxxdgfdfg.exe
Zxsweep.exe
~.exe


6. Create a Registry Startup Project
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<LoveHebeAA><C:\WINDOWS\system32\vistaAA.exe>
The purpose of booting itself up

7. Create a timer every 1800 seconds to start the virus itself

Purge method:

1. Restart Computer access
In Safe Mode (after Power-on press F8 key and then come out an advanced menu to select the first safe mode to enter the system)
Open Sreng:
Start the Project registry delete the following items

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<LoveHebeAA><C:\WINDOWS\system32\vistaAA.exe>

Delete all red Ifeo items

2. Delete the following file C:\WINDOWS\system32\vistaAA.exe

3. Use antivirus software to remove virus download other Trojan