Viking/Viking new variants, Trojan-PSW.Win32.WOW.do, etc. (2)

EndurerOriginal

1Version

(Continued)
This section describes the analysis process.

1. Check the automatic scanning record of rising startup:
==================================
Virus name processing result found date path file virus source
Trojan. psw. Agent. adw cleared successfully. svhost32.exe> C:/progra ~ 1/svhost32.exe Local Machine
Trojan. psw. zhengtu. CC cleared successfully 1.exe> C:/Windows/system32/1.exe Local Machine
Trojan. psw. Agent. adw cleared successfully 2006-07-19 08:25 svhost32.exe> C:/progra ~ 1/svhost32.exe Local Machine
Trojan. psw. zhengtu. CC cleared successfully 2006-07-19 08:25 1.exe> C:/Windows/system32/1.exe Local Machine
Trojan. psw. zhengtu. CC cleared successfully 2006-07-19 08:25 1.exe> C:/Windows/system32/1.exe Local Machine
Trojan. psw. zhengtu. CC cleared successfully 1.exe> C:/Windows/system32/1.exe Local Machine
Trojan. psw. Agent. adw cleared successfully 2006-07-19 20 svhost32.exe> C:/progra ~ 1/svhost32.exe Local Machine
Trojan. psw. Agent. adw cleared successfully 2006-07-19 svhost32.exe> C:/progra ~ 1/svhost32.exe Local Machine
Trojan. psw. zhengtu. CC cleared successfully 1.exe> C:/Windows/system32/1.exe Local Machine
Trojan. psw. Agent. adw cleared successfully 2006-07-19 svhost32.exe> C:/progra ~ 1/svhost32.exe Local Machine
Trojan. psw. zhengtu. CC cleared successfully 2006-07-19 19:58 1.exe> C:/Windows/system32/1.exe Local Machine
Trojan. DL. Direct. h cleared successfully 0.exe> C:/Windows/system32/0.exe Local Machine
Trojan. psw. zhengtu. CC cleared successfully 2006-07-19 19:58 1.exe> C:/Windows/system32/1.exe Local Machine
Trojan. psw. Agent. adw cleared successfully 2006-07-19 svhost32.exe> C:/progra ~ 1/svhost32.exe Local Machine
Trojan. psw. zhengtu. CC cleared successfully 2006-07-19 1.exe> C:/Windows/system32/1.exe Local Machine

2. Use rising to manually scan drive C. The scan records on the evening of the 19th are as follows:
==================================
Trojan. psw. lmir. kgs deleted successfully 2006-07-19 23:05 C:/Windows/q54414.log Local Machine
Trojan. psw. lmir. kgs deleted successfully 2006-07-19 C:/Windows/q62539.log Local Machine
Trojan. psw. lmir. kgs deleted successfully 2006-07-19 23:05 C:/Windows/kb684745m. Log Local Machine
Trojan. psw. jhonline. Epp deleted successfully c:/Windows/system32/2.dll Local Machine
Trojan. DL. Direct. h deleted successfully c:/Windows/system32/winexec.exe Local Machine
Trojan. DL. Direct. h deleted successfully c:/Windows/system32/2.exe Local Machine
Trojan. DL. Direct. h deleted successfully c:/Windows/system32/0.exe Local Machine
Trojan. DL. Direct. h deleted successfully c:/Windows/system32/1.exe Local Machine

3. Use hijackthis for analysis.
Run hijackthis.exe. Although you can see the process in the task manager, there is no display window!
Run procview.exe with the same results! At the same time, we found that the system generated a file named vidll. dll with a size of 25,600 bytes. Procview.exe is in a separate folder, so it is easy to find.
To be honest, procview.exe has a length of nearly 20 KB. Normally, it should be more than 10 KB, And the icon looks rough ......

It seems that the system is infected with the virus of the EXE file!

Go to the http://endurer.ys168.com and download hijackthis, procview, and icesword again.

After overwriting the original file, hijackthis can run properly:

3.1 The following suspicious items are found in the logs scanned by hijackthis:
==============================================

Logfile of hijackthis v1.99.1
Scan saved at 9:41:44, on
Platform: Windows XP SP1 (winnt 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

C:/Windows/SMSs. exe

F2-Reg: system. ini: shellw.shangher.exe 1
F3-Reg: win. ini: load = C:/Windows/rundl132.exe

O4-HKLM/../run: [ravuptyes] C:/Windows/system32/ravseidll.exe

O4-HKLM/../run: [winsvc] C:/Windows/system32/winsvc.exe
O4-HKLM/../run: [tprogram] C:/Windows/SMSs. exe
O4-HKLM/../run: [svch0st] C:/Windows/system32/svch0st.exe
O4-HKLM/../runservices: [tprogram] C:/Windows/SMSs. exe

O20-appinit_dlls: kb684745m. Log

3.2 due to the fact that trojan.psw.lmirhas modified the EXE file, hijackthisscanned startuplist.txt and found suspicious items:
==============================================

Autorun entries from registry:
HKLM/software/Microsoft/Windows/CurrentVersion/run

Tprogram = C:/Windows/SMSs. exe
Svch0st = C:/Windows/system32/svch0st.exe

--------------------------------------------------

Autorun entries from registry:
HKLM/software/Microsoft/Windows/CurrentVersion/runservices

Tprogram = C:/Windows/SMSs. exe

--------------------------------------------------

File Association entry for. EXE:
Hkey_classes_root/winfiles/Shell/Open/command

(Default) = C:/Windows/exeroute.exe "% 1" % *

--------------------------------------------------

Load/run keys from C:/Windows/win. ini:

Load = * ini section not found *
Run = * ini section not found *

Load/run keys from registry:

HKLM/../Windows NT/CurrentVersion/Windows: appinit_dlls = kb684745m. Log

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
* No scripts set to run *

Windows NT checkdisk command:
Bootexecute = autocheck autochk *

Windows NT 'wininit. ini ':
Pendingfilerenameoperations: C:/Windows/kb684745m. log | C:/Windows/q36155.log

--------------------------------------------------
It can be seen that the EXE file is associated with C:/Windows/exeroute.exe, And the winint. ini file is used for the next start operation.