Virus analysis in the. netframework Environment

This example describes how to run the program on. netframework2.0 is a virus in the runtime environment. This virus not only modifies iesettings, but also locks the IE homepage and injects system processes to protect itself from being revived repeatedly.

First, let's take a look at the simple analysis of this virus program.

Virus Sample Introduction

Let's take a look at the relevant information of the virus sample, as shown in 1.

File: 4.exe

MD5: 8f97cc356a149265647d3167fb802409

Size: 270KB

Figure 1: virus sample

As shown in figure 1, compiled by SFXMake indicates that this sample is actually a self-extracting program, as shown in figure 2. The self-extracting program can be opened directly using winrar, 7zip, and other decompression tools. There are some bundled viruses, sometimes made into self-extracting forms, bundle a normal software program with a malicious virus sample, and execute the virus sample first by writing a script program. As long as we double-click the self-extract program containing the malicious script, virus samples are given priority, which will lead to direct recruitment. Of course, when we encounter this type of self-extracting format program, we can open it directly through winrar or 7zip to check whether there are malicious programs bound to this program. If there are malicious programs, you can decompress the self-extracting program through winrar or 7zip, delete the malicious program in it, and keep the normal software program we need, so as to avoid system recruitment. In addition, we can also use anti-virus software to scan and kill malicious programs in the Self-extracting program and retain normal software programs. This is also a very simple and effective method.

Figure 2: Use winrarto open 4.exe, which is actually an msi Program

The MSI file is a windows installer package. It is actually a database that contains the information required to install a product and the instructions and data required to install and uninstall the program in many installation scenarios. The MSI file associates the component files of the program with functions. We use winrar to directly extract the muzina. msi program and double-click it to run it. The prompt shown in 3 is displayed.

Figure 3: the prompt for installing. netframework2.0 is displayed.

Here, we will not explain in detail how to install. netframework2.0. First download and install windows intaller3.1, and then install. netframework2.0. Next let's take a look at the virus phenomenon.

Virus symptom

Run 4.exe directly after installing .netframework2.0as needed. 4.exe after running for a while, let's restart the computer to see what damage this virus has done to the system. Open ie browser and check that the ie homepage is changed to http://www.filmxizle.org/arama,4. This is a virus. Modify the ie homepage.

Figure 4: The ie homepage is changed to www.filmxizle.org/arama

If the ie homepage has been modified, check the properties of the ie shortcut on the desktop. Can you modify the homepage here? 5, as shown in, the web page setting function of ie browser is disabled by viruses. The Homepage cannot be changed.

Figure 5: an internet connection is left for the ie shortcut, and other items are disabled

Next, run xuetr and use xuetr to check the processes and startup items created by the virus. As shown in figure 6, there is a Skriller.exe in the xuetrprocess, and the path is C: \ Program Files \ Internet Explorer \ Skriller.exe.

Figure 6: skiller.exe virus Program written in C: \ Program Files \ Internet Explorer \

Next, let's take a look at the startup item, as shown in 7. The virus is written into the skiller.exe virus Program in C: \ Program Files \ Internet Explorer \ and set as the startup Item HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run, so as to achieve the purpose of running at startup.

Figure 7: startup entry SkrillerMaintance for virus writing

As shown in figure 7, the file vendor is mami. At this time, the virus looks very simple. It only writes a virus program and sets it as the startup Item. After modifying the ie homepage, it seems that you only need to end the process with xutre and delete the Registry Startup item to solve the problem. As shown in figure 8, right-click the intermediate process skiller.exe and force the process to end. Select the startup Item SkrillerMaintance in the startup Item, right-click to delete (startup information), as shown in figure 9. Restart your computer and check whether the system is normal.

Figure 8: Use xuetrto force the route entry skriller.exe

Figure 9: Delete the startup entry for virus writing

After restarting the computer, we opened a folder and tried to find that the folder was obviously choppy. Then we checked the process and startup items with xuetr, as shown in 10, and found that the virus program skriller appeared magically, the startup Item was re-written, as shown in Figure 11. It seems that we have not completely handled the virus.

Figure 10: open a folder and the virus appears again

Figure 11: The virus startup Item is written again

There should be other virus programs that we haven't processed completely. The virus that seems to have been processed is triggered again after opening the folder. Next, let's take a look at what causes the virus to run again. Follow the preceding method to end the process and delete the startup Item. Use processmonitor to monitor the action of opening the folder. We set a filter rule. The operation is process creation, as shown in Figure 12.

Figure 12: Set the processmonitor process creation rule

After setting the rules, we open the folder and find that processmonitorcaught the system process er.exeand created the process skrill.exe, as shown in 13.

Figure 13: creation process skriller.exe

We then set the Registration Table value to 14, and found that the virus program skriller.exe keeps setting the ie tab to http://www.filmxizle.org/arama,15.

Figure 14: Set the processmonitor rule to set the registry value

Figure 15: skriller.exe keeps modifying the ie Tab

Right-click the record in the red box in Figure 15, and click attribute 16. The ie tab of virus program is changed to http://www.filmxizle.org/arama.

Figure 16: virus settings the registry value for the ie tab is http://www.filmxizle.org/arama

Worker Process Module, as shown in figure 17.

Figure 17: zookeeper er.exe Process Module

We can see that assumer.exe has loaded two suspicious dll modules: C: \ Program Files \ Internet Explorer \ mhuzun. dll and C: \ Program Files \ Internet Explorer \ Interop. SHDocVw. dll, as shown in 18.

Figure 18: two suspicious dll files loaded by assumer.exe

Right-click a dll and choose find module File to directly jump to the path of the suspicious dll file, as shown in Figure 19.

Figure 19: locate the module File

Go to the module File Path C: \ Program Files \ Internet Explorer \. We found no suspicious dll file, as shown in Figure 20. It seems to be hidden.

Figure 20: C: \ Program Files \ Internet Explorer \ no suspicious dll Files

By modifying tools-Folder Options-view, you can deselect the hidden protected system files (recommended), select to display all files and folders, and unhide extensions of known file types. See the virus program, as shown in Figure 21.

Figure 21: unhide system settings

After you cancel the system hide settings, let's take a look at the virus programs in the C: \ Program Files \ Internet Explorer \ directory, as shown in 22.

Figure 22: CLEAR system Hidden setting virus programs

The virus creates skrill.exe, writes it to the C: \ Program Files \ Internet Explorer \ directory, sets it to the startup registry entry, and writes it to the mhuzun. dll and \ interop.shdocv1_dllare added to multiple processes, such as assumer.exe, And the ie homepage is changed to http://www.filmxizle.org/arama.

Manual virus Processing

We have found all the virus files written by the virus, and it will be much easier to process them. In addition to the previously mentioned xuetrentries, we deleted the registration table items and uninstalled the virus dll injected by the assumer.exe process globally, as shown in Figure 23. Uninstall the virus dll module, and then use xuetr to delete the virus Files in the C: \ Program Files \ Internet Explorer \ directory, as shown in 24.

Figure 23: Use xuetr to globally uninstall the virus Module

Figure 24: delete all virus files with xuetr

After the above operations, we restarted the computer and found that the folder was not choppy. We used xuetr to check that there were no suspicious processes in the system process and startup items, indicating that the virus was successfully manually cleaned. The remaining home page repair problems should be handed over to the rising security assistant. We used the rising security assistant computer repair function to scan the system and found that multiple iesettings were modified, as shown in Figure 25.

Figure 25: rising security assistant scanned multiple ie disabled

Click repair now. Use the rising security assistant to successfully repair the ie items that are disabled by the virus, as shown in Figure 26.

Figure 26: rising security assistant fixed ie disabling items

Attribute 27 of the ie shortcut that has been repaired is shown in.

Figure 27: ie shortcut attributes repaired successfully