已知病毒，求行为分析，及完全清理办法

荷韵诗

q721tcl521 发表于 2011-6-4 16:56
中招之后没有被干掉吗？或者能安装上，我看了下 好像劫持杀软啊

没事的  我是关闭360，运行程序，再打开360的，一点问题没有。这个不是病毒。360可以清除

q721tcl521

jefffire 发表于 2011-6-4 16:55
删那些文件不够。
注册表IEFO项被添加了很多，要删掉。hosts文件也被篡改，需要删。
C:\Program Files\ ...

谢谢了，是别人中毒，我再拿虚拟机玩玩，之前虚拟机我用powertools 不知道是删错了还是怎么了，重启之后无限重启了

hx1997

解决方法：（可能不全）
删除以下文件或文件夹
C:\Program Files\aldlslwld
C:\WINDOWS\system32\3.lnk
C:\WINDOWS\system32\dianwoxiufu.bat
C:\WINDOWS\system32\Internet Expiore.lnk
C:\WINDOWS\system32\linzhiling.rmvb
C:\WINDOWS\system32\linzhiling.txt
C:\WINDOWS\system32\linzhiling.vbe
C:\WINDOWS\system32\linzhilingwoaini.vbe
C:\WINDOWS\system32\修复浏览器专用.reg
C:\WINDOWS\system32\「开始」菜单程序启动\系统清理工具(建议开机自启动).vbe
C:\WINDOWS\system32\「开始」菜单程序启动\屏幕保护专家(建议开机自启动).vbe
C:\WINDOWS\system32\Favorites\Internet Explore.lnk
C:\WINDOWS\system32\Favorites\网上掏书就上当当网.lnk
C:\WINDOWS\system32\Favorites\网址导航.lnk
C:\WINDOWS\system32\Favorites\卓越网周年店庆.lnk
C:\WINDOWS\system32\Favorites\最大的成人用品商店.lnk
C:\WINDOWS\system32\Favorites\安全浏览器.lnk
C:\WINDOWS\system32\Favorites\安全绿色浏览器.lnk
C:\WINDOWS\system32\Favorites\当当网-全球最大的中文网上书店&购物中心.lnk
C:\WINDOWS\system32\Favorites\电影网.lnk
C:\WINDOWS\system32\Favorites\京东商城.lnk
C:\WINDOWS\system32\Favorites\欧飞数字点卡打折卖.lnk
C:\WINDOWS\system32\Favorites\淘宝购物.lnk
C:\WINDOWS\system32\Quick Launch\360安全浏览器 3.lnk
C:\WINDOWS\system32\Quick Launch\Internet Explorer.lnk
C:\WINDOWS\system32\Quick Launch\启动 Internet Explorer 浏览器.lnk
C:\WINDOWS\system32\Quick Launch\淘宝购物.lnk
C:\WINDOWS\system32\Quick Launch\网址导航.lnk
C:\WINDOWS\system32\激情美女面对面
C:\WINDOWS\system32\桌面\淘宝购物.lnk
C:\WINDOWS\system32\桌面\安全浏览器.lnk
C:\WINDOWS\system32\桌面\网址导航.lnk
C:\WINDOWS\system32\桌面\搜索互联网.lnk
C:\WINDOWS\system32\桌面1\激情美女面对面
C:\WINDOWS\system32\1.lnk
C:\WINDOWS\system32\ahui1.exe
C:\WINDOWS\system32\ahui.vbe
C:\WINDOWS\system32\dabukai.txt
C:\WINDOWS\system32\xxxzzzaass.exe
C:\WINDOWS\system32\xxxzzzaass
C:\WINDOWS\system32\填加的.vbe
C:\WINDOWS\system32\gai.ini
C:\WINDOWS\system32\jia.ini
%UserProfile%\「开始」菜单\Internet Explore.lnk
%UserProfile%\「开始」菜单\程序\Internet Explore.lnk
C:\WINDOWS\Media\sssssssssssaaaaaaaaaddddddddd
C:\WINDOWS\Help\Tours\xxxxxxxxxxxxxxxxxxxaaaaaaaa
C:\WINDOWS\system32\jieshujincheng1.bat
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\淘宝购物.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\网址导航.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk

修复以下文件
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\360安全浏览器 3.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
C:\WINDOWS\system32\etc\hosts

最后修复注册表映像劫持

hx1997

jefffire 发表于 2011-6-4 16:55
删那些文件不够。
注册表IEFO项被添加了很多，要删掉。hosts文件也被篡改，需要删。
C:\Program Files\ ...

还不全，还有一些

%UserProfile%\「开始」菜单\Internet Explore.lnk
%UserProfile%\「开始」菜单\程序\Internet Explore.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\淘宝购物.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\网址导航.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\360安全浏览器 3.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk

网名丢失

红伞全杀

yyylll66

映像劫持，改写hosts。下载者 桌面多个ie快捷方式指向http://888.niwota888.cn

C:\Documents and Settings\All Users\「开始」菜单\程序\启动\屏幕保护专家(建议开机自启动).vbe
C:\Documents and Settings\All Users\「开始」菜单\程序\启动\系统清理工具(建议开机自启动).vbe
C:\Documents and Settings\All Users\桌面\安全浏览器.lnk
C:\Documents and Settings\All Users\桌面\搜索互联网.lnk
C:\Documents and Settings\All Users\桌面\淘宝购物.lnk
C:\Documents and Settings\All Users\桌面\网址导航.lnk
C:\Documents and Settings\All Users\桌面\激情美女面对面\激情美女面对面\哥哥,请看.txt
C:\Documents and Settings\All Users\桌面\激情美女面对面\激情美女面对面\美女陪聊一对一.lnk
C:\Documents and Settings\Administrator\「开始」菜单\Internet Explore.lnk
C:\Documents and Settings\Administrator\「开始」菜单\程序\Internet Explore.lnk
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\360安全浏览器 3.lnk
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\淘宝购物.lnk
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\网址导航.lnk
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\360安全浏览器 3.lnk
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk

C:\Documents and Settings\Administrator\Favorites\Internet Explore.lnk
C:\Documents and Settings\Administrator\Favorites\京东商城.lnk
C:\Documents and Settings\Administrator\Favorites\卓越网周年店庆.lnk
C:\Documents and Settings\Administrator\Favorites\安全浏览器.lnk
C:\Documents and Settings\Administrator\Favorites\安全绿色浏览器.lnk
C:\Documents and Settings\Administrator\Favorites\当当网-全球最大的中文网上书店&购物中心.lnk
C:\Documents and Settings\Administrator\Favorites\最大的成人用品商店.lnk
C:\Documents and Settings\Administrator\Favorites\欧飞数字点卡打折卖.lnk
C:\Documents and Settings\Administrator\Favorites\淘宝购物.lnk
C:\Documents and Settings\Administrator\Favorites\电影网.lnk
C:\Documents and Settings\Administrator\Favorites\网上掏书就上当当网.lnk
C:\Documents and Settings\Administrator\Favorites\网址导航.lnk


C:\Program Files\aldlslwld\tubiao\(1.rmvb
C:\Program Files\aldlslwld\tubiao\(10).rmvb
C:\Program Files\aldlslwld\tubiao\(2).rmvb
C:\Program Files\aldlslwld\tubiao\(3).rmvb
C:\Program Files\aldlslwld\tubiao\(4).rmvb
C:\Program Files\aldlslwld\tubiao\(5).rmvb
C:\Program Files\aldlslwld\tubiao\(6).rmvb
C:\Program Files\aldlslwld\tubiao\(7).rmvb
C:\Program Files\aldlslwld\tubiao\(8).rmvb
C:\Program Files\aldlslwld\tubiao\(9).rmvb
C:\Program Files\aldlslwld\tubiao\x1 (1).rmvb
C:\Program Files\aldlslwld\tubiao\x1 (10).rmvb
C:\Program Files\aldlslwld\tubiao\x1 (11).rmvb
C:\Program Files\aldlslwld\tubiao\x1 (2).rmvb
C:\Program Files\aldlslwld\tubiao\x1 (3).rmvb
C:\Program Files\aldlslwld\tubiao\x1 (4).rmvb
C:\Program Files\aldlslwld\tubiao\x1 (5).rmvb
C:\Program Files\aldlslwld\tubiao\x1 (6).rmvb
C:\Program Files\aldlslwld\tubiao\x1 (7).rmvb
C:\Program Files\aldlslwld\tubiao\x1 (8).rmvb
C:\Program Files\aldlslwld\tubiao\x1 (9).rmvb
C:\Program Files\aldlslwld\tubiao\x1.rmvb
C:\Program Files\aldlslwld\tubiao\xiaosla.cmd
C:\Program Files\aldlslwld\tubiao\xiaoslal.cmd
C:\Program Files\aldlslwld\tubiao\复件 (1.rmvb
C:\Program Files\aldlslwld\tubiao\复件 (2).rmvb
C:\Program Files\aldlslwld\tubiao\复件 (3).rmvb
C:\Program Files\aldlslwld\tubiao\复件 (4).rmvb
C:\Program Files\aldlslwld\tubiao\复件 (5).rmvb

C:\WINDOWS\system32\Favorites\Internet Explore.lnk
C:\WINDOWS\system32\Favorites\京东商城.lnk
C:\WINDOWS\system32\Favorites\卓越网周年店庆.lnk
C:\WINDOWS\system32\Favorites\安全浏览器.lnk
C:\WINDOWS\system32\Favorites\安全绿色浏览器.lnk
C:\WINDOWS\system32\Favorites\当当网-全球最大的中文网上书店&购物中心.lnk
C:\WINDOWS\system32\Favorites\最大的成人用品商店.lnk
C:\WINDOWS\system32\Favorites\欧飞数字点卡打折卖.lnk
C:\WINDOWS\system32\Favorites\淘宝购物.lnk
C:\WINDOWS\system32\Favorites\电影网.lnk
C:\WINDOWS\system32\Favorites\网上掏书就上当当网.lnk
C:\WINDOWS\system32\Favorites\网址导航.lnk
C:\WINDOWS\system32\Quick Launch\网址导航.lnk
C:\WINDOWS\system32\Quick Launch\淘宝购物.lnk
C:\WINDOWS\system32\Quick Launch\启动 Internet Explorer 浏览器.lnk
C:\WINDOWS\system32\Quick Launch\Internet Explorer.lnk
C:\WINDOWS\system32\Quick Launch\360安全浏览器 3.lnk
C:\WINDOWS\system32\桌面\安全浏览器.lnk
C:\WINDOWS\system32\桌面\搜索互联网.lnk
C:\WINDOWS\system32\桌面\淘宝购物.lnk
C:\WINDOWS\system32\桌面\网址导航.lnk
C:\WINDOWS\system32\桌面1\激情美女面对面\激情美女面对面\哥哥,请看.txt
C:\WINDOWS\system32\桌面1\激情美女面对面\激情美女面对面\美女陪聊一对一.lnk
C:\WINDOWS\system32\「开始」菜单程序启动\屏幕保护专家(建议开机自启动).vbe
C:\WINDOWS\system32\「开始」菜单程序启动\系统清理工具(建议开机自启动).vbe
C:\WINDOWS\system32\激情美女面对面\激情美女面对面\哥哥,请看.txt
C:\WINDOWS\system32\激情美女面对面\激情美女面对面\美女陪聊一对一.lnk

C:\WINDOWS\Help\Tours\xxxxxxxxxxxxxxxxxxxaaaaaaaa\1.vbe
C:\WINDOWS\Hxes2lp\Tour11222s\GoddEER\s5yueah.vbe 等。。。。。。
C:\WINDOWS\Media\sssssssssssaaaaaaaaaddddddddd\xxxzzzaass.cmd

C:\WINDOWS\system32\etc\hosts
C:\WINDOWS\system32\xxxzzzaass\xxxzzzaass.cmd
C:\WINDOWS\system32\xxxzzzaass\xxxzzzaass\1.vbe
C:\WINDOWS\system32\saaaa2211.vbe
C:\WINDOWS\system32\nsrqqigomezpaaeer.exe
C:\WINDOWS\system32\xxxzzzaass.exe
C:\WINDOWS\system32\linzhilingwoaini.vbe
C:\WINDOWS\system32\linzhiling.vbe
C:\WINDOWS\system32\linzhiling.txt
C:\WINDOWS\system32\linzhiling.rmvb
C:\WINDOWS\system32\填加的.vbe
C:\WINDOWS\system32\修复浏览器专用.reg
C:\WINDOWS\system32\jia.ini
C:\WINDOWS\system32\Internet Expiore.lnk
C:\WINDOWS\system32\gai.ini
C:\WINDOWS\system32\jieshujincheng1.bat
C:\WINDOWS\system32\jieshujincheng.bat
C:\WINDOWS\system32\dianwoxiufu.bat
C:\WINDOWS\system32\dabukai.txt
C:\WINDOWS\system32\ahui1.exe
C:\WINDOWS\system32\ahui.vbe
C:\WINDOWS\system32\3.lnk
C:\WINDOWS\system32\1.lnk
C:\WINDOWS\etcaa22.exe
C:\WINDOWS\gaiie.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7KL4WOG2\gaiie[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7KL4WOG2\etcaa22.exe
C:\Documents and Settings\Administrator\gai.ini
C:\Documents and Settings\Administrator\jia.ini
C:\Program Files\Common Files\awinxzd\1.cmd
C:\Program Files\kasea\guda\tiasf\sdfa\fse\svxd\sdf\jddr.cmd
C:\Program Files\Windows Media Player\Icsssons\等等
C:\Program Files\Windows NT\Accesssories\qidsss2a.vbs等
C:\Program Files\Common Files\awinxzd文件夹下
ctusky-1.exe
ctusky-2.exe
ctusky-3.exe
ctusky-4.exe
ctusky-5.exe
ctusky-6.exe
ctusky-7.exe
ctusky-8.exe
ctusky-9.exe
ctusky-10.exe
ctusky-11.exe
ctusky-12.exe
ctusky-13.exe
ctusky-14.exe
ctusky-15.exe
ctusky-16.exe
ctusky-17.exe
ctusky-18.exe
ctusky-19.exe
ctusky-20.exe
ctusky-21.exe
ctusky-22.exe
ctusky-23.exe
ctusky-24.exe
ctusky-25.exe
ctusky-26.exe
ctusky-27.exe
ctusky-28.exe
ctusky-29.exe
ctusky-30.exe
ctusky-31.exe
ctusky-32.exe
ctusky-33.exe
ctusky-34.exe
ctusky-35.exe
ctusky-36.exe
ctusky-37.exe
ctusky-38.exe
ctusky-39.exe
ctusky-40.exe
ctusky-41.exe
ctusky-42.exe
ctusky-43.exe
ctusky-44.exe
ctusky-45.exe
ctusky-46.exe
ctusky-47.exe
ctusky-48.exe
ctusky-49.exe
ctusky-50.exe
ctusky-51.exe
ctusky-52.exe
ctusky-53.exe
ctusky-54.exe
ctusky-55.exe
ctusky-56.exe
ctusky-57.exe
ctusky-58.exe
ctusky-59.exe
ctusky-60.exe
ctusky-61.exe
ctusky-62.exe
ctusky-63.exe
ctusky-64.exe
ctusky-65.exe
ctusky-66.exe
ctusky-67.exe
ctusky-68.exe
ctusky-69.exe
ctusky-70.exe
ctusky-71.exe
ctusky-72.exe
ctusky-73.exe
ctusky-74.exe
ctusky-75.exe
ctusky-76.exe
ctusky-77.exe
ctusky-78.exe
可查看下载目录run.txt
。。。。。。等等（多重启几次），Program Files和system32下的文件夹会出现很多可变为随机名的。有点特色，会调用ftp.exe，做好wscript.exe的控制就好解决问题。

q721tcl521

hx1997 发表于 2011-6-4 17:41
还不全，还有一些

我想知道你是怎么分析出这些病毒释放文件的路径的

q721tcl521

yyylll66 发表于 2011-6-4 20:54
映像劫持，改写hosts。桌面多个ie快捷方式指向http://888.niwota888.cn

C:\Documents and Settings\Al ...

用的什么分析工具可否介绍下

yyylll66

q721tcl521 发表于 2011-6-4 21:48
用的什么分析工具可否介绍下

ark工具——开始用助手查看了下启动项等大概情况，基本纯手工。

留侯

大蜘蛛啟發式分析技術作出判斷：

xiaoslal.cmd - archive RAR
xiaoslal.cmd/linzhiling.vbe packed by ENCODED SCRIPT
xiaoslal.cmd/linzhiling.vbe probably infected with SCRIPT.Virus
xiaoslal.cmd/linzhilingwoaini.vbe packed by ENCODED SCRIPT
xiaoslal.cmd/=A1=B8=BF=AA=CA=BC=A1=B9=B2=CB=B5=A5=B3=CC=D0=F2=C6=F4=B6=AF\=CF=B5=CD=B3=C7=E5=C0=ED=B9=A4=BE=DF(=BD=A8=D2=E9=BF=AA=BB=FA=D7=D4=C6=F4=B6=AF).vbe packed by ENCODED SCRIPT
xiaoslal.cmd/=A1=B8=BF=AA=CA=BC=A1=B9=B2=CB=B5=A5=B3=CC=D0=F2=C6=F4=B6=AF\=CF=B5=CD=B3=C7=E5=C0=ED=B9=A4=BE=DF(=BD=A8=D2=E9=BF=AA=BB=FA=D7=D4=C6=F4=B6=AF).vbe probably infected with SCRIPT.Virus
xiaoslal.cmd/=A1=B8=BF=AA=CA=BC=A1=B9=B2=CB=B5=A5=B3=CC=D0=F2=C6=F4=B6=AF\=C6=C1=C4=BB=B1=A3=BB=A4=D7=A8=BC=D2(=BD=A8=D2=E9=BF=AA=BB=FA=D7=D4=C6=F4=B6=AF).vbe packed by ENCODED SCRIPT
xiaoslal.cmd/=A1=B8=BF=AA=CA=BC=A1=B9=B2=CB=B5=A5=B3=CC=D0=F2=C6=F4=B6=AF\=C6=C1=C4=BB=B1=A3=BB=A4=D7=A8=BC=D2(=BD=A8=D2=E9=BF=AA=BB=FA=D7=D4=C6=F4=B6=AF).vbe probably infected with SCRIPT.Virus

xiaoslal.cmd/ahui1.exe/ahui1.cmd - archive RAR
xiaoslal.cmd/ahui1.exe/ahui1.cmd/riweirun.vbe packed by ENCODED SCRIPT
xiaoslal.cmd/ahui.vbe packed by ENCODED SCRIPT
xiaoslal.cmd/xxxzzzaass.exe - archive RAR
xiaoslal.cmd/xxxzzzaass.exe/xxxzzzaass.cmd - archive RAR
xiaoslal.cmd/xxxzzzaass.exe/xxxzzzaass.cmd/1.vbe packed by ENCODED SCRIPT
xiaoslal.cmd/xxxzzzaass\xxxzzzaass\1.vbe packed by ENCODED SCRIPT
xiaoslal.cmd/xxxzzzaass\xxxzzzaass.cmd - archive RAR
xiaoslal.cmd/xxxzzzaass\xxxzzzaass.cmd/1.vbe packed by ENCODED SCRIPT
xiaoslal.cmd/=CC=EE=BC=D3=B5=C4.vbe packed by ENCODED SCRIPT