AV终结者(随机八位数，映像劫持，破坏安全模式)病毒解决方案-骇客基地-病毒分析

最近，一种病毒变种(以随机八位字符为文件名)疯狂传播。由于病毒制造者会经常更新病毒文件，使病毒变种狂增，一方面使很多用户深受其害，更一方面使得专杀效果不是很好，所以还是建议进行手工查杀。
	一、病毒相关分析：
	病毒标签：病毒名称：Trojan-PSW.Win32.Nilage.gen/Virus.Win32.Autorun.gen 病毒别名：帕虫--瑞星，AV终结者--金山，U盘寄生虫--江民病毒类型：病毒危害级别：5 感染平台：Windows 平台病毒大小：33,363 (字节) SHA1　　：d8ced73c38439ca03bd2f4f07a492b58b9a82947 加壳类型：upx 开发工具：Delphi
	病毒分析： 1、运行病毒文件后，会生成以下文件： %CommonProgramFiles%\Microsoft Shared\MSInfo\随机八位字符.dll (46163字节) %CommonProgramFiles%\Microsoft Shared\MSInfo\随机八位字符.dat (33363字节) %SystemRoot%\Help\随机八位字符.chm (33363字节) %SystemRoot%\随机八位字符.hlp (33字节) 在除系统盘外的各盘根目录下生成 autorun.inf (172字节) 随机八位字符.exe (33363字节) 2、关闭运行的安全软件，监控并关闭以下含有以下字符串的文件夹、窗体、进程、服务、网页或文本： AntiVirus、Trojan、Firewall、Kaspersky、JiangMin、KV200、kxp、Rising、RAV、RFW、KAV200、KAV6、 McAfe、Network Associates、TrustPort、Norton、Symantec、SYMANT~1、Norton、SystemWorks、ESET、 Grisoft、F-Pro、Alwil Software、ALWILS~1、F-Secure、ArcaBit、Softwin、ClamWin、DrWe、Fortine、 anda Software、Vba3、TrendMicro、QUICKH~1、TRENDM~1、Quick Heal、eSaf、ewido、Prevx1、ersavg、 Ikarus、Sopho、Sunbelt、PC-cilli、ZoneAlar、 Agnitum、WinAntiVirus、AhnLab、Norma、surfsecret、 Bullguard、BlackICE、Armor2net、360safe、SkyNet、k2007、AntiyLabs、LinDirMicro Lab、Filseclab、ast、 System Safety Monitor、ProcessGuard、FengYun、Lavasoft、Defendio、kis6、Behead、sreng、IceSword、 HijackThis、killbox、procexp、Magicset、EQSysSecure、ProSecurity、Yahoo!、Google、baidu、P4P、 Sogou PXP、yaskp.sys、BDGuard.sys、超级兔子、木马、KSysFilt.sys、KSysCall.sys、AVK、K7、Zondex、 blcorp、TinyFirewall Pro、Jetico、HAURI、CA、kmx、PCClear_Plus、Novatix、Ashampoo、WinPatrol、 Spy Cleaner Gold、CounterSpy、EagleEyeOS、Webroot、BufferZone、avp、AgentSvr、Ccenter、Rav、 RavMonD、RavStub、RavTask、rfwcfg、rfwsrv、RsAgent、Rsaupd、runiep、SmartUp、FileDsty、RegClean、 360tray、360Safe、360rpt、kabaload、safelive、Ras、KASMain、KASTask、KAV32、KAVDX、KAVStart、 KISLnchr、KmailMon、KMFilter、KPFW32、KPFW32X、KPFWSvc、KWatch9x、Kwatch、KwatchX、TrojanDetector、 UpLive.EXE、KVSrvXP、KvDetect、KregEx、kvol、kvolself、kvupload、kvwsc、UIHost、IceSword、iparmo、 mmsk、adam、MagicSet、PFWLiveUpdate、SREng、WoptiClean、scan32、shcfg32、mcconsol、HijackThis、 mmqcj、Trojanwall、FTCleanerShell、loaddll.、rfwProxy、KsLoader、KvfwMcl、autoruns.、AppSvc32、 ccSvcHst、isPwdSvc、symlcsvc、nod32kui、avgrssvc、RfwMain、KAVPFW、Iparmor、nod32krn、PFW、RavMon、 KAVSetup、NAVSetup、SysSafe、QHSET、xsweep.、AvMonitor、UmxCfg、UmxFwHlp、UmxPol、UmxAgent、 UmxAttachment、KPFW32、KPFW32X、KvXP_1、KVMonXP_1、KvReport、KVScan、KVStub、KvXP、KVMonXP、KVCenter、 TrojDie、avp.com、krepair.COM、KaScrScn.SCR、Trojan、Virus、kaspersky、jiangmin、rising、ikaka、duba、 kingsoft、360safe、木马、木馬、病毒、杀毒、殺毒、查毒、防毒、反病毒、专杀、專殺、卡巴、江民、瑞星、卡卡社区、金山毒霸、毒霸、金山、社区、360安全、恶意软件、流氓软件、举报、报警、杀软、殺軟、防駭、微点、 MSInfo、WinRAR、KvNative、bsmain、aswBoot 3、删除以下注册表项破坏安全模式 HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} 修改系统隐藏属性: 改HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ Folder\Hidden\SHOWALL\CheckedValue值为0 //1为显示隐藏文件 4、添加IFEO映像劫持项 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krepair.COM HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.EXE.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zxsweep.exe 以上键值均指向 %CommonProgramFiles%\Microsoft Shared\MSInfo\随机八位字符.dat 5、连接http://google.171738.org 和http://head.bodyhtml.biz/ani.js 下载ani.c (1,156 字节)Ani.c为ANI溢出程序，并通过该文件下载 http://head.bodyhtml.biz/update.exe。通过连接http://www.cnzz.com/stat/website.php?web_id=518199记录访问量。 6、update.exe文件会从http://head.bodyhtml.biz上下载大量木马与病毒。其中包括AV终结者变种，病毒如下：%CommonProgramFiles%\system\jbtmfqq.exe (25240字节) %CommonProgramFiles%\microsoft shared\ytbikec.exe (25240字节) 在除系统盘根目录下 autorun.inf hsomklg.exe (28672字节) %temp%目录下 LYLOADER.EXE (10196字节) LYMANGR.DLL (2816字节) MSDEG32.DLL (4999字节) ~SM3.tmp (19504字节) ~SM4.tmp (19504字节) ~SM5.tmp (19504字节) ~SM6.tmp (19504字节) ~SM7.tmp (19504字节) 以上文件会采用添加自身到启动项或插入explorer.exe进程进行自我保护，还会下载其他盗取网游帐号的木马。
	二、解决方案：
		1、先找突破点。因为映像劫持(image File Execution Options Hijack)只是针对文件名，所以只要更改变文件名，就可以使它失效。为了防止刚清理的病毒又被重新生成或者安全软件不能使用。我们先解除映像支持，使用超级巡警中新发布的IFEO修复功能(“安全优化”中“系统修复”下的“Fix IFEO”) 即可。因为AST可能已经被映像劫持，所以推荐使用超级巡警团队针对此类病毒新推出的“ToolsLoader”(详见http://www.dswlab.com/d3.html)。 2、清出内存病毒和病毒文件。找到加载到 explorer.exe 的dll文件(文件名应该与就是刚才记着的相同)，用超级巡警 ToolsLoader卸载它。然后删除掉dll文件和同目录下的扩展名为dat的文件(因为病毒会监控以上文件的目录，所以推荐使用巡警中的“文件粉碎机”删除以上文件)。然后用 win+e 打开资源管理器，找到根目录下的 autorun.inf 和 autorun.inf 里面记录的exe文件(注意：不要双击盘符或单击盘符右键选打开，这样让autorun.inf失效，然后使用巡警中的“文件粉碎机”删除这两个文件)。现在病毒的主文件已经都清理了。剩下的可以用病毒文件的文件名(不要扩展名)和病毒文件生成时间进行全盘搜索，找到的文件都删除掉。此病毒还会连接一些网站，下载大量盗号软件，这些盗号软件目的是盗取游戏程序或其他程序的帐号与密码，清除不会很复杂。它们一般都采用加载启动的方法，达到开机运行的效果。所以只要删除了启动项及其对应的文件，就可解决。这些病毒文件产生的dll文件和垃圾文件，就可以交给杀毒软件处理了。 3、全面修复。修复隐藏属性：使[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\Advanced\Folder\Hidden\SHOWALL]下的"CheckedValue"= dword:00000001。修复安全模式，可以用超级巡警的安全修复(“安全优化”中“系统修复”下的“Fix IFEO”)。也可以先在能进入安全模式的机器中导出 HKLM\SYSTEM\ControSet001\Control\SafeBoot\ HKLM\SYSTEM\ControSet003\Control\SafeBoot\ HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\然后复制到本机上导入。修复映像劫持：这个在第一步已经做了。 4、安全模式杀毒。确保杀毒软件升级到最新，确保打上了最新的系统补丁(用巡警的补丁检查功能，没打的补丁一定要打上)，进入安全模式(推荐断开网络)，使用超级巡警进行全盘扫描，彻底清除各种病毒。 5、使用超级巡警屏蔽网站http://head.bodyhtml.biz


	黑客首页　\|　服务指南　\|　软件发布　\|　关于我们　\|　本站声明　\|　隐私声明　\|　诚征英才　\|　网站地图　\|　友情链接　\|
	中国·黑客·骇客·基地　请使用IE6.0版本, 分辩率1024×768进行浏览 www.hookbase.com 站长：利客　Email:hookbase@163.com Copyright © 2004-2009 All Rights Reserved. 粤ICP备05000985号