Win32.Troj.QQRobber.fb

tVersion\\ tVersion\\ tVersion\\

病毒名稱

Win32.Troj.QQRobber.fb
威脅級別:★
病毒類型:木馬
影響系統:Win 9x/ME,Win 2000/NT,Win XP,Win 2003

病毒行為

:
病毒是一個QQ大盜變種。該病毒會將盜取的QQ號及密碼傳送到指定的電子信箱和提交到指定的網址。建議電腦用戶不要隨便運行不明程式,以免中毒受害。
1、病毒拷貝自身到系統目錄下,並設定為隱藏。
%SystemRoot%\system32\NTdHcP.exe
2、刪除QQ保護檔案npkcrypt.sys,並保存為npkcrypt.bak檔案。
D:\Program Files\Tencent\QQ\npkcrypt.sys
3、添加註冊表啟動項
HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run
"NTdhcp" = "%SystemRoot%\system32\NTdhcp.exe"
4、安裝了一個類型為WH_JOURNALRECORD的訊息鉤子,記錄連續的滑鼠和鍵盤事件。
其申請進程為:%SystemRoot%\system32\NTdHcP.exe
5、將下列服務啟動全設定為禁止啟動,並結束其進程。
HKLM\SYSTEM\CurrentControlSet\Services\navapsvc\Start
HKLM\SYSTEM\CurrentControlSet\Services\RsRavMon\Start
HKLM\SYSTEM\CurrentControlSet\Services\RsCCenter\Start
HKLM\SYSTEM\CurrentControlSet\Services\kavsvc\Start
HKLM\SYSTEM\CurrentControlSet\Services\kvsrvxp\Start
HKLM\SYSTEM\CurrentControlSet\Services\KVWSC\Start
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\Start
HKLM\SYSTEM\CurrentControlSet\Services\kpfwsvc\Start
HKLM\SYSTEM\CurrentControlSet\Services\KWatchSvc\Start
HKLM\SYSTEM\CurrentControlSet\Services\SNDSrvc\Start
HKLM\SYSTEM\CurrentControlSet\Services\ccProxy\Start
HKLM\SYSTEM\CurrentControlSet\Services\ccEvtMgr\Start
HKLM\SYSTEM\CurrentControlSet\Services\CCSETMGR\Start
HKLM\SYSTEM\CurrentControlSet\Services\SPBBCSvc\Start
HKLM\SYSTEM\CurrentControlSet\Services\Symantec Core LC\Start
HKLM\SYSTEM\CurrentControlSet\Services\NPFMntor\Start
HKLM\SYSTEM\CurrentControlSet\Services\MskService\Start
HKLM\SYSTEM\CurrentControlSet\Services\FireSvc\Start
HKLM\SYSTEM\CurrentControlSet\Services\mcshield\Start
HKLM\SYSTEM\CurrentControlSet\Services\McTaskManager\Start
HKLM\SYSTEM\CurrentControlSet\Services\McAfeeFramework\Start
HKLM\SYSTEM\CurrentControlSet\Services\RfwService\Start
7、嘗試刪除下列啟動項,並結束其進程。
HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\RavMon
HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\KAVPersonal50
HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\RavTimer
HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\RavTask HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\KvMonXP HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\iDuba Personal FireWall HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\KAVRun HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\KpopMon HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\Kulansyn HKCU\SoftWare\Microsoft\Windows\CurrentVersion\Run\iDuba Personal FireWall HKCU\SoftWare\Microsoft\Windows\CurrentVersion\Run\KavPFW
HKCU\SoftWare\Microsoft\Windows\CurrentVersion\Run\KvXP NOTFOUND
HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\ccapp HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\SSC_UserPrompt HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\NAV CfgWiz HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\MCAgentExe HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\McRegWiz HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\MCUpdateExe HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\MSKAGENTEXE HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\MSKDetectorExe HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\VirusScan Online HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\VSOCheckTask HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\McAfeeUpdaterUI HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\Network Associates Error HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\ShStatEXE HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\VSOCheckTask HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\KavStart HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\RfwMain HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\SonudMan HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\KvPpWall_autorun
8、生成並運行Deleteme.bat批處理檔案,實現自刪除。

其它

文化藝術,生活娛樂,人物百科,社會人文,中外歷史...


相關詞條

相關搜尋

熱門詞條

聯絡我們