运行 xiaoshen.exe 后 访问网络 生成
C:/WINDOWS/system32/Update.exe
C:/WINDOWS/system32/update2.exe
C:/WINDOWS/system32/update3.exe
C:/WINDOWS/system32/update4.exe
C:/WINDOWS/system32/update9.exe
C:/Documents and Settings/mopery/Local Settings/Temporary Internet Files/Content.IE5/63U70503/desktop.ini
C:/Documents and Settings/mopery/Local Settings/Temporary Internet Files/Content.IE5/63U70503/host[1].txt
C:/Documents and Settings/mopery/Local Settings/Temporary Internet Files/Content.IE5/63U70503/up5[1].jpg
C:/Documents and Settings/mopery/Local Settings/Temporary Internet Files/Content.IE5/B006ZRBG/desktop.ini
C:/Documents and Settings/mopery/Local Settings/Temporary Internet Files/Content.IE5/B006ZRBG/up2[1].jpg
C:/Documents and Settings/mopery/Local Settings/Temporary Internet Files/Content.IE5/LRVZUX8H/desktop.ini
C:/Documents and Settings/mopery/Local Settings/Temporary Internet Files/Content.IE5/LRVZUX8H/desktop.ini
C:/Documents and Settings/mopery/Local Settings/Temporary Internet Files/Content.IE5/OZENOVM1/desktop.ini
C:/Documents and Settings/mopery/Local Settings/Temporary Internet Files/Content.IE5/OZENOVM1/desktop.ini
还在每个盘符下 生成
xiaoshen.exe 和 autorun.inf
C:/WINDOWS/system32/drivers/etc/hosts
内容为
127.0.0.1 qq.etsoft.com.cn
61.152.90.31 zt.abcoll.com
然后 Update.exe 那几个分别运行..
C:/WINDOWS/system32/Update.exe
就写入一个注册表
HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run
[Update] C:/WINDOWS/system32/Update.exe
C:/WINDOWS/system32/update2.exe
释放文件
C:/Program Files/Common Files/Microsoft Shared/MSINFO/50948A91.dat
C:/Program Files/Common Files/Microsoft Shared/MSINFO/50948A91.dll
C:/WINDOWS/Help/wshmcepts.chm
修改系统文件 C:/WINDOWS/system32/verclsid.exe 为 C:/WINDOWS/system32/verclsid.exe.bak
注册表项
HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/ShellExecuteHooks
[{48A95094-5094-8A91-948A-094A90948A91}]
HKCR/CLSID/{48A95094-5094-8A91-948A-094A90948A91}/InProcServer32
[默认]C:/Program Files/Common Files/Microsoft Shared/MSINFO/50948A91.dll
具体参考:http://forum.ikaka.com/topic.asp?board=28&artid=8201339
C:/WINDOWS/system32/update3.exe
生成文件
C:/DOCUME~1/mopery/LOCALS~1/Temp/mc21.tmp
C:/nxldr.dat
注册表项
HKLM/SYSTEM/CurrentControlSet/Services/NetWorkLogon
HKLM/SYSTEM/CurrentControlSet/Services/mchInjDrv
C:/WINDOWS/system32/Update4.exe
生成文件
C:/20061023.dat
C:/20061026.dat
C:/WINDOWS/system32/Ravdm.exe
C:/WINDOWS/system32/Drivers/Rinld.sys
hosts 添加 125.65.77.72 www.qo263.com
C:/WINDOWS/system32/Ravdm.exe 具体的处理方法参考:http://forum.ikaka.com/topic.asp?board=28&artid=8156736
C:/WINDOWS/system32/update9.exe
生成文件
C:/WINDOWS/Intel/rundll32.exe
C:/WINDOWS/system32/ztdll.dll
注册表项
HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run
[rzt] C:/WINDOWS/Intel/rundll32.exe
具体的处理方法..安全模式下操作..
先清空IE临时文件夹..
删除文件
C:/WINDOWS/system32/Update.exe
C:/WINDOWS/system32/update2.exe
C:/WINDOWS/system32/update3.exe
C:/WINDOWS/system32/update4.exe
C:/WINDOWS/system32/update9.exe
右键 打开 盘符
删除
xiaoshen.exe 和 autorun.inf
C:/WINDOWS/system32/drivers/etc/hosts 用 记事本 打开..
127.0.0.1 localhost
下面的全部删除..
C:/WINDOWS/system32/Update.exe
处理方法
删除注册表
HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run
[Update]
C:/WINDOWS/system32/update2.exe
参考:http://forum.ikaka.com/topic.asp?board=28&artid=8201339 处理..
C:/WINDOWS/system32/update3.exe
处理方法
删除文件
C:/DOCUME~1/mopery/LOCALS~1/Temp/mc21.tmp
C:/nxldr.dat
打开注册表 删除
HKLM/SYSTEM/CurrentControlSet/Services/NetWorkLogon
HKLM/SYSTEM/CurrentControlSet/Services/mchInjDrv
C:/WINDOWS/system32/Update4.exe
参考:http://forum.ikaka.com/topic.asp?board=28&artid=8156736 处理..
C:/WINDOWS/system32/update9.exe
处理方法
删除文件
C:/WINDOWS/Intel/rundll32.exe
C:/WINDOWS/system32/ztdll.dll
打开注册表 删除
HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run
[rzt]
以上操作全部需要在安全模式下...