发现 SuperUtilBar

最新推荐文章于 2022-02-25 21:57:21 发布

gracexu

最新推荐文章于 2022-02-25 21:57:21 发布

阅读量1.1k

点赞数

分类专栏：流氓软件文章标签： system c windows google dll 百度

本文链接：https://blog.csdn.net/gracexu/article/details/1515613

版权

流氓软件专栏收录该内容

1 篇文章 0 订阅

订阅专栏

今天打开 Windows Defender 看了一下，在隔离项目下有个SuperUtilBar，文件名是toolsp.exe。在Google搜了一下，CA公司对该流氓软件有很详细的描述。
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453101952
从描述来看，是百度出品的东东，真是没品的家伙啊，我以前就中过它的招。把相关信息记录如下：

可执行文件
%program_files%/superutilbar/uninst.exe
%program_files%/common files/system/updaterun.exe, temp.exe, bar.exe
%windows%/toolsp.exe

DLL文件
%system%/wbem/vicqr.dll
%system%/wbem/ocmor.dll
%system%/wbem/kblfu.dll
%system%/lqbag.dll
%system%/agyst.dll
%system%/advport.dll
%program_files%/superutilbar/superutilbar.dll

注册表项
HKEY_CLASSES_ROOT/6781.toolbar
HKEY_CLASSES_ROOT/6781.toolbar.1
HKEY_CLASSES_ROOT/6781.toolbar.1/clsid
HKEY_CLASSES_ROOT/6781.toolbar/clsid
HKEY_CLASSES_ROOT/6781.toolbar/curver
HKEY_CLASSES_ROOT/6781.toolbarloader
HKEY_CLASSES_ROOT/6781.toolbarloader.1
HKEY_CLASSES_ROOT/6781.toolbarloader.1/clsid
HKEY_CLASSES_ROOT/6781.toolbarloader/clsid
HKEY_CLASSES_ROOT/6781.toolbarloader/curver
HKEY_CLASSES_ROOT/clsid/{03465ff5-00ae-411a-9c34-960ed566ec03}
HKEY_CLASSES_ROOT/clsid/{03465ff5-00ae-411a-9c34-960ed566ec03}/inprocserver32
HKEY_CLASSES_ROOT/clsid/{03465ff5-00ae-411a-9c34-960ed566ec03}/inprocserver32 threadingmodel
HKEY_CLASSES_ROOT/clsid/{03465ff5-00ae-411a-9c34-960ed566ec03}/progid
HKEY_CLASSES_ROOT/clsid/{03465ff5-00ae-411a-9c34-960ed566ec03}/programmable
HKEY_CLASSES_ROOT/clsid/{03465ff5-00ae-411a-9c34-960ed566ec03}/typelib
HKEY_CLASSES_ROOT/clsid/{03465ff5-00ae-411a-9c34-960ed566ec03}/versionindependentprogid
HKEY_CLASSES_ROOT/clsid/{6cfd436c-7aad-4e50-992f-c0c87a94cad2}
HKEY_CLASSES_ROOT/clsid/{6cfd436c-7aad-4e50-992f-c0c87a94cad2}/inprocserver32
HKEY_CLASSES_ROOT/clsid/{6cfd436c-7aad-4e50-992f-c0c87a94cad2}/inprocserver32 threadingmodel
HKEY_CLASSES_ROOT/clsid/{6cfd436c-7aad-4e50-992f-c0c87a94cad2}/progid
HKEY_CLASSES_ROOT/clsid/{6cfd436c-7aad-4e50-992f-c0c87a94cad2}/programmable
HKEY_CLASSES_ROOT/clsid/{6cfd436c-7aad-4e50-992f-c0c87a94cad2}/typelib
HKEY_CLASSES_ROOT/clsid/{6cfd436c-7aad-4e50-992f-c0c87a94cad2}/versionindependentprogid
HKEY_CLASSES_ROOT/typelib/{03d0c547-ebad-43d9-8b57-de16e7a93b52}
HKEY_CLASSES_ROOT/typelib/{03d0c547-ebad-43d9-8b57-de16e7a93b52}/0.0
HKEY_CLASSES_ROOT/typelib/{03d0c547-ebad-43d9-8b57-de16e7a93b52}/0.0/0
HKEY_CLASSES_ROOT/typelib/{03d0c547-ebad-43d9-8b57-de16e7a93b52}/0.0/0/win32
HKEY_CLASSES_ROOT/typelib/{03d0c547-ebad-43d9-8b57-de16e7a93b52}/0.0/flags
HKEY_CLASSES_ROOT/typelib/{03d0c547-ebad-43d9-8b57-de16e7a93b52}/0.0/helpdir
HKEY_LOCAL_MACHINE/software/microsoft/internet explorer/toolbar {03465ff5-00ae-411a-9c34-960ed566ec03}
HKEY_LOCAL_MACHINE/software/microsoft/windows/currentversion/explorer/browser helper objects/{6cfd436c-7aad-4e50-992f-c0c87a94cad2}
HKEY_LOCAL_MACHINE/software/microsoft/windows/currentversion/uninstall/êµóãëñë÷¹¤¾ßìõ
HKEY_LOCAL_MACHINE/software/microsoft/windows/currentversion/uninstall/êµóãëñë÷¹¤¾ßìõ displayname
HKEY_LOCAL_MACHINE/software/microsoft/windows/currentversion/uninstall/êµóãëñë÷¹¤¾ßìõ displayversion
HKEY_LOCAL_MACHINE/software/microsoft/windows/currentversion/uninstall/êµóãëñë÷¹¤¾ßìõ publisher
HKEY_LOCAL_MACHINE/software/microsoft/windows/currentversion/uninstall/êµóãëñë÷¹¤¾ßìõ uninstallstring
HKEY_LOCAL_MACHINE/software/microsoft/windows/currentversion/uninstall/êµóãëñë÷¹¤¾ßìõ urlinfoabout