安全响应·Security
|
Worm.Win32.Skipi.b分析
出处：安天CERT 时间：2007-09-25 15：00
 病毒标签： |
|
病毒名称：
Worm.Win32.Skipi.b
病毒类型： 蠕虫类
文件 MD5： 9fc5fad65fb0dae7b5370607d103aa80
公开范围： 完全公开
危害等级： 5
文件长度： 188,416字节
感染系统： Win98以上版本
开发工具： Microsoft Visual C++ 7.0
加壳类型： 无壳
|
| 病毒描述： |
|
该病毒属蠕虫类，病毒运行后复制自身到系统目录下，并分别重命名为：mshtmldat32.exe、
sdrivew32.exe、winlgcvers.exe、wndrivs32.exe；修改注册表，添加启动项，以达到随机启动
的目的；病毒运行后打开%windir%目录下的图片Soap Bubbles.bmp；wndrivs32.exe以子进程的
方式注入到系统进程explorer.exe中，并间隔6000ms查看一次wndrivs32.exe进程，如关闭则重
新启动；该病毒通过Skype文字聊天工具进行传播。修改主机host文件，屏蔽安全软件相关网站。
|
| 行为分析： |
|
本地行为：
1、文件运行后会释放以下文件：
%system32%\wndrivs32.exe
%system32%\mshtmldat32.exe
%system32%\sdrivew32.exe
%system32%\winlgcvers.exe
2、修改注册表，添加启动项，以达到随机启动的目的：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
\Windows\CurrentVersion\RunOnce
键值: 字串: "Services Start"="mshtmldat32.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
\Windows NT\CurrentVersion\Winlogon\
键值: 字串: 0022Windows Sys"="explorer.exe mshtmldat32.exe"
3、病毒运行后打开%windir%目录下的图片Soap Bubbles.bmp。
4、wndrivs32.exe以子进程的方式注入到系统进程explorer.exe中，并间隔6000ms查
看一次wndrivs32.exe进程，如关闭则重新启动。
网络行为：
1、通过Skype发送以下诱惑文字诱使用户执行病毒：
pala biski
as net nezinau ka tavo vietoj daryciau. :S
matai :D
;) geras ane ? patinka ?
kas cia tavim taip isderge ? =]]
cia tu isimetei?
cia biski su photoshopu pazaidziau bet bet irgi gerai atrodai :D
zek kur tavo foto metos isdergta
(mm) kaip as taves noriu
ziurek kur tavo foto imeciau :D esi?
labas this (happy) sexy one
what ur friend name wich is in photo ?
u happy ?
oh sry not for u
oops sorry please don't look there :S
you checked ? :D
(rofl) (devil) :) really funny
now u populr
haha lol
I used photoshop and edited it look what
crazy photo Tiffany sent to me,looks cool where
I put urphoto :D
your photos looks realy nice
look
hey how are u ? :)
2、该病毒通过Skype文字聊天工具进行传播。
3、修改主机host文件，屏蔽安全软件相关网站，屏蔽了以下网站：
139.206.15.236 symantec.comsecurityresponse.symantec.com
180.60.30.22 www.symantec.comsecurityresponse.symantec.com
21.240.105.130 pandasoftware.com
142.228.78.42 www.pandasoftware.com
116.151.83.254 sophos.com
146.95.10.145 www.sophos.com
109.1.56.19 mcafee.com
205.127.53.127 www.mcafee.com
120.49.150.21 downloads-us1.kaspersky-labs.com
65.23.10.11 www.downloads-us1.kaspersky-labs.com
65.110.130.128 updates1.kaspersky-labs.com
101.129.149.177 www.updates1.kaspersky-labs.com
41.194.34.111 updates2.kaspersky-labs.com
162.25.55.209 www.updates2.kaspersky-labs.com
194.124.49.38 updates3.kaspersky-labs.com
216.192.37.45 www.updates3.kaspersky-labs.com
86.175.127.137 updates4.kaspersky-labs.com
215.90.233.111 www.updates4.kaspersky-labs.com
96.177.111.162 updates5.kaspersky-labs.com
230.80.224.161 www.updates5.kaspersky-labs.com
17.156.119.30 downloads1.kaspersky-labs.com
64.15.186.179 www.downloads1.kaspersky-labs.com
205.208.163.209 downloads2.kaspersky-labs.com
146.135.254.249 www.downloads2.kaspersky-labs.com
172.111.18.46 downloads3.kaspersky-labs.com
126.173.131.170 www.downloads3.kaspersky-labs.com
249.224.119.208 downloads4.kaspersky-labs.com
27.249.248.98 www.downloads4.kaspersky-labs.com
182.77.154.244 downloads5.kaspersky-labs.com
115.232.93.160 www.downloads5.kaspersky-labs.com
22.36.212.252 ftp.downloads1.kaspersky-labs.com
4.123.135.73 www.ftp.downloads1.kaspersky-labs.com
2.154.151.237 ftp.downloads2.kaspersky-labs.com
63.182.160.36 www.ftp.downloads2.kaspersky-labs.com
149.35.227.242 ftp.downloads3.kaspersky-labs.com
12.35.165.92 www.ftp.downloads3.kaspersky-labs.com
160.252.210.215 ftp.downloads4.kaspersky-labs.com
68.77.230.1 www.ftp.downloads4.kaspersky-labs.com
38.161.13.143 ftp.downloads5.kaspersky-labs.com
53.69.137.134 www.ftp.downloads5.kaspersky-labs.com
225.87.85.175 dnl-us3.kaspersky-labs.com
33.32.8.68 www.dnl-us3.kaspersky-labs.com
187.164.251.240 dnl-us4.kaspersky-labs.com
192.118.174.247 www.dnl-us4.kaspersky-labs.com
85.209.104.176 dnl-us5.kaspersky-labs.com
185.229.30.60 www.dnl-us5.kaspersky-labs.com
132.111.150.114 dnl-us6.kaspersky-labs.com
45.140.205.25 www.dnl-us6.kaspersky-labs.com
207.207.149.90 dnl-us7.kaspersky-labs.com
45.145.130.116 www.dnl-us7.kaspersky-labs.com
243.136.7.178 dnl-us8.kaspersky-labs.com
63.156.221.155 www.dnl-us8.kaspersky-labs.com
95.245.164.104 kaspersky.ru
221.89.205.187 www.kaspersky.ru
184.181.183.141 msk1.drweb.com
245.249.24.104 www.msk1.drweb.com
86.41.159.215 msk2.drweb.com
106.177.216.28 www.msk2.drweb.com
198.250.79.32 msk3.drweb.com
145.58.248.176 www.msk3.drweb.com
70.144.206.229 msk4.drweb.com
181.80.187.228 www.msk4.drweb.com
75.156.184.200 boss.drweb.comdrweb.com
148.52.53.221 www.boss.drweb.comdrweb.com
254.142.187.15 liveupdate.symantecliveupdate.com
224.42.208.162 www.liveupdate.symantecliveupdate.com
186.32.27.35 viruslist.com
191.251.200.158 www.viruslist.com
144.201.46.17 security.symantec.com
75.115.175.33 www.security.symantec.com
196.75.224.12 f-secure.com
18.228.234.223 www.f-secure.com
78.38.49.233 kaspersky-labs.com
151.161.51.111 www.kaspersky-labs.com
89.34.178.161 kaspersky.com
207.132.21.205 www.kaspersky.com
199.201.12.211 avp.com
166.106.115.217 www.avp.com
171.234.121.63 norman.com
120.177.1.213 www.norman.com
206.24.72.76 sandbox.norman.com
152.193.200.235 www.sandbox.norman.com
43.41.93.131 networkassociates.com
204.128.167.165 www.networkassociates.com
114.184.175.18 ca.com
206.220.205.115 www.ca.com
137.163.201.75 mast.mcafee.com
205.69.64.41 www.mast.mcafee.com
6.141.73.34 my-etrust.com
234.47.89.126 www.my-etrust.com
183.93.100.178 download.mcafee.com
187.149.69.143 www.download.mcafee.com
26.189.96.184 dispatch.mcafee.com
204.113.134.89 www.dispatch.mcafee.com
229.156.25.22 secure.nai.com
25.69.112.66 www.secure.nai.com
127.172.124.82 nai.com
149.150.172.145 www.nai.com
133.229.15.21 update.symantec.com
166.107.185.241 www.update.symantec.com
70.0.103.172 updates.symantec.com
167.210.102.242 www.updates.symantec.com
71.253.176.138 us.mcafee.com
100.92.89.136 www.us.mcafee.com
192.158.41.196 liveupdate.symantec.com
162.156.139.138 www.liveupdate.symantec.com
29.233.165.147 customer.symantec.com
148.171.201.52 www.customer.symantec.com
126.170.12.214 rads.mcafee.com
103.167.52.166 www.rads.mcafee.com
55.239.216.142 trendmicro.com
183.48.194.99 www.trendmicro.com
81.138.152.96 grisoft.com
24.233.188.211 www.grisoft.com
8.147.112.22 esaugumas.lt
142.253.62.193 www.esaugumas.lt
75.227.151.30 antivirus.esaugumas.lt
21.151.186.221 www.antivirus.esaugumas.lt
62.154.215.9 esecurity.lt
25.105.116.59 www.esecurity.lt
187.153.17.14 virustotal.com
255.38.7.210 www.virustotal.com
205.9.182.133 windowsupdate.microsoft.com
155.8.223.255 www.windowsupdate.microsoft.com
51.210.79.108 microsoft.com
183.75.190.255 www.microsoft.com
227.37.246.229 virusscan.jotti.org
147.176.56.120 www.virusscan.jotti.org
133.243.219.182 bkav.com.vn
95.251.54.241 www.bkav.com.vn
244.115.192.199 grisoft.czfree.grisoft.com
195.117.118.85 www.grisoft.czfree.grisoft.com
192.160.125.168 bitdefender.com
88.107.9.116 www.bitdefender.com
175.184.125.9 aonealarm.com
44.173.212.130 www.aonealarm.com
55.191.63.64 barracudanetworks.com
65.15.15.151 www.barracudanetworks.com
5.250.214.198 free-av.com
14.235.201.45 www.free-av.com
122.116.105.186 avast.com
253.158.99.165 www.avast.com
41.125.180.93 pandasecurity.com
236.7.16.194 www.pandasecurity.com
90.38.133.148 nod32-es.com
172.11.92.43 www.nod32-es.com
137.198.64.105 nod32.com
133.19.162.238 www.nod32.com
232.119.91.138 eset.com
176.140.147.248 www.eset.com
217.153.226.201 nod32.it
219.102.182.158 www.nod32.it
117.79.245.154 nod32.de
169.150.227.23 www.nod32.de
8.254.69.152 nod32.nl
47.149.199.255 www.nod32.nl
146.209.155.1 nod32.datsec.de
120.222.99.214 www.nod32.datsec.de
71.55.81.53 u0.eset.com
2.116.140.127 u1.eset.com
16.98.214.59 u2.eset.com
63.89.109.194 u3.eset.com
8.202.46.59 u4.eset.com
21.24.0.202 u5.eset.com
0.169.112.5 u6.eset.com
94.60.153.168 u7.eset.com
252.125.71.137 u8.eset.com
104.214.92.206 u9.eset.com
179.137.114.93 u10.eset.com
118.252.193.148 u11.eset.com
19.83.67.59 u12.eset.com
61.68.23.182 u13.eset.com
187.39.36.127 u14.eset.com
104.77.254.212 u15.eset.com
127.147.13.173 u16.eset.com
21.55.236.241 u17.eset.com
231.234.15.233 u18.eset.com
86.38.169.245 u19.eset.com
176.193.204.126 u20.eset.com
177.195.210.43 u21.eset.com
74.117.253.88 u22.eset.com
160.186.90.196 u23.eset.com
88.162.235.137 u24.eset.com
18.61.4.82 u25.eset.com
51.173.246.200 u26.eset.com
232.127.235.77 u27.eset.com
104.60.17.237 u28.eset.com
121.58.251.145 u29.eset.com
53.184.68.118 u30.eset.com
14.42.117.222 u31.eset.com
16.210.40.6 u32.eset.com
102.144.110.87 u33.eset.com
32.251.111.224 u34.eset.com
51.176.80.4 u35.eset.com
193.235.90.112 u36.eset.com
155.84.88.81 u37.eset.com
5.27.64.195 u38.eset.com
185.70.22.140 u39.eset.com
46.74.14.10 u40.eset.com
25.217.241.106 u41.eset.com
53.252.193.27 u42.eset.com
63.97.160.130 u43.eset.com
69.246.238.240 u44.eset.com
33.183.178.209 u45.eset.com
65.195.59.38 u46.eset.com
169.182.7.53 u47.eset.com
58.51.227.126 u48.eset.com
52.192.84.242 u49.eset.com
250.215.54.96 u50.eset.com
21.57.163.48 u51.eset.com
124.134.22.83 u52.eset.com
18.11.208.122 u53.eset.com
113.219.123.134 u54.eset.com
230.33.14.64 u55.eset.com
188.180.240.75 u56.eset.com
190.236.96.87 u57.eset.com
247.181.20.150 u58.eset.com
188.225.32.116 u59.eset.com
237.195.26.131 u60.eset.com
119.249.124.180 u61.eset.com
29.137.73.205 u62.eset.com
121.48.244.23 u63.eset.com
61.246.125.87 u64.eset.com
191.6.221.0 u65.eset.com
181.189.164.167 u66.eset.com
60.1.225.183 u67.eset.com
32.212.66.102 u68.eset.com
87.40.124.232 u69.eset.com
206.245.237.226 u70.eset.com
105.138.128.33 u71.eset.com
69.33.210.140 u72.eset.com
64.181.147.87 u73.eset.com
187.24.46.122 u74.eset.com
158.64.172.98 u75.eset.com
157.225.213.230 u76.eset.com
186.66.153.124 u77.eset.com
11.73.175.173 u78.eset.com
190.215.124.198 u79.eset.com
90.92.54.209 u80.eset.com
71.162.73.195 u81.eset.com
145.237.250.247 u82.eset.com
233.70.74.219 u83.eset.com
237.20.29.234 u84.eset.com
169.236.155.218 u85.eset.com
93.170.215.22 u86.eset.com
128.193.174.110 u87.eset.com
6.207.243.13 u88.eset.com
223.117.201.172 u89.eset.com
192.101.79.6 u90.eset.com
37.188.131.140 u91.eset.com
151.147.96.89 u92.eset.com
42.208.74.104 u93.eset.com
75.66.172.5 u94.eset.com
184.238.224.129 u95.eset.com
208.163.79.42 u96.eset.com
13.213.217.122 u97.eset.com
207.168.119.143 u98.eset.com
91.74.30.219 u99.eset.com
35.134.231.29 u100.eset.com
72.150.110.144 download0.avast.com
93.57.119.98 sl0.avast.com
110.6.216.103 rs0.avast.com
64.0.147.15 download1.avast.com
219.106.66.150 sl1.avast.com
70.221.184.122 rs1.avast.com
146.151.229.50 download2.avast.com
25.22.250.29 sl2.avast.com
8.230.206.185 rs2.avast.com
27.183.128.21 download3.avast.com
168.178.95.137 sl3.avast.com
223.13.6.164 rs3.avast.com
80.221.203.102 download4.avast.com
174.44.91.175 sl4.avast.com
210.76.158.248 rs4.avast.com
2.106.225.65 download5.avast.com
116.102.51.74 sl5.avast.com
14.227.15.6 rs5.avast.com
112.154.60.77 download6.avast.com
52.243.242.209 sl6.avast.com
116.214.62.83 rs6.avast.com
141.190.167.23 download7.avast.com
35.16.18.149 sl7.avast.com
102.172.227.113 rs7.avast.com
147.193.101.173 download8.avast.com
189.229.108.30 sl8.avast.com
205.101.57.28 rs8.avast.com
200.217.157.126 download9.avast.com
80.252.98.198 sl9.avast.com
110.187.230.152 rs9.avast.com
142.140.9.113 download10.avast.com
203.1.73.149 sl10.avast.com
109.157.44.73 rs10.avast.com
176.230.223.67 download11.avast.com
200.187.28.95 sl11.avast.com
33.232.80.147 rs11.avast.com
235.248.254.37 download12.avast.com
214.75.94.27 sl12.avast.com
26.104.75.244 rs12.avast.com
187.147.92.149 download13.avast.com
11.163.80.134 sl13.avast.com
112.14.175.94 rs13.avast.com
103.70.174.124 download14.avast.com
201.72.83.248 sl14.avast.com
78.113.219.217 rs14.avast.com
79.148.89.137 download15.avast.com
208.75.159.134 sl15.avast.com
189.138.97.89 rs15.avast.com
116.122.152.204 download16.avast.com
132.132.37.88 sl16.avast.com
180.171.183.221 rs16.avast.com
72.32.238.150 download17.avast.com
127.16.193.75 sl17.avast.com
96.193.29.200 rs17.avast.com
182.221.206.143 download18.avast.com
90.14.163.202 sl18.avast.com
176.202.205.131 rs18.avast.com
116.113.137.23 download19.avast.com
183.149.255.232 sl19.avast.com
36.152.105.83 rs19.avast.com
136.125.119.226 download20.avast.com
146.248.242.194 sl20.avast.com
215.199.161.119 rs20.avast.com
24.69.105.206 download21.avast.com
200.61.183.19 sl21.avast.com
201.252.35.133 rs21.avast.com
119.170.77.7 download22.avast.com
231.218.11.24 sl22.avast.com
112.95.199.5 rs22.avast.com
107.97.34.93 download23.avast.com
56.177.221.166 sl23.avast.com
130.90.250.78 rs23.avast.com
195.121.30.229 download24.avast.com
10.78.58.137 sl24.avast.com
252.146.106.161 rs24.avast.com
24.11.30.206 download25.avast.com
64.95.119.30 sl25.avast.com
117.38.244.131 rs25.avast.com
227.66.77.132 download26.avast.com
29.115.159.51 sl26.avast.com
169.38.202.95 rs26.avast.com
191.142.23.10 download27.avast.com
78.246.31.29 sl27.avast.com
64.86.232.91 rs27.avast.com
255.36.80.148 download28.avast.com
56.108.175.27 sl28.avast.com
223.35.184.122 rs28.avast.com
115.185.160.99 download29.avast.com
131.237.131.234 sl29.avast.com
113.229.3.242 rs29.avast.com
118.126.50.229 download30.avast.com
230.225.178.169 sl30.avast.com
181.87.26.207 rs30.avast.com
59.94.156.13 download31.avast.com
52.252.229.238 sl31.avast.com
11.83.69.200 rs31.avast.com
88.118.16.239 download32.avast.com
167.123.68.40 sl32.avast.com
123.209.107.96 rs32.avast.com
146.212.195.158 download33.avast.com
107.159.157.55 sl33.avast.com
6.33.3.65 rs33.avast.com
235.116.157.73 download34.avast.com
109.105.214.73 sl34.avast.com
48.104.58.212 rs34.avast.com
233.119.34.148 download35.avast.com
101.152.148.246 sl35.avast.com
205.88.101.36 rs35.avast.com
40.165.160.52 download36.avast.com
33.224.44.158 sl36.avast.com
10.51.168.244 rs36.avast.com
34.37.154.205 download37.avast.com
19.107.201.3 sl37.avast.com
191.1.231.30 rs37.avast.com
60.122.115.15 download38.avast.com
29.149.222.34 sl38.avast.com
244.16.237.46 rs38.avast.com
21.193.94.14 download39.avast.com
156.226.206.85 sl39.avast.com
177.173.218.62 rs39.avast.com
10.41.133.226 download40.avast.com
178.67.217.174 sl40.avast.com
9.32.210.19 rs40.avast.com
13.178.119.127 download41.avast.com
215.137.74.141 sl41.avast.com
104.236.226.121 rs41.avast.com
166.41.215.214 download42.avast.com
162.41.222.131 sl42.avast.com
28.71.53.219 rs42.avast.com
73.98.66.44 download43.avast.com
212.49.119.106 sl43.avast.com
34.215.120.37 rs43.avast.com
218.184.128.185 download44.avast.com
165.138.1.197 sl44.avast.com
50.175.138.222 rs44.avast.com
126.194.238.132 download45.avast.com
82.112.163.84 sl45.avast.com
13.137.104.128 rs45.avast.com
163.86.42.125 download46.avast.com
230.46.41.251 sl46.avast.com
4.68.87.26 rs46.avast.com
81.195.0.219 download47.avast.com
71.29.176.212 sl47.avast.com
203.159.82.41 rs47.avast.com
178.74.149.183 download48.avast.com
132.222.148.146 sl48.avast.com
128.55.181.178 rs48.avast.com
224.220.209.233 download49.avast.com
94.214.150.24 sl49.avast.com
246.190.42.163 rs49.avast.com
238.26.17.34 download50.avast.com
20.234.81.90 sl50.avast.com
71.125.212.107 rs50.avast.com
56.137.13.74 download51.avast.com
114.123.223.114 sl51.avast.com
152.12.186.215 rs51.avast.com
238.21.7.28 download52.avast.com
27.164.198.5 sl52.avast.com
46.79.117.47 rs52.avast.com
222.200.52.255 download53.avast.com
22.178.40.216 sl53.avast.com
177.179.29.145 rs53.avast.com
130.203.111.38 download54.avast.com
151.228.42.173 sl54.avast.com
190.170.112.140 rs54.avast.com
73.156.27.234 download55.avast.com
15.99.164.99 sl55.avast.com
179.99.68.0 rs55.avast.com
41.145.88.102 download56.avast.com
117.132.10.77 sl56.avast.com
182.206.46.52 rs56.avast.com
100.140.106.83 download57.avast.com
214.60.154.210 sl57.avast.com
7.207.114.56 rs57.avast.com
153.255.101.38 download58.avast.com
26.227.198.69 sl58.avast.com
135.193.46.125 rs58.avast.com
14.35.29.104 download59.avast.com
24.45.228.6 sl59.avast.com
135.45.194.178 rs59.avast.com
60.116.77.84 download60.avast.com
221.101.19.217 sl60.avast.com
213.203.130.224 rs60.avast.com
156.112.5.182 download61.avast.com
56.235.112.133 sl61.avast.com
4.185.158.200 rs61.avast.com
176.143.88.2 download62.avast.com
137.239.121.176 sl62.avast.com
250.250.80.124 rs62.avast.com
83.133.70.179 download63.avast.com
202.110.193.249 sl63.avast.com
192.48.72.60 rs63.avast.com
69.182.231.230 download64.avast.com
221.109.213.87 sl64.avast.com
132.157.84.146 rs64.avast.com
241.249.217.54 download65.avast.com
24.117.109.177 sl65.avast.com
242.87.83.176 rs65.avast.com
128.145.235.217 download66.avast.com
14.78.214.189 sl66.avast.com
181.203.91.8 rs66.avast.com
35.104.9.251 download67.avast.com
159.255.158.29 sl67.avast.com
71.116.40.45 rs67.avast.com
156.141.106.90 download68.avast.com
65.4.129.183 sl68.avast.com
0.219.200.233 rs68.avast.com
14.240.248.34 download69.avast.com
144.209.148.84 sl69.avast.com
93.209.132.158 rs69.avast.com
6.92.255.11 download70.avast.com
20.135.175.123 sl70.avast.com
144.235.16.225 rs70.avast.com
201.180.26.175 download71.avast.com
81.245.31.143 sl71.avast.com
73.63.246.84 rs71.avast.com
222.113.89.48 download72.avast.com
20.209.140.39 sl72.avast.com
195.92.63.195 rs72.avast.com
222.91.182.10 download73.avast.com
251.55.39.173 sl73.avast.com
16.142.100.130 rs73.avast.com
123.134.185.52 download74.avast.com
70.98.24.58 sl74.avast.com
168.83.115.5 rs74.avast.com
207.144.106.126 download75.avast.com
220.168.38.175 sl75.avast.com
48.23.133.192 rs75.avast.com
230.24.119.38 download76.avast.com
160.187.168.23 sl76.avast.com
135.55.95.65 rs76.avast.com
141.129.166.187 download77.avast.com
246.30.171.60 sl77.avast.com
22.53.102.139 rs77.avast.com
92.232.124.54 download78.avast.com
143.228.99.135 sl78.avast.com
88.55.199.180 rs78.avast.com
1.99.45.86 download79.avast.com
124.176.215.28 sl79.avast.com
167.198.231.193 rs79.avast.com
206.122.199.59 download80.avast.com
113.233.199.54 sl80.avast.com
72.195.8.192 rs80.avast.com
133.234.154.70 download81.avast.com
89.60.225.191 sl81.avast.com
185.172.61.39 rs81.avast.com
98.152.233.47 download82.avast.com
27.87.36.51 sl82.avast.com
58.17.143.108 rs82.avast.com
105.211.215.103 download83.avast.com
170.226.147.181 sl83.avast.com
153.80.112.229 rs83.avast.com
241.206.139.175 download84.avast.com
82.193.30.114 sl84.avast.com
66.152.95.225 rs84.avast.com
113.92.165.248 download85.avast.com
65.136.205.54 sl85.avast.com
133.28.220.6 rs85.avast.com
137.237.229.126 download86.avast.com
84.63.46.75 sl86.avast.com
41.149.142.236 rs86.avast.com
84.200.25.31 download87.avast.com
35.87.0.153 sl87.avast.com
50.254.178.250 rs87.avast.com
235.138.71.0 download88.avast.com
78.235.31.251 sl88.avast.com
238.139.198.129 rs88.avast.com
60.222.27.98 download89.avast.com
8.59.178.222 sl89.avast.com
69.234.118.22 rs89.avast.com
13.126.147.193 download90.avast.com
229.100.147.32 sl90.avast.com
65.189.198.52 rs90.avast.com
75.105.232.46 download91.avast.com
224.100.254.39 sl91.avast.com
219.86.129.17 rs91.avast.com
151.101.190.238 download92.avast.com
175.78.125.64 sl92.avast.com
8.180.225.192 rs92.avast.com
18.184.143.82 download93.avast.com
74.201.18.57 sl93.avast.com
4.189.127.135 rs93.avast.com
103.33.84.216 download94.avast.com
185.206.166.64 sl94.avast.com
221.189.124.130 rs94.avast.com
25.29.118.131 download95.avast.com
29.162.178.254 sl95.avast.com
65.31.239.120 rs95.avast.com
15.87.243.119 download96.avast.com
1.17.43.239 sl96.avast.com
139.106.146.253 rs96.avast.com
92.111.211.215 download97.avast.com
226.235.178.4 sl97.avast.com
12.126.168.200 rs97.avast.com
83.239.205.227 download98.avast.com
251.195.252.123 sl98.avast.com
150.15.49.86 rs98.avast.com
203.138.53.76 download99.avast.com
85.230.126.252 sl99.avast.com
78.97.80.191 rs99.avast.com
174.151.41.218 download100.avast.com
15.154.92.248 sl100.avast.com
179.68.252.215 rs100.avast.com
199.204.251.65 download101.avast.com
233.152.147.62 sl101.avast.com
233.82.229.136 rs101.avast.com
204.62.225.63 download102.avast.com
23.203.101.222 sl102.avast.com
74.104.169.110 rs102.avast.com
170.152.218.249 download103.avast.com
67.73.5.66 sl103.avast.com
46.98.55.179 rs103.avast.com
16.155.227.151 download104.avast.com
227.145.131.137 sl104.avast.com
249.26.130.44 rs104.avast.com
61.213.90.29 download105.avast.com
189.6.250.38 sl105.avast.com
101.161.106.181 rs105.avast.com
13.165.177.140 download106.avast.com
183.171.247.185 sl106.avast.com
17.191.231.201 rs106.avast.com
66.110.87.57 download107.avast.com
226.32.43.45 sl107.avast.com
74.169.118.100 rs107.avast.com
15.26.227.108 download108.avast.com
201.221.84.18 sl108.avast.com
25.1.200.29 rs108.avast.com
234.210.130.60 download109.avast.com
246.173.104.60 sl109.avast.com
140.18.169.126 rs109.avast.com
145.251.162.169 download110.avast.com
198.108.3.156 sl110.avast.com
72.76.45.167 rs110.avast.com
93.115.223.250 download111.avast.com
109.4.18.93 sl111.avast.com
79.253.33.34 rs111.avast.com
199.12.45.88 download112.avast.com
76.165.192.66 sl112.avast.com
14.81.176.8 rs112.avast.com
55.73.71.171 download113.avast.com
113.67.160.62 sl113.avast.com
169.140.84.84 rs113.avast.com
19.87.87.181 download114.avast.com
111.85.28.85 sl114.avast.com
138.133.0.134 rs114.avast.com
7.78.229.108 download115.avast.com
95.203.29.177 sl115.avast.com
39.102.139.123 rs115.avast.com
146.168.4.155 download116.avast.com
54.79.251.8 sl116.avast.com
19.161.94.139 rs116.avast.com
209.1.187.187 download117.avast.com
73.192.167.44 sl117.avast.com
71.53.96.228 rs117.avast.com
142.16.177.14 download118.avast.com
29.235.22.243 sl118.avast.com
177.34.33.37 rs118.avast.com
139.229.28.253 download119.avast.com
115.139.240.72 sl119.avast.com
253.41.70.62 rs119.avast.com
11.100.235.180 download120.avast.com
147.131.121.146 sl120.avast.com
163.201.52.134 rs120.avast.com
162.1.50.250 download121.avast.com
216.90.191.68 sl121.avast.com
49.117.255.29 rs121.avast.com
61.189.213.85 download122.avast.com
124.247.4.197 sl122.avast.com
217.25.148.132 rs122.avast.com
116.96.120.94 download123.avast.com
164.157.109.129 sl123.avast.com
61.208.37.122 rs123.avast.com
14.247.165.96 download124.avast.com
174.40.236.79 sl124.avast.com
121.222.213.24 rs124.avast.com
213.145.62.55 download125.avast.com
186.137.106.6 sl125.avast.com
113.243.164.48 rs125.avast.com
155.53.37.103 download126.avast.com
118.127.56.90 sl126.avast.com
92.162.156.225 rs126.avast.com
140.38.42.123 download127.avast.com
45.150.183.251 sl127.avast.com
144.31.60.126 rs127.avast.com
182.90.53.160 download128.avast.com
18.101.70.240 sl128.avast.com
143.56.36.161 rs128.avast.com
213.54.179.130 download129.avast.com
200.3.108.48 sl129.avast.com
82.150.2.137 rs129.avast.com
99.143.69.101 download130.avast.com
54.202.70.129 sl130.avast.com
213.52.188.188 rs130.avast.com
223.221.166.134 download131.avast.com
137.79.50.149 sl131.avast.com
227.31.222.217 rs131.avast.com
93.193.221.179 download132.avast.com
137.160.188.98 sl132.avast.com
34.110.69.190 rs132.avast.com
78.185.164.40 download133.avast.com
32.192.200.193 sl133.avast.com
97.132.12.218 rs133.avast.com
144.34.23.172 download134.avast.com
39.95.0.73 sl134.avast.com
32.133.182.211 rs134.avast.com
184.110.160.236 download135.avast.com
115.222.128.109 sl135.avast.com
96.22.157.91 rs135.avast.com
158.165.33.23 download136.avast.com
31.130.192.212 sl136.avast.com
172.88.154.78 rs136.avast.com
41.33.99.186 download137.avast.com
27.246.193.248 sl137.avast.com
103.37.245.16 rs137.avast.com
92.133.190.220 download138.avast.com
244.6.122.2 sl138.avast.com
87.140.143.38 rs138.avast.com
161.254.9.93 download139.avast.com
229.153.133.228 sl139.avast.com
114.139.77.18 rs139.avast.com
85.189.196.139 download140.avast.com
31.240.5.183 sl140.avast.com
232.11.199.114 rs140.avast.com
147.179.132.5 download141.avast.com
84.29.218.85 sl141.avast.com
112.32.49.91 rs141.avast.com
68.143.158.212 download142.avast.com
137.197.7.58 sl142.avast.com
214.129.136.242 rs142.avast.com
102.245.22.199 download143.avast.com
28.25.98.151 sl143.avast.com
196.69.0.76 rs143.avast.com
156.255.201.14 download144.avast.com
19.18.126.184 sl144.avast.com
208.224.174.136 rs144.avast.com
246.248.217.26 download145.avast.com
167.235.213.151 sl145.avast.com
199.92.113.42 rs145.avast.com
2.87.89.179 download146.avast.com
16.228.57.192 sl146.avast.com
55.219.37.185 rs146.avast.com
18.249.57.90 download147.avast.com
146.52.124.102 sl147.avast.com
66.76.10.154 rs147.avast.com
207.163.115.224 download148.avast.com
199.78.94.198 sl148.avast.com
161.108.114.46 rs148.avast.com
254.182.118.71 download149.avast.com
46.88.182.188 sl149.avast.com
246.0.169.43 rs149.avast.com
144.52.210.216 download150.avast.com
244.232.228.163 sl150.avast.com
86.80.41.55 rs150.avast.com
240.243.36.133 download151.avast.com
1.1.118.113 sl151.avast.com
22.230.254.202 rs151.avast.com
136.31.68.128 download152.avast.com
70.76.24.17 sl152.avast.com
212.135.118.69 rs152.avast.com
148.245.173.27 download153.avast.com
69.154.192.3 sl153.avast.com
201.114.13.77 rs153.avast.com
43.189.44.226 download154.avast.com
224.154.26.50 sl154.avast.com
77.215.151.109 rs154.avast.com
138.8.204.246 download155.avast.com
注： %System32% 是一个可变路径。病毒通过查询操作系统来决定当前 System文件夹的
位置。
%Windir% WINDODWS所在目录
%DriveLetter% 逻辑驱动器根目录
%ProgramFiles% 系统程序默认安装目录
%HomeDrive% 当前启动的系统的所在分区
%Documents and Settings% 当前用户文档根目录
%Temp% \Documents and Settings
\当前用户\Local Settings\Temp
%System32% 系统的 System32文件夹
Windows2000/NT中默认的安装路径是C:\Winnt\System32
windows95/98/me中默认的安装路径是C:\Windows\System
windowsXP中默认的安装路径是C:\Windows\System32
|
|
|
| 清除方案： |
| |
1 、使用安天木马防线可彻底清除此病毒 ( 推荐 )
2 、手工清除请按照行为分析删除对应文件，恢复相关系统设置。
(1)使用安天木马防线“进程管理”关闭病毒进程：
wndrivs32.exe
关闭系统进程explorer.exe，并重启explorer.exe进程
(2)删除病毒文件：
%system32%\mshtmldat32.exe
%system32%\sdrivew32.exe
%system32%\winlgcvers.exe
%system32%\wndrivs32.exe
(3)恢复病毒修改的注册表项目，删除病毒添加的注册表项。
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
\Windows NT\CurrentVersion\Winlogon\
键值: 字串: 0022Windows Sys"
="explorer.exe mshtmldat32.exe"
|
| 附： |
| |
点击此处下载木马防线2005+
 病毒上报信箱: submit@virusview.net |
|
