安全响应·Security
|
Trojan-Downloader.Win32.Agent.hfo分析
出处：安天病毒分析组 时间：2008-03-04 10：30
 病毒标签： |
|
病毒名称：
Trojan-Downloader.Win32.Agent.hfo
病毒类型： 木马类
文件 MD5： EB3F2CD4BA9F29E1820FBB2E76F3E078
公开范围： 完全公开
危害等级： 3
文件长度： 23,552 字节
感染系统： Windows98以上版本
开发工具： Microsoft Visual C++ 6.0
加壳类型： Upack 0.3.9 beta2s |
| 病毒描述： |
|
该病毒为木马类，病毒运行后复制自身到系统目录。该病毒为下载型木马，
首先读取下载列表，然后依照下载列表进行文件下载。下载完成后下载的病毒
文件在本机运行，会占用大量系统资源而且盗取用户的敏感信息。
|
| 行为分析： |
|
本地行为：
1、文件运行后会衍生以下文件：
%System32%\drivers\ntfs.dll 28,727 字节
%System32%\userinit.exe
（替换原有系统userinit.exe文件） 23,552 字节
2、系统文件userinit.exe被替换，因此系统原有启动项被病毒利用，以加载病毒体：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
\Windows NT\CurrentVersion\Winlogon]
注册表值："Userinit"
类型： REG_SZ
值： "C:\WINDOWS\system32\userinit.exe,"
描述：加载病毒体
3、该病毒尝试关闭360安全卫士主程序进程360Safe.exe，上报模块进程
360rpt.exe和ARP功能模块进程AntiArp.exe。以使360安全卫士检测
不到此病毒信息。
4、病毒进程userinit.exe启动后，将病毒衍生文件ntfs.dll注入到系统
打印服务进程spoolsv.exe中，以spoolsv.exe进程连接网络下载其它
病毒。
5、病毒下载网址列表：
http://219.152.120.***/m/001.exe
http://219.152.120.***/m/002.exe
http://219.152.120.***/m/003.exe
http://219.152.120.***/m/004.exe
http://219.152.120.***/m/005.exe
http://219.152.120.***/m/006.exe
http://219.152.120.***/m/007.exe
http://219.152.120.***/m/008.exe
http://219.152.120.***/m/009.exe
http://219.152.120.***/m/10.exe
http://219.152.120.***/m/11.exe
http://219.152.120.***/m/12.exe
http://219.152.120.***/m/13.exe
http://219.152.120.***/m/14.exe
http://219.152.120.***/m/15.exe
http://219.152.120.***/m/16.exe
http://219.152.120.***/m/17.exe
http://219.152.120.***/m/18.exe
http://219.152.120.**/m/19.exe
http://219.152.120.**/m/20.exe
http://219.152.120.**/m/21.exe
http://219.152.120.**/m/22.exe
http://219.152.120.**/m/23.exe
http://219.152.120.**/m/24.exe
http://219.152.120.**/m/25.exe
http://219.152.120.***/f.exe
http://219.152.120.***/k.exe
http://219.152.120.***/a.exe
http://219.152.120.***/d.exe
http://219.152.120.***/m/001.exe
http://219.152.120.***/m/002.exe
http://219.152.120.***/m/003.exe
http://219.152.120.***/m/004.exe
http://219.152.120.***/m/005.exe
http://219.152.120.***/m/006.exe
http://219.152.120.***/m/007.exe
http://219.152.120.***/m/008.exe
http://219.152.120.***/m/009.exe
http://219.152.120.***/m/10.exe
http://219.152.120.***/m/11.exe
http://219.152.120.***/m/12.exe
http://219.152.120.***/m/13.exe
http://219.152.120.***/m/14.exe
http://219.152.120.***/m/15.exe
http://219.152.120.***/m/16.exe
http://219.152.120.***/m/17.exe
http://219.152.120.***/m/18.exe
http://219.152.120.**/m/19.exe
http://219.152.120.**/m/20.exe
http://219.152.120.**/m/21.exe
http://219.152.120.**/m/22.exe
http://219.152.120.**/m/23.exe
http://219.152.120.**/m/24.exe
http://219.152.120.**/m/25.exe
http://219.152.120.***/f.exe
http://219.152.120.***/k.exe
http://219.152.120.***/a.exe
http://219.152.120.***/d.exe
6、下载后运行得到的衍生文件：
%Program Files%\Internet Explorer\PLUGINS\Ns_Sys55.Sys
%Program Files%\Internet Explorer\PLUGINS\Nv_Win3s.Jmp
%Windir%\124327MM.DLL
%Windir%\cmdbcs.exe
%Windir%\DbgHlp32.exe
%Windir%\Kvsc3.exE
%Windir%\PTSShell.exe
%System32%\cmdbcs.dll
%System32%\DbgHlp32.dlL
%System32%\drivers\001.txt
%System32%\drivers\002.txt
%System32%\drivers\003.txt
%System32%\drivers\005.txt
%System32%\drivers\006.txt
%System32%\drivers\007.txt
%System32%\drivers\008.txt
%System32%\drivers\009.exe
%System32%\drivers\009.txt
%System32%\drivers\11.txt
%System32%\drivers\12.txt
%System32%\drivers\13.txt
%System32%\drivers\14.txt
%System32%\drivers\15.txt
%System32%\drivers\16.txt
%System32%\drivers\17.exe
%System32%\drivers\17.txt
%System32%\drivers\18.txt
%System32%\drivers\19.exe
%System32%\drivers\19.txt
%System32%\drivers\20.exe
%System32%\drivers\20.txt
%System32%\drivers\21.exe
%System32%\drivers\21.txt
%System32%\drivers\22.txt
%System32%\drivers\23.txt
%System32%\drivers\24.txt
%System32%\drivers\25.txt
%System32%\drivers\a.txt
%System32%\drivers\d.txt
%System32%\drivers\f.exe
%System32%\drivers\f.txt
%System32%\drivers\k.exe
%System32%\drivers\k.txt
%System32%\drivers\ntfs.dll
%System32%\drivers\pop.sys
%System32%\drivers\svchost.exe
%System32%\fBABBAB1035.dll
%System32%\fBABBAB1035.exe
%System32%\fCBDCBD1033.dll
%System32%\fCBDCBD1033.exe
%System32%\ffDAADAA1042.dll
%System32%\ffDAADAA1042.exe
%System32%\ffHADHAD1043.dll
%System32%\ffHADHAD1043.exe
%System32%\ffKADKAD1039.dll
%System32%\ffKADKAD1039.exe
%System32%\ffTQQTQQ1007.dll
%System32%\ffTQQTQQ1007.exe
%System32%\fIGBWD1043.dll
%System32%\fIGBWD1043.exe
%System32%\fJACJAC1041.dll
%System32%\fJACJAC1041.exe
%System32%\fNNBNNB1030.dll
%System32%\fNNBNNB1030.exe
%System32%\hfrdzx.dll
%System32%\HHHCompress.dll
%System32%\Kvsc3.dll
%System32%\lyjtenwwow.dll
%System32%\PTSShell.dll
%System32%\scvhost.exe
%System32%\sgrefg.dll
%System32%\upxdnd.dll
%System32%\WSockDrv32.dll
%System32%\wyrsdj.dll
%System32%\zjydcx.dll
%Windir%\upxdnd.exe
%Windir%\WSockDrv32.exe
注： %System32% 是一个可变路径。病毒通过查询操作系统来决定当前 System文件夹的
位置。
%Windir% WINDODWS所在目录
%DriveLetter% 逻辑驱动器根目录
%ProgramFiles% 系统程序默认安装目录
%HomeDrive% 当前启动的系统的所在分区
%Documents and Settings% 当前用户文档根目录
%Temp% \Documents and Settings
\当前用户\Local Settings\Temp
%System32% 系统的 System32文件夹
Windows2000/NT中默认的安装路径是C:\Winnt\System32
windows95/98/me中默认的安装路径是C:\Windows\System
windowsXP中默认的安装路径是C:\Windows\System32
|
|
|
| 清除方案： |
| |
1 、使用安天防线2008可彻底清除此病毒(推荐)，
请到安天网站下载：www.antiy.com 。
2 、手工清除请按照行为分析删除对应文件，恢复相关系统设置。
(1)使用安天木马防线或ATool中的“进程管理”关闭病毒进程。
(2)强行删除病毒文件：
%System32%\drivers\ntfs.dll
%System32%\userinit.exe
%Program Files%\Internet Explorer
\PLUGINS\Ns_Sys55.Sys
%Program Files%\Internet Explorer
\PLUGINS\Nv_Win3s.Jmp
%Windir%\124327MM.DLL
%Windir%\cmdbcs.exe
%Windir%\DbgHlp32.exe
%Windir%\Kvsc3.exE
%Windir%\PTSShell.exe
%System32%\cmdbcs.dll
%System32%\DbgHlp32.dlL
%System32%\drivers\001.txt
%System32%\drivers\002.txt
%System32%\drivers\003.txt
%System32%\drivers\005.txt
%System32%\drivers\006.txt
%System32%\drivers\007.txt
%System32%\drivers\008.txt
%System32%\drivers\009.exe
%System32%\drivers\009.txt
%System32%\drivers\11.txt
%System32%\drivers\12.txt
%System32%\drivers\13.txt
%System32%\drivers\14.txt
%System32%\drivers\15.txt
%System32%\drivers\16.txt
%System32%\drivers\17.exe
%System32%\drivers\17.txt
%System32%\drivers\18.txt
%System32%\drivers\19.exe
%System32%\drivers\19.txt
%System32%\drivers\20.exe
%System32%\drivers\20.txt
%System32%\drivers\21.exe
%System32%\drivers\21.txt
%System32%\drivers\22.txt
%System32%\drivers\23.txt
%System32%\drivers\24.txt
%System32%\drivers\25.txt
%System32%\drivers\a.txt
%System32%\drivers\d.txt
%System32%\drivers\f.exe
%System32%\drivers\f.txt
%System32%\drivers\k.exe
%System32%\drivers\k.txt
%System32%\drivers\ntfs.dll
%System32%\drivers\pop.sys
%System32%\drivers\svchost.exe
%System32%\fBABBAB1035.dll
%System32%\fBABBAB1035.exe
%System32%\fCBDCBD1033.dll
%System32%\fCBDCBD1033.exe
%System32%\ffDAADAA1042.dll
%System32%\ffDAADAA1042.exe
%System32%\ffHADHAD1043.dll
%System32%\ffHADHAD1043.exe
%System32%\ffKADKAD1039.dll
%System32%\ffKADKAD1039.exe
%System32%\ffTQQTQQ1007.dll
%System32%\ffTQQTQQ1007.exe
%System32%\fIGBWD1043.dll
%System32%\fIGBWD1043.exe
%System32%\fJACJAC1041.dll
%System32%\fJACJAC1041.exe
%System32%\fNNBNNB1030.dll
%System32%\fNNBNNB1030.exe
%System32%\hfrdzx.dll
%System32%\HHHCompress.dll
%System32%\Kvsc3.dll
%System32%\lyjtenwwow.dll
%System32%\PTSShell.dll
%System32%\scvhost.exe
%System32%\sgrefg.dll
%System32%\upxdnd.dll
%System32%\WSockDrv32.dll
%System32%\wyrsdj.dll
%System32%\zjydcx.dll
%Windir%\upxdnd.exe
%Windir%\WSockDrv32.exe
(3)下载系统文件userinit.exe，复制到%System32%目录下。
(4) 清空浏览器的下载临时文件夹，以删除下载的存留病毒体。
|
| 附： |
| |
点击此处下载安天防线2008
 病毒上报信箱: submit@virusview.net |
|
