文件名称: GR.PIF
文件大小: 12036 bytes
MD5: eb92f0f76fdf5316c193cef1f56c2238
加壳: WinUpack
编写语言: N/A
病毒名: kaspersky: Worm.Win32.AutoRun.otv
rising: Worm.Win32.DownLoad.iz
duba: Win32.TrojDownloader.RessdxT.uk.253952
详细资料:
文件变化:
释放文件
%SystemRoot%system32wanifts.dll
c:temp.temp
替换系统文件
%SystemRoot%system32wuauclt.exe
%SystemRoot%system32dllcachewuauclt.exe
%SystemRoot%system32Driversbeep.sys
各分区根目录释放
X:GR.PIF
X:AUTORUN.INF
autorun.inf 内容:
[AutoRun] shellopen=打开(&O) shellopenCommand=GR.PIF shellopenDefault=1
shellexplore=
资源管理器(&X) shellexplorecommand=GR.PIF
注册表变动:
病毒创建启动项
[HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesexplorerrun]
"internetnet"="%SystemRoot%system32wuauclt.exe"
修改注册表项禁用"显示所有文件和文件夹:
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHidde
nSHOWALL]
"CheckedValue"=dword:00000002
删除注册表项破坏"安全模式"
[HKLMSystemCurrentControlSetControlSafeBootMinimal{4D36E967-E325-11CE-BFC1-
08002BE10318}]
[HKLMSystemCurrentControlSetControlSafeBootNetwork{4D36E967-E325-11CE-BFC1-
08002BE10318}]
其他行为:
通过 cacls.exe 命令修改下列文件访问控制权限
%SystemRoot%system32packet.dll
%SystemRoot%system32pthreadVC.dll
%SystemRoot%system32wpcap.dll
%SystemRoot%system32driversnpf.sys
%SystemRoot%system32npptools.dll
%SystemRoot%system32driversacpidisk.sys
%SystemRoot%system32wanpacket.dll
c:Documents and SettingsAll Users「开始」菜单程序启动
调用ie访问 58.53.128.146 下载病毒..
病毒修改系统年份:
2004
创建 Image File Execution Options 劫持安全相关程序,当被劫持程序运行,实际运行的是病毒主程序.
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
Options360rpt.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
Options360safe.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
Options360safebox.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
Options360tray.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsANTIARP.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsArSwp.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsAst.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsAutoRun.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsAutoRunKiller.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsAvMonitor.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsAVP.COM]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsAVP.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsCCenter.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsFrameworkservice.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsGFUpd.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsGuardField.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsHijackThis.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsIceSword.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsIparmor.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsKASARP.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsKAVPFW.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
Optionskavstart.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
Optionskmailmon.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsKRegEx.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsKVMonxp.KXP]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsKVSrvXP.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsKVWSC.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
Optionskwatch.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsMmsk.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
Optionsmsconfig.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsNavapsvc.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
Optionsnod32krn.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsNod32kui.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsPFW.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsQQDoctor.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsRAV.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsRavStub.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsRegedit.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
Optionsrfwmain.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsrfwProxy.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
Optionsrfwsrv.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
Optionsrfwstub.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsRSTray.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsRuniep.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionssafeboxTray.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsSREngLdr.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsTrojanDetector.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsTrojanwall.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsTrojDie.KXP]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsVPC32.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsVPTRAY.EXE]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution
OptionsWOPTILITIES.EXE]
清除方法:
1. 下载 IceSword(冰刃),解压 运行冰刃
2. 文件(冰刃界面左上)-设置,勾上 禁止进线程创建 和 禁止协议功能
3. 冰刃=>进程=>结束下列进程 wuauclt.exe 和 GR.PIF 进程=>关闭冰刃
4. 下载本帖附件=>解压=>运行 killgr.bat
5. 重启计算机
6. 下载System Repair Engineer （点击下载）
解压=>运行=>系统修复=>高级修复=>修复安全模式
7. 修改系统时间
8. 从相同的操作系统中拷贝下列系统文件,复制到相同位置
%SystemRoot%system32wuauclt.exe
%SystemRoot%system32dllcachewuauclt.exe
%SystemRoot%system32Driversbeep.sys
备注: 本处理方法不能清除病毒联网下载的病毒.
killgr.bathttp://www.mopery.cn/tools/killgr.rar