Ò»¡¢Èç¹ûÄúµÄϵͳÌáʾ"ÕÒ²»µ½ff_vfw.dll"»ò"ff_vfw.dllȱʧ" »òÕß"ff_vfw.dll´íÎó"µÈµÈ£¬Çë²»Óõ£ÐÄ£¬Çë°Ñff_vfw.dllÏÂÔص½±¾»ú¡£

¶þ¡¢Ö±½Ó¿½±´¸ÃÎļþµ½ÏµÍ³Ä¿Â¼À

¡¡¡¡ 1¡¢Windows 95/98/Meϵͳ£¬½«ff_vfw.dll¸´ÖƵ½C:WindowsSystemĿ¼Ï¡£

¡¡¡¡ 2¡¢Windows NT/2000ϵͳ£¬½«ff_vfw.dll¸´ÖƵ½C:WINNTSystem32Ŀ¼Ï¡£

¡¡¡¡ 3¡¢Windows XP/WIN7ϵͳ£¬½«ff_vfw.dll¸´ÖƵ½C:WindowsSystem32Ŀ¼Ï¡£

Èý¡¢È»ºó´ò¿ª"¿ªÊ¼-ÔËÐÐ-ÊäÈëregsvr32 ff_vfw.dll"£¬»Ø³µ¼´¿É½â¾ö´íÎóÌáʾ£¡Ï£Íû¶àÌØÈí¼þվΪÄúÌṩµÄff_vfw.dll¶ÔÄúÓÐËù°ïÖú£¡

Ò»¡¢worm.win32.download.gbb

ÎļþÃû³Æ£ºniu.exe

Îļþ´óС£º30625 bytes

AVÃüÃû£ºVirus.Win32.AutoRun.of(Kaspersky)

¼Ó¿Ç·½Ê½£ºFSG

±àдÓïÑÔ£ºDelphi

²¡¶¾ÀàÐÍ£ºUÅ̲¡¶¾\ÏÂÔØÕß

ÎļþMD5£ºe9612843c037fe7b62ded850bf4689c1

´«²¥·½Ê½£ºUÅ̵ÈÒƶ¯½éÖÊ\Íøҳ©¶´¡£

ÐÐΪ·ÖÎö£º

1¡¢ÊͷŲ¡¶¾¸±±¾£º

%Systemroot%\system32\crsss.exe 30625×Ö½Ú£¨×¢ÒâÇø±ð£¬²»ÊÇϵͳÎļþ£¡£©

²¢²éÕÒ¿ÉÓõĴÅÅÌ£¬ÔÚÆäĿ¼Éú³É£ºNIu.exeºÍAutorun.inf¡£

2¡¢ÊÍ·ÅP´¦Àí£¬¿ªÆô×Ô¶¯²¥·Å£¿

net start shellHWDetection

3¡¢Á¬½Ó60.175.150.1**£¨°²»ÕÊ¡³üÖÝÊеçÐÅIDC»ú·¿£©ÏÂÔØľÂí¡£

ÏÂÁËÒ»´ó¶Ñ¡£¡£¡£:

µÁºÅľÂíÆ·ÖÖÓУºÈÈѪ½­ºþ\ÖïÏÉ\ÍêÃÀÊÀ½ç\´ó»°Î÷ÓÎ\ÃλÃÎ÷ÓÎ\»úÕ½

»¹´øÓÐARP²¡¶¾¡£¡£¡£

4¡¢³¢ÊÔÐÞ¸ÄIEÖ÷Ò³£¬²»¹ý²âÊÔʱ²¢Î´ÊµÏÖ£¬¸üеØÖ·Á¬½Ó£º

¿´ÁËÏ£¬Êǰٶȵġ£

5¡¢ÊÍ·ÅP´¦Àí£¬³¢ÊÔдÈë×¢²á±íIFEO¼üÖµ£¬²»¹ý²âÊÔʱ²¢Î´ÊµÏÖ¡£¡£¡£

Èç¹û³É¹¦µÄ»°£¬ÒÔϽø³Ì»á±»½Ù³Ö£º

REG.exe

360rpt.exe

360Safe.exe

360tray.exe

adam.exe

AgentSvr.exe

AppSvc32.exe

AST.exe

autoruns.exe

avgrssvc.exe

AvMonitor.exe

avp.exe

CCenter.exe

ccSvcHst.exe

FileDsty.exe

HijackThis.exe

FTCleanerShell.exe

IceSword.exe

iparmo.exe

Iparmor.exe

isPwdSvc.exe

kabaload.exe

KASMain.exe

KASTask.exe

KAV32.exe

KAVDX.exe

KAVPFW.exe

KAVSetup.exe

KAVStart.exe

KISLnchr.exe

KMailMon.exe

KMFilter.exe

KPFW32.exe

KPFW32X.exe

KPFWSvc.exe

KRegEx.exe

KsLoader.exe

KvDetect.exe

KvfwMcl.exe

kvol.exe

kvolself.exe

KVSrvXP.exe

kvupload.exe

kvwsc.exe

KWatch.exe

KWatch9x.exe

KWatchX.exe

loaddll.exe

MagicSet.exe

mcconsol.exe

mmqczj.exe

mmsk.exe

NAVSetup.exe

PFW.exe

PFWLiveUpdate.exe

QHSET.exe

Ras.exe

Rav.exe

RavMon.exe

RavMonD.exe

SysSafe.exe

TrojanDetector.exe

symlcsvc.exe

SREng.exe

SmartUp.exe

shcfg32.exe

scan32.exe

safelive.exe

runiep.exe

Rsaupd.exe

RsAgent.exe

rfwsrv.exe

RfwMain.exe

rfwcfg.exe

RegClean.exe

rfwProxy.exe

RavTask.exe

RavStub.exe

Trojanwall.exe

UIHost.exe

UmxAgent.exe

UmxAttachment.exe

UmxCfg.exe

UmxFwHlp.exe

UmxPol.exe

UpLive.EXE.exe

WoptiClean.exe

zxsweep.exe

regedit.exe

msconfig.exe

mmc.exe

taskmgr.exe

6¡¢³¢ÊԹرմ°¿ÚµÄһЩ¡°Ãô¸Ð×Ö¡±£¬Á¬½Ó¸üÐÂÁбí

±£´æÖÁ%Systemroot%\system32\test1.txt¡£

ÏÖÓÐÁÐ±í£º

ľÂí

²¡¶¾

360

ÈðÐÇ

¿¨°É

½ðɽ

¶¾°Ô

½­Ãû£¨×÷Õß×Ô¼º´ò´íÁË£¬º¹£©

¿ÉÄܵ¼ÖÂһЩ³ÌÐò»òä¯ÀÀµÄÍøÒ³»á±»¹Ø±Õ¡£

7¡¢±éÀú´ÅÅÌ£¬²éÕÒ*htm¡¢INDEX.PHP¡¢DEFAULT.PHP¡¢CONN.ASPµÈÍøÒ³Îļþ£¬²åÈëÒ»¶ÎJS´úÂ룺

{IfrAmE src= width=0 height=0}{/IfrAmE}

8¡¢²éÕÒÓ²ÅÌÎļþ£¬ÓÐÓöµ½*.GHOµÄÔòɾ³ý¡£

¿ÉÄܵ¼ÖÂÎÞ·¨Ê¹ÓÃGHOST»¹Ô­¡£

9¡¢ÊÍ·ÅÒ»¸öP´¦Àí£¬³¢ÊÔ°Ñcrsss.exeдÈë×¢²á±íÆô¶¯Ï²»¹ý»¹ÊÇûÓÐʵÏÖ``=¡£=

10¡¢³¢ÊÔÐÞ¸Ä×¢²á±í£¬Ê¹¡°ÏµÍ³ÏÔʾÒþ²ØÎļþ¹¦ÄÜʧЧ¡±¡£Ê¹¸Ã¹¦ÄÜÑ¡Ïî³É£º

ÇÝÊÞÉÐÓÐһ˿Á¯Ãõ,ÎÒ²»ÊÇÇÝÊÞ,ËùÒÔÎÒûÓÐÁ¯Ãõ¡£

²âÊÔʱºòÈÔȻûÓÐʵÏÖ¡£¡£

²¢ÊÔͼɾ³ý°²È«Ä£Ê½Ò»Ð©¼üÖµ£¬Ò²Ã»Óгɹ¦¡£

11¡¢»¹ÊÇÐÞ¸Ä×¢²á±í£¬½ûÓÃϵͳ×Ô¶¯¸üкͷÀ»ðǽ¡£

¼üÖµ£ºNoAutoUpdateÓëEnableFirewall¡£

12¡¢Ã¿¼¸ºÁÃëΪÖÜÆÚ·ÃÎÊϵͳ¿ÉÓõĴÅÅÌ£¬Èç·¢ÏÖNIu.exeºÍAutorun.inf²»ÔÚÔòÖØд¡£

ͬʱҲʵÏÖÁËUÅ̸ÐȾ¡£

½â¾ö·½·¨£º

1¡¢ÏÂÔØ£º

ͼƬµã»÷¿ÉÔÚд°¿Ú´ò¿ª²é¿´ÐÞ¸´IFEOÖ®XPϵͳרÓÃ.rar 72KB

ͼƬµã»÷¿ÉÔÚд°¿Ú´ò¿ª²é¿´sreng2.5.zip 780KB

ͼƬµã»÷¿ÉÔÚд°¿Ú´ò¿ª²é¿´PowerRmv.com 101KB

ͼƬµã»÷¿ÉÔÚд°¿Ú´ò¿ª²é¿´ÏÔʾÒþ²ØÎļþ.reg 9KB

2¡¢¶Ï¿ªÍøÂ磬¹Ø±Õ²»ÐèÒªµÄ½ø³Ì¡£ÒÔϲ½ÖèÒª°´Ë³Ðò¡£

3¡¢ÖØÆôµçÄÔ£¬°´F8½øÈ밲ȫģʽ£¬Èç¹û½ø²»Á˵Ļ°£¬¾ÍÕý³£Ä£Ê½°É£¡

4¡¢´ò¿ªÈÎÎñ¹ÜÀíÆ÷£¬Èç¹û´ò¿ª²»µÄ»°£¬ÔËÐÐÄǸö¡°ÐÞ¸ÄIFEOÖ®XPϵͳרÓᱡ£

5¡¢´ò¿ªÈÎÎñ¹ÜÀíÆ÷£¬¹Ø±Õcrsss.exe½ø³Ì¡£

6¡¢´ò¿ªPowerRmv£¬Ñ¡ÉÏÒÖÖÆɱÃð¶ÔÏóÔÙ´ÎÉú³É£¬ÌîÈëÏÂÃæ·¾¶£º£¨×¢Òâ²»Òª°üº¬¿Õ¸ô£©

C:\autorun.inf

C:\niu.exe

D:\autorun.inf

D:\niu.exe

E:\autorun.inf

E:\niu.exe

F:\autorun.inf

F:\niu.exe

X:\autorun.inf

X:\niu.exe

C:\Windows\system32\crsss.exe

XΪÒƶ¯ÅÌ.

ºÃÁË£¬Ö÷Ì嶼ÏûÃðÁË£¬»¹ÓÐľÂíȺ£¬»¹ÊÇʹÓÃPowerRmv£¬¼ÌÐøÌîÈë,Ò»´ÎÒ»¸ö£º

ÏÓÂé·³µÄÈ¥ÏÂÔØXdelbox¡£°ÑÏÂÁз¾¶µ¼Èë¡£

C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Jmp

C:\Program Files\Internet Explorer\PLUGINS\SysWin74.Jmp

C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys

C:\Program Files\Internet Explorer\PLUGINS\WinSys74.Sys

C:\Program Files\winp\actv.ini

C:\Program Files\winp\code.dll

C:\Program Files\winp\lexi.lex

C:\Program Files\winp\play.dll

C:\Program Files\winp\snet.dll

C:\Program Files\winp\stdi.ini

C:\Program Files\winp\stdl.ini

C:\Program Files\winp\stub.dll

C:\Program Files\winp\upme.ini

C:\Program Files\winp\vote.dll

C:\Windows\upxdnd.exe

C:\Windows\Fonts\ardaase.fon

C:\Windows\Fonts\armease.fon

C:\Windows\Fonts\chqiaur.fon

C:\Windows\Fonts\chreaur.fon

C:\Windows\Fonts\chtiaur.fon

C:\Windows\Fonts\enweafx.fon

C:\Windows\Fonts\gejiand.fon

C:\Windows\Fonts\msguasd.fon

C:\Windows\Fonts\mszhasd.fon

C:\Windows\system32\0svchsot.exe

C:\Windows\system32\13temp.exe

C:\Windows\system32\17temp.exe

C:\Windows\system32\18temp.exe

C:\Windows\system32\19temp.exe

C:\Windows\system32\1svchsot.exe

C:\Windows\system32\21temp.exe

C:\Windows\system32\2svchsot.exe

C:\Windows\system32\4temp.exe

C:\Windows\system32\8kJk1g.dll

C:\Windows\system32\Autorun.inf

C:\Windows\system32\avpcq.dll

C:\Windows\system32\avpdj.dll

C:\Windows\system32\avpms.dll

C:\Windows\system32\avwgain.dll

C:\Windows\system32\avwgcmn.dll

C:\Windows\system32\avwgcst.exe

C:\Windows\system32\avzxain.dll

C:\Windows\system32\avzxbmn.dll

C:\Windows\system32\avzxbst.exe

C:\Windows\system32\c.txtC:\Windows\system32\d.txt

C:\Windows\system32\dpserio1.dll

C:\Windows\system32\h1.dll

C:\Windows\system32\jshelp.exe

C:\Windows\system32\jsshow.dll

C:\Windows\system32\kawdacs.dll

C:\Windows\system32\kawdbaz.exe

C:\Windows\system32\kawdbzy.dll

C:\Windows\system32\kvdxacf.dll

C:\Windows\system32\kvdxcis.exe

C:\Windows\system32\kvdxcma.dll

C:\Windows\system32\kvmxacf.dll

C:\Windows\system32\kvmxdis.exe

C:\Windows\system32\kvmxdma.dll

C:\Windows\system32\msavp.dll

C:\Windows\system32\mscomm.dll

C:\Windows\system32\nz4iek.dll

C:\Windows\system32\playasp.exe

C:\Windows\system32\raqjani.dll

C:\Windows\system32\raqjapi.dll

C:\Windows\system32\raqjatl.exe

C:\Windows\system32\rarjani.dll

C:\Windows\system32\rarjbpi.dll

C:\Windows\system32\rarjbtl.exe

C:\Windows\system32\ratbani.dll

C:\Windows\system32\ratbdpi.dll

C:\Windows\system32\ratbdtl.exe

C:\Windows\system32\rsjzafg.dll

C:\Windows\system32\rsjzbpm.dll

C:\Windows\system32\rsjzbsp.exe

C:\Windows\system32\test1.txt

C:\Windows\system32\upxdnd.dll

C:\Windows\system32\wxpSetup170.exe

C:\Windows\system32\xyupri0.dll

C:\Windows\system32\drivers\486who07g.sys

C:\Windows\system32\drivers\jshelp.sys

C:\Windows\system32\drivers\jsshow.drv

C:\Windows\system32\drivers\jsshow.sys

C:\Windows\system32\drivers\nnf5v.sys

C:\Windows\system32\drivers\scvhost.exe

C:\Windows\system32\drivers\svchost.exe

C:\Windows\system32\wbem\mopsll32.dll

6¡¢ÖØÆôϵͳ£¬´ò¿ªSREng,ɾ³ý£º

×¢²á±í

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

{upxdnd}{C:\winnt\upxdnd.exe} []

{KVP}{C:\winnt\system32\drivers\svchost.exe} []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\

ShellExecuteHooks]

{{4D47B341-43DF-4563-753F-345FFA3157D4}}{C:\winnt\system32\kvmxdma.dll} []

{{3C87A354-ABC3-DEDE-FF33-3213FD7447C3}}{C:\winnt\system32\kvdxcma.dll} []

{{3A1247C1-53DA-FF43-ABD3-345F323A48D3}}{C:\winnt\system32\avwgcmn.dll} []

{{46650011-3344-6688-4899-345FABCD1564}}{C:\winnt\system32\ratbdpi.dll} []

{{14783410-4F90-34A0-7820-3230ACD05F41}}{C:\winnt\system32\raqjapi.dll} []

{{22FAACDE-34DA-CCD4-AB4D-DA34485A3422}}{C:\winnt\system32\rsjzbpm.dll} []

{{2859245F-345D-BC13-AC4F-145D47DA34F2}}{C:\winnt\system32\avzxbmn.dll} []

{{28907901-1416-3389-9981-372178569982}}{C:\winnt\system32\kawdbzy.dll} []

{{2598FF45-DA60-F48A-BC43-10AC47853D52}}{C:\winnt\system32\rarjbpi.dll} []

{{E3F426F6-8634-42A5-A29E-BC694A88FB7D}}{C:\winnt\system32\xyupri0.dll} []

{{1AB09B3F-A6D0-4B55-B87D-264934EBEAED}}{C:\Program Files\Internet Explorer\PLUGINS\WinSys74.Sys} []

{{5D83AD9C-3BFC-43F5-979D-2904DBC54A8E}}{C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys} []

·þÎñ£º

[Windows svcs RunThem/ svcs][Stopped/Auto Start]

{C:\winnt\System32\svchost.exe-k netsvcs--}C:\PROGRA~1\winp\snet.dll}{}

[ServiceJsHelp/ ServiceJsHelp][Running/Auto Start]

{C:\winnt\system32\playasp.exe}{}

Çý¶¯£º

[nnf5v/ nnf5v][Running/Auto Start]

{\??\C:\winnt\system32\drivers\nnf5v.sys}{N/A}

[486who07g/ 486who07g][Running/Boot Start]

{\SystemRoot\System32\DRIVERS\486who07g.sys}{N/A}

£¨¿ÉÄÜÃû×Ö²»Ò»Ñù¡££©

7¡¢SREng£¬±à¼­×¢²á±í£¬×¢Òâ²»ÊÇɾ³ý£º

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

{shell}{Explorer.exe jshelp.exe} []

Õâ¸öSRENG»á×Ô¶¯ÐÞ¸´£¬Èç¹ûûÓÐÐÞ¸´µÄ»°£¬°ÑºóÃæjshelp.exeÈ¥µô£¬³É£º

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

{shell}{Explorer.exe} []

»¹ÓÐÕâ¸ö£º

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

{AppInit_DLLs}{rarjbpi.dll} []

Öÿգ¬³É£º

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

{AppInit_DLLs}{} []

8¡¢°ÑÏÂÔصŤ¾ßµ¼È룬ÐÞ¸´ÏÔʾÒþ²ØÏî¡£Èç¹û°²È«Ä£Ê½±»ÆÆ»µµÄ£¬ÓÃSRENGÐÞ¸´``

9¡¢»¹ÓÐÄÇЩ±»²å´úÂëµÄÍøÒ³£¬È¥ÎÒÍøÅÌÏÂÔØÇå³ý£º

iframekill.rar 212KB

Ó÷¨ºÜ¼òµ¥£¬¾Í²»·Ñ»°ÁË¡£

10¡¢Èç¹û·À»ðǽºÍ×Ô¶¯¸üб»½ûÓÃÁ˵Ļ°£¬´ò¿ª×¢²á±í£¬É¾³ý£º

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AUϵģº

NoAutoUpdateºÍAUOptions¼üÖµ¡£

»¹ÓУº

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\

StandardProfile

µÄEnableFirewall¼ü¡£

11¡¢ÐÞ¸ÄQQ¡¢ÍøÓεÈÃÜÂë¡£

¶þ¡¢¿ª»úÌáʾc:/windows/system32/ff_vfw.dll³ö´í

Öйý¶¾»òÕßûÓÐÕý³£Ð¶ÔØÈí¼þ°É£¿

ϵͳÖвÐÁôµÃÆô¶¯ÏîÄ¿

È¥µô¸ÃÆô¶¯ÏîÄ¿

¾ßÌåµÄ·½·¨È¥

1..ʹÓÃʹÓÃÅäÖÃÏʼ£­ÔËÐУ­msconfig£­Æô¶¯Ñ¡ÏÕÒµ½¼üֵΪ»ò°üº¬

c:/windows/system32/ff_vfw.dll

µÄÄÇÒ»ÐУ¬½«Ç°±ßµÄ¶Ô¹¹È¥µô£¬ÖØÆô»úÆ÷

2..Ò²¿ÉÒÔͨ¹ýÔÚ×¢²á±íÖÐɾ³ýÏàÓ¦µÄ¼üÀ´´ïµ½ÏàÓ¦µÄÄ¿µÄ·½·¨£º¿ªÊ¼£­ÔËÐУ­regedit£­È·¶¨´ò¿ª×¢²á±í±à¼­Æ÷

Ò»°ãÊÇÔÚÒ»ÏÂÁ½¸öλÖÃÏÂ

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

ÔÚÀï±ßÕÒµ½ÒÔc:/windows/system32/ff_vfw.dllΪ¼üÖµ»òÕß°üº¬

ff_vfw.dll¼üÓÒ¼üɾ³ý¾Í¿ÉÒÔÁË

Èç¹û¶Ô×¢²á±í²»ÊǺÜÊìϤ

½¨ÒéʹÓ÷½·¨Ò»

Â¥ÉϵÄ˵»°Óе㲻¸ºÔðÈΰ¡£¬ÖØÐÂ×öϵͳ¸üÂé·³¡£²»µ½ÆȲ»µÃÒÑÊDz»»áÓõ½ÕâÕеġ£

×£ÄãºÃÔË

csiaoyu