木马种植者
trojan-dropper.win32.startpage.sd
捕获时间
2010-10-07
危害等级
中
病毒症状
该样本是使用“delphi”编写的蠕虫程序，由微点主动防御软件自动捕获，采用“upx”加壳方式试图躲避特征码扫描,加壳后长度为“73,343”字节，图标为“”，病毒扩展名为“exe”，主要通过“文件捆绑”、“下载器下载”、“网页挂马”等方式传播，病毒主要目的是添加广告，修改ag旗舰厅首页主页，下载其他恶意程序。
用户中毒后，会出现安全软件无故关闭、桌面出现大量恶意图标、安全模式无法进入、系统无故报错等现象。
感染对象
windows 2000/windows xp/windows 2003/windows vista/ windows 7
传播途径
文件捆绑、网页挂马、下载器下载
防范措施
已安装使用微点主动防御软件的用户，无须任何设置，微点主动防御将自动保护您的系统免受该病毒的入侵和破坏。无论您是否已经升级到最新版本，微点主动防御都能够有效清除该病毒。如果您没有将微点主动防御软件升级到最新版，微点主动防御软件在发现该病毒后将报警提示您发现“未知间谍”，请直接选择删除处理（如图1）
图1 微点主动防御软件自动捕获未知病毒（未升级）
如果您已经将微点主动防御软件升级到最新版本，微点将报警提示您发现木马"trojan-dropper.win32.startpage.sd ”，请直接选择删除（如图2）。
图2 微点主动防御软件升级后截获已知病毒
未安装微点主动防御软件的手动解决办法：
1、结束病毒生成的explorer.exe进程
2、手动删除以下文件：
%programfiles%\common files\microsoft shared\explorer.exe
%documents and settings%\all users\桌面\intennet exploner.lnk
%documents and settings%\all users\桌面\改变你的一生.url
%documents and settings%\all users\桌面\淘宝购物a.url
%documents and settings%\all users\桌面\免费电影c.url
%systemdriver%\mfiles\winlogon.exe
%programfiles%\common files\uiui8.dll
%documents and settings%\all users\「开始」菜单\程序\启动\1681.lnk
3、手动删除以下注册表值：
hkey_classes_root\exefile
名称：nevershowext
数据：1
hkey_current_user\software\microsoft\windows\currentversion\policies\associations
名称：modriskfiletypes
数据：.exe
4、手动删除hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\下的所有映像劫持
5、将正常值导入到以下注册表项：
hkey_local_machine\system\currentcontrolset\control\safeboot\minimal\{4d36e967-e325-11ce-bfc1-08002be10318}
hkey_local_machine\system\currentcontrolset\control\safeboot\network\{4d36e967-e325-11ce-bfc1-08002be10318}
hkey_local_machine\system\controlset001\control\safeboot\minimal\{4d36e967-e325-11ce-bfc1-08002be10318}
hkey_local_machine\system\controlset001\control\safeboot\network\{4d36e967-e325-11ce-bfc1-08002be10318}
变量声明：
%systemdriver% 系统所在分区，通常为“c:\”
%systemroot% windodws所在目录，通常为“c:\windows”
%documents and settings% 用户文档目录，通常为“c:\documents and settings”
%temp% 临时文件夹，通常为“c:\documents and settings\当前用户名称\local settings\temp”
%programfiles% 系统程序默认安装目录，通常为：“c:\programfiles”
病毒分析
(1)木马获取系统目录，将自身复制为%programfiles%\common files\microsoft shared\explorer.exe。
(2)创建成功后，将其设置为系统隐藏，并运行该程序。
(3)explorer.exe创建名为“6e25f6cd59fa89b88b46a1674ff7333b”的互斥体以免重复运行。并新建程序%programfiles%\common files\uiui8.dll、
%systemdriver%\kefycv.txt（随机命名）、%systemdriver%\ofeuvq.jpg（随机命名）、%systemdriver%\pmerdc.bmp（随机命名）和%systemdriver%\qrhkvz.gif（随机命名）
(4)调用uiui8.dll文件，在全局范围内挂钩子，窃取用户隐私信息。
(5)将%systemdriver%\kefycv.txt、%systemdriver%\ofeuvq.jpg、%systemdriver%\pmerdc.bmp、%systemdriver%\qrhkvz.gif移动到桌面并分别重命名为：intennet exploner.lnk、改变你的一生.url、淘宝购物a.url、免费电影c.url，指向不同网址以散播广告。
(6)病毒将自身复制为%systemdriver%\mfiles\winlogon.exe。完成后在所有用户的开始目录下的自启动文件夹中创建快捷方式1681.lnk指向%systemdriver%\mfiles\winlogon.exe，以此实现开机启动。并且将%systemdriver%\mfiles，%systemdriver%\mfiles\winlogon.exe和%programfiles%\common files\的属性设置为系统隐藏。
(7)隐藏.exe文件的扩展名并且在运行可执行文件时不提示，对应注册表值为：
hkey_classes_root\exefile
名称：nevershowext
数据：1
hkey_current_user\software\microsoft\windows\currentversion\policies\associations
名称：modriskfiletypes
数据：.exe
(8)修改安全模式启动参数，使系统进入安全模式后无法读取磁盘，对应注册表项为：
hkey_local_machine\system\currentcontrolset\control\safeboot\minimal\{4d36e967-e325-11ce-bfc1-08002be10318}
hkey_local_machine\system\currentcontrolset\control\safeboot\network\{4d36e967-e325-11ce-bfc1-08002be10318}
hkey_local_machine\system\controlset001\control\safeboot\minimal\{4d36e967-e325-11ce-bfc1-08002be10318}
hkey_local_machine\system\controlset001\control\safeboot\network\{4d36e967-e325-11ce-bfc1-08002be10318}
(9)建立大量映像劫持以阻止安全软件或其他辅助工具的启动，相应注册表项为：
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\360rp.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\360rpt.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\360safe.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\360safebox.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\360sd.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\360tray.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\799d.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\adam.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\agentsvr.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\antiu.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\aoyun.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\appdllman.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\appsvc32.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\arswp.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\arswp2.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\arswp3.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ast.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\auto.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\autorun.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\autoruns.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\av.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avastu3.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avconsol.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avgrssvc.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avmonitor.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avp.com
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avp.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avu3launcher.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ccenter.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ccsvchst.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\cross.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\discovery.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\dsmain.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\eghost.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\filedsty.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\filmst.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ftcleanershell.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\fyfirewall.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ghost.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\guangd.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\hijackthis.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\icesword.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\iparmo.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\iparmor.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\irsetup.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ispwdsvc.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\jisu.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kabaload.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kascrscn.scr
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kasmain.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kastask.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kav32.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavdx.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavpf.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavpfw.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavsetup.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavstart.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kernelwind32.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kislnchr.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kissvc.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kmailmon.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kmfilter.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kpfw32.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kpfw32x.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kpfwsvc.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kregex.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\krepair.com
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ksloader.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvcenter.kxp
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvdetect.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvfwmcl.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvmonxp.kxp
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvmonxp_1.kxp
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvol.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvolself.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvreport.kxp
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvscan.kxp
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvsrvxp.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvstub.kxp
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvupload.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvwsc.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvxp.kxp
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvxp_1.kxp
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kwatch.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kwatch9x.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kwatchx.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\loaddll.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\logogo.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\magicset.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\mcconsol.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\mmqczj.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\mmsk.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\navapsvc.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\navapw32.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\navsetup.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\niu.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\nod32.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\nod32krn.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\nod32kui.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\npfmntor.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\pagefile.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\pagefile.pif
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\pfserver.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\pfw.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\pfwliveupdate.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qheart.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qhset.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qqdoctor.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qqdoctormain.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qqdoctorrtp.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qqkav.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qqsc.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qsetup.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ras.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rav.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ravcopy.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ravmon.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ravmond.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ravstub.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ravtask.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\regclean.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rfwcfg.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rfwmain.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rfwproxy.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rfwsrv.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rsagent.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rsaupd.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rsnetsvr.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rstray.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rstrui.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\runiep.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\safeboxtray.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\safelive.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\scan32.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\scanfrm.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\scanu3.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\sdgames.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\selfupdate.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\servet.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\shcfg32.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\smartup.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\sos.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\sreng.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\srengps.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\stormii.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\sxgame.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\symlcsvc.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\syssafe.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\tmp.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\tnt.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\trojandetector.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\trojanwall.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\trojdie.kxp
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\txomou.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ufo.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\uihost.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxagent.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxattachment.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxcfg.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxfwhlp.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxpol.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\upiea.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\uplive.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\usbcleaner.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\vsstat.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\wbapp.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\webscanx.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\wopticlean.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\wsyscheck.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\xdelbox.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\xp.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\zhudongfangyu.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\zjb.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\zxsweep.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\~.exe
病毒创建文件：
%programfiles%\common files\microsoft shared\explorer.exe
%systemdriver%\kefycv.txt（随机命名）
%systemdriver%\ofeuvq.jpg（随机命名）
%systemdriver%\pmerdc.bmp（随机命名）
%systemdriver%\qrhkvz.gif（随机命名）
%documents and settings%\all users\桌面\intennet exploner.lnk
%documents and settings%\all users\桌面\改变你的一生.url
%documents and settings%\all users\桌面\淘宝购物a.url
%documents and settings%\all users\桌面\免费电影c.url
%systemdriver%\mfiles\winlogon.exe
%programfiles%\common files\uiui8.dll
%documents and settings%\all users\「开始」菜单\程序\启动\1681.lnk
病毒删除文件：
%systemdriver%\kefycv.txt（随机命名）
%systemdriver%\ofeuvq.jpg（随机命名）
%systemdriver%\pmerdc.bmp（随机命名）
%systemdriver%\qrhkvz.gif（随机命名）
病毒创建注册表：
hkey_classes_root\exefile
名称：nevershowext
数据：1
hkey_current_user\software\microsoft\windows\currentversion\policies\associations
名称：modriskfiletypes
数据：.exe
hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\(所有映像劫持)
病毒删除注册表：
hkey_local_machine\system\currentcontrolset\control\safeboot\minimal\{4d36e967-e325-11ce-bfc1-08002be10318}
hkey_local_machine\system\currentcontrolset\control\safeboot\network\{4d36e967-e325-11ce-bfc1-08002be10318}
hkey_local_machine\system\controlset001\control\safeboot\minimal\{4d36e967-e325-11ce-bfc1-08002be10318}
hkey_local_machine\system\controlset001\control\safeboot\network\{4d36e967-e325-11ce-bfc1-08002be10318}
病毒访问网络：
http://www.dh***.com/?88
http://888.qq***3.com/
