新AV终结者采用ring3级hook技术对抗杀毒软件
截获最新的AV终结者，该变种采用ring3级hook技术直接删除杀毒软件，劫持众多网站，阻止杀毒软件更新。专杀程序紧张制作中，测试通过会及时发布，老版本AV终结者专杀运行后会自动升级。以下是详细分析报告：
病毒名：Win32.Troj.AvKiller.hd.212992
病毒利用WH_CALLWNDPROC类型的挂钩将自身注入其他进程
**释放文件**
C:\WINDOWS\system32\nfxphzn.jbt 该文件为kernel32.dll的拷贝
c:\WINDOWS\system32\yqia.btl 该文件为病毒自身的拷贝
**下载文件**
w3.hao5555.com/v3/pic.bmp
w3.hao5555.com/v3/Riched32.dll
w3.hao5555.com/v3/search.asp
w3.hao5555.com/bd.dll
**修改的注册表**
"xphz"="{1b5f93d7-93d7-0a4e-4e82-93d71b5f93d7}"
@="C:\\WINDOWS\\system32\\yqia.btl""ThreadingModel"="Apartment"
"DisableCMD"=dword:00000001
**挂接函数**
RegEnumValueA
RegEnumValueW -- 目的为隐藏病毒添加的注册表键值
CreateFileA
CreateFileW -- 目的为保护病毒释放的文件
**卸载组件**
regsvr32.exe /u /s wshom.ocx
病毒自身通过nfxphzn.jbt来调用CreateFileA和CreateFileW函数，病毒注入系统的其他进程后
(1)创建一个线程来保护其添加的注册表键值不被删除；
(2)结束杀毒软件进程；
(3)通过将ZwCreateFile的前两个字节填0加以破坏；
(4)并试图删除以下文件，（主要是杀毒软件和流氓软件清除工具的驱动、程序文件）
"mmskskin.dll"
"KKClean.dll"
"VirUnk.def"
"AntiActi.dll"
"Rsaupd.exe"
"Iereset.dll"
"Libclsid.dat"
"KNetWch.SYS"
"CleanHis.dll"
"WoptiClean.sys"
"kakalib.def"
"libdll.dat"
"kkinst.ini"
"KASearch.DLL"
"KAVBootC.sys"
"Ras.exe"
"iehelp.exe"
"trojandetector.exe"
"KAConfig.DLL"
"KAVPassp.DLL"
"hsfw.dll"
**修改hosts文件为**
hosts文件被修改后，会影响很多杀毒软件和反流氓软件的升级，影响访问相关网站
（注意一下61.152.244.167这个IP，下面发现众多流量很高的站点被劫持到61.152.244.167，可以尝试一下在IE地址栏中输入这个IP，你发现去了cn.yahoo.com）
127.0.0.1 localhost
61.152.244.167 search.114.vnet.cn
61.152.244.167 auto.search.msn.com
61.152.244.167 search.msn.com
61.152.244.167 cnweb.search.live.com
61.152.244.167 search.live.com
61.152.244.167 www.hao123.com
61.152.244.167 hao123.com
61.152.244.167 www.360safe.com
61.152.244.167 360safe.com
222.73.126.115 update.360safe.com
61.152.244.167 dl.360safe.com
61.152.244.167 bbs.360safe.com
61.152.244.167 www.btbaicai.com
61.152.244.167 btbaicai.com
61.152.244.167 www.pctutu.com
61.152.244.167 www.7322.com
61.152.244.167 www.5566.net
61.152.244.167 www.9991.com
61.152.244.167 9991.com
61.152.244.167 forum.ikaka.com
61.152.244.167 www.ikaka.com
222.73.126.115 update.ikaka.com
61.152.244.167 forum.jiangmin.com
222.73.126.115 update.jiangmin.com
61.152.244.167 post.baidu.com
222.73.126.115 update.rising.com.cn
61.152.244.167 online.rising.com.cn
222.73.126.115 center.rising.com.cn
61.152.244.167 up.duba.net
61.152.244.167 shadu.baidu.com
61.152.244.167 security.symantec.com
61.152.244.167 shadu.duba.net
61.152.244.167 online.jiangmin.com
61.152.244.167 cn.mcafee.com
61.152.244.167 www.ahn.com.cn
61.152.244.167 www.kaspersky.com.cn
61.152.244.167 www.pcav.cn
61.152.244.167 mopery.hits.io
61.152.244.167 www.luosoft.com
61.152.244.167 luosoft.com
61.152.244.167 www.im286.com
61.152.244.167 bbs.htmlman.net
61.152.244.167 10000.286er.com
61.152.244.167 im286.net
61.152.244.167 cool.47555.com
61.152.244.167 ju.qihoo.com
61.152.244.167 bbs.chinaz.com
222.73.126.115 dnl-cn1.kaspersky-labs.com
222.73.126.115 dnl-cn2.kaspersky-labs.com
222.73.126.115 dnl-cn3.kaspersky-labs.com
222.73.126.115 dnl-cn4.kaspersky-labs.com
222.73.126.115 dnl-cn5.kaspersky-labs.com
222.73.126.115 dnl-cn6.kaspersky-labs.com
222.73.126.115 dnl-cn7.kaspersky-labs.com
222.73.126.115 dnl-cn8.kaspersky-labs.com
222.73.126.115 dnl-cn9.kaspersky-labs.com
222.73.126.115 dnl-cn10.kaspersky-labs.com
222.73.126.115 dnl-cn11.kaspersky-labs.com
222.73.126.115 dnl-cn12.kaspersky-labs.com
222.73.126.115 dnl-cn13.kaspersky-labs.com
222.73.126.115 dnl-cn14.kaspersky-labs.com
222.73.126.115 dnl-cn15.kaspersky-labs.com
222.73.126.115 dnl-eu1.kaspersky-labs.com
222.73.126.115 dnl-eu2.kaspersky-labs.com
222.73.126.115 dnl-eu3.kaspersky-labs.com
222.73.126.115 dnl-eu4.kaspersky-labs.com
222.73.126.115 dnl-eu5.kaspersky-labs.com
222.73.126.115 dnl-eu6.kaspersky-labs.com
222.73.126.115 dnl-eu7.kaspersky-labs.com
222.73.126.115 dnl-eu8.kaspersky-labs.com
222.73.126.115 dnl-eu9.kaspersky-labs.com
222.73.126.115 dnl-eu10.kaspersky-labs.com
222.73.126.115 dnl-eu11.kaspersky-labs.com
222.73.126.115 dnl-eu12.kaspersky-labs.com
222.73.126.115 dnl-eu13.kaspersky-labs.com
222.73.126.115 dnl-eu14.kaspersky-labs.com
222.73.126.115 dnl-eu15.kaspersky-labs.com
222.73.126.115 dnl-us1.kaspersky-labs.com
222.73.126.115 dnl-us2.kaspersky-labs.com
222.73.126.115 dnl-us3.kaspersky-labs.com
222.73.126.115 dnl-us4.kaspersky-labs.com
222.73.126.115 dnl-us5.kaspersky-labs.com
222.73.126.115 dnl-us6.kaspersky-labs.com
222.73.126.115 dnl-us7.kaspersky-labs.com
222.73.126.115 dnl-us8.kaspersky-labs.com
222.73.126.115 dnl-us9.kaspersky-labs.com
222.73.126.115 dnl-us10.kaspersky-labs.com
222.73.126.115 dnl-us11.kaspersky-labs.com
222.73.126.115 dnl-us12.kaspersky-labs.com
222.73.126.115 dnl-us13.kaspersky-labs.com
222.73.126.115 dnl-us14.kaspersky-labs.com
222.73.126.115 dnl-us15.kaspersky-labs.com
222.73.126.115 dnl-ru1.kaspersky-labs.com
222.73.126.115 dnl-ru2.kaspersky-labs.com
222.73.126.115 dnl-ru3.kaspersky-labs.com
222.73.126.115 dnl-ru4.kaspersky-labs.com
222.73.126.115 dnl-ru5.kaspersky-labs.com
222.73.126.115 dnl-ru6.kaspersky-labs.com
222.73.126.115 dnl-ru7.kaspersky-labs.com
222.73.126.115 dnl-ru8.kaspersky-labs.com
222.73.126.115 dnl-ru9.kaspersky-labs.com
222.73.126.115 dnl-ru10.kaspersky-labs.com
222.73.126.115 dnl-ru11.kaspersky-labs.com
222.73.126.115 dnl-ru12.kaspersky-labs.com
222.73.126.115 dnl-ru13.kaspersky-labs.com
222.73.126.115 dnl-ru14.kaspersky-labs.com
222.73.126.115 dnl-ru15.kaspersky-labs.com
222.73.126.115 dnl-jp1.kaspersky-labs.com
222.73.126.115 dnl-jp2.kaspersky-labs.com
222.73.126.115 dnl-jp3.kaspersky-labs.com
222.73.126.115 dnl-jp4.kaspersky-labs.com
222.73.126.115 dnl-jp5.kaspersky-labs.com
222.73.126.115 dnl-jp6.kaspersky-labs.com
222.73.126.115 dnl-jp7.kaspersky-labs.com
222.73.126.115 dnl-jp8.kaspersky-labs.com
222.73.126.115 dnl-jp9.kaspersky-labs.com
222.73.126.115 dnl-jp10.kaspersky-labs.com
222.73.126.115 dnl-jp11.kaspersky-labs.com
222.73.126.115 dnl-jp12.kaspersky-labs.com
222.73.126.115 dnl-jp13.kaspersky-labs.com
222.73.126.115 dnl-jp14.kaspersky-labs.com
222.73.126.115 dnl-jp15.kaspersky-labs.com
222.73.126.115 dnl-kr1.kaspersky-labs.com
222.73.126.115 dnl-kr2.kaspersky-labs.com
222.73.126.115 dnl-kr3.kaspersky-labs.com
222.73.126.115 dnl-kr4.kaspersky-labs.com
222.73.126.115 dnl-kr5.kaspersky-labs.com
222.73.126.115 dnl-kr6.kaspersky-labs.com
222.73.126.115 dnl-kr7.kaspersky-labs.com
222.73.126.115 dnl-kr8.kaspersky-labs.com
222.73.126.115 dnl-kr9.kaspersky-labs.com
222.73.126.115 dnl-kr10.kaspersky-labs.com
222.73.126.115 dnl-kr11.kaspersky-labs.com
222.73.126.115 dnl-kr12.kaspersky-labs.com
222.73.126.115 dnl-kr13.kaspersky-labs.com
222.73.126.115 dnl-kr14.kaspersky-labs.com
222.73.126.115 dnl-kr15.kaspersky-labs.com
222.73.126.115 dnl-cd1.kaspersky-labs.com
222.73.126.115 dnl-cd2.kaspersky-labs.com
222.73.126.115 dnl-cd3.kaspersky-labs.com
222.73.126.115 dnl-cd4.kaspersky-labs.com
222.73.126.115 dnl-cd10.kaspersky-labs.com
61.152.244.167 search.cn.yahoo.com
61.152.244.167 www.google.com
61.152.244.167 google.com
61.152.244.167 www.google.cn
61.152.244.167 www.sogou.com
61.152.244.167 www.yahoo.com.cn
61.152.244.167 cn.yahoo.com
222.73.210.148 www.comewz.com
61.152.244.167 search.tom.com
61.152.244.167 sou.china.com
61.152.244.167 toolsbar.kuaiso.com
61.152.244.167 www.kuaiso.com :o 看不太懂。。 对于一些病毒的预警是很好的，但是如果只说病毒的确发病症状而不说些解决措施也许等于白说，毕竟大家只关注病毒是怎么查杀的而不是怎么发作的
页:
[1]