Win32.Troj.QQRobber.b

病毒名称

Win32.Troj.QQRobber.b

处理时间

2006⑴2-08 要挟级别：★

病毒类型：木马 影响系统：Win 9x/ME,Win 2000/NT,Win XP,Win 2003

病毒行动

:

具体行动

1、病毒拷贝本身到系统目录下，并设置为隐藏。

%SystemRoot%\system32\NTdHcP.exe

2、删除QQ保护文件npkcrypt.sys，并保存为npkcrypt.bak文件。

D:\Program Files\Tencent\QQ\npkcrypt.sys

3、添加注册表启动项

HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run

"NTdhcp" = "%SystemRoot%\system32\NTdhcp.exe"

4、安装了1个类型为WH_JOURNALRECORD的 消息钩子，记录连续的鼠标和键盘事件。

其申请进程为：%SystemRoot%\system32\NTdHcP.exe

5、将以下服务启动全设置为制止启动,并结束其进程。

HKLM\SYSTEM\CurrentControlSet\Services\navapsvc\Start

HKLM\SYSTEM\CurrentControlSet\Services\RsRavMon\Start

HKLM\SYSTEM\CurrentControlSet\Services\RsCCenter\Start

HKLM\SYSTEM\CurrentControlSet\Services\kavsvc\Start

HKLM\SYSTEM\CurrentControlSet\Services\KVSrvXP\Start

HKLM\SYSTEM\CurrentControlSet\Services\KVWSC\Start

HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\Start

HKLM\SYSTEM\CurrentControlSet\Services\KPfwSvc\Start

HKLM\SYSTEM\CurrentControlSet\Services\KWatchSvc\Start

HKLM\SYSTEM\CurrentControlSet\Services\SNDSrvc\Start

HKLM\SYSTEM\CurrentControlSet\Services\ccProxy\Start

HKLM\SYSTEM\CurrentControlSet\Services\ccEvtMgr\Start

HKLM\SYSTEM\CurrentControlSet\Services\ccSetMgr\Start

HKLM\SYSTEM\CurrentControlSet\Services\SPBBCSvc\Start

HKLM\SYSTEM\CurrentControlSet\Services\Symantec Core LC\Start

HKLM\SYSTEM\CurrentControlSet\Services\NPFMntor\Start

HKLM\SYSTEM\CurrentControlSet\Services\MskService\Start

HKLM\SYSTEM\CurrentControlSet\Services\FireSvc\Start

HKLM\SYSTEM\CurrentControlSet\Services\McShield\Start

HKLM\SYSTEM\CurrentControlSet\Services\McTaskManager\Start

HKLM\SYSTEM\CurrentControlSet\Services\McAfeeFramework\Start

HKLM\SYSTEM\CurrentControlSet\Services\RfwService\Start

7、尝试删除以下启动项,并结束其进程。

HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\RavMon

HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\KAVPersonal50

HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\RavTimer

HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\RavTask HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\KvMonXP HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\iDuba Personal FireWall HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\KAVRun HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\KpopMon HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\Kulansyn HKCU\SoftWare\Microsoft\Windows\CurrentVersion\Run\iDuba Personal FireWall HKCU\SoftWare\Microsoft\Windows\CurrentVersion\Run\KavPFW

HKCU\SoftWare\Microsoft\Windows\CurrentVersion\Run\KvXP NOTFOUND

HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\ccApp HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\SSC_UserPrompt HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\NAV CfgWiz HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\MCAgentExe HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\McRegWiz HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\MCUpdateExe HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\MSKAGENTEXE HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\MSKDetectorExe HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\VirusScan Online HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\VSOCheckTask HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\McAfeeUpdaterUI HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\Network Associates Error HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\ShStatEXE HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\VSOCheckTask HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\KavStart HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\RfwMain HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\SonudMan HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run\KvPpWall_autorun

8、生成并运行Deleteme.bat 批处理文件，实现自删除。