抓获Backdoor.Gpigeon.voo和Trojan.PSW.OnlineGames.xd等盗号木马

骑猪看日落 2024-02-17 13:55 106阅读 0赞

**endurer** 原创  
2007-05-08 第**1**版

一位朋友，说他的电脑最近运行很慢，让偶帮忙检修。

下载 pe\_xscan 扫描 log 并分析，发现如下可疑项：  
/---  
pe\_xscan 07-04-12 by Purple Endurer  
2007-5-8 12:12:51  
Windows XP Service Pack 2(5.1.2600)  
管理员用户组

O2 - BHO - \{8298D101-F992-43B7-8ECA-5052D885B996\} - C:/WINDOWS/system32/rs.bin

O4 - HKCR/../Run: \[3u\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/iexpl0re.exe  
O4 - HKCR/../Run: \[tuj\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/rundl132.exe  
O4 - HKCR/../Run: \[wc2imbevyfqu7g\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/winlog0n.exe

O4 - HKLM/../Run: \[mhsa\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/mhso.exe  
O4 - HKLM/../Run: \[ztsa\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/ztso.exe  
O4 - HKLM/../Run: \[rxsa\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/rxso.exe  
O4 - HKLM/../Run: \[wos3\] C:/WINDOWS/wos3.exe  
O4 - HKLM/../Run: \[wls3\] C:/WINDOWS/wls3.exe  
O4 - HKLM/../Run: \[wgs3\] C:/WINDOWS/wgs3.exe  
O4 - HKLM/../Run: \[wms3\] C:/WINDOWS/wms3.exe  
O4 - HKLM/../Run: \[jts3\] C:/WINDOWS/jts3.exe  
O4 - HKLM/../Run: \[qqs3\] C:/WINDOWS/qqs3.exe  
O4 - HKLM/../Run: \[mysa\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/myso.exe  
O4 - HKLM/../Run: \[qqsa\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/qqso.exe  
O4 - HKLM/../Run: \[hysa\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/hyso.exe  
O4 - HKLM/../Run: \[kernelmh\] C:/WINDOWS/Kernelmh.exe

O23 - 服务: ERSvc (Error Reporting Service) - C:/WINDOWS/System32/svchost.exe -k netsvcs -> C:/WINDOWS/system32/syst.dll | 2007-3-22 19:35:54(自动)

O24 - \[F\] - \{754FB7D8-B8FE-4810-B363-A788CD060F1F\} = F  
O24 - \[F\] - \{A6011F8F-A7F8-49AA-9ADA-49127D43138F\} = F  
O24 - \[C\] - \{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC\} = C  
O24 - \[\] - \{91B1E846-2BEF-4345-8848-7699C7C9935F\} = C:/Program Files/Common Files/Microsoft Shared/MSINFO/SysWFGQQ2.dll  
\---/

检查c:/windows 和 c:/windows/system32，一大堆的可疑文件，如：  
/---  
D:/tools/bat\_do>dir c:/windows/system32 /a /od  
驱动器 C 中的卷没有标签。  
卷的序列号是 40FB-AD0B

c:/windows/system32 的目录

(略)  
2007-03-22 19:25 70,413 dongdi.exe  
2007-03-22 19:35 256,000 syst.dll  
2007-03-22 19:35 256,000 sysi.dll  
2007-03-22 19:35 21,657 wanmei.exe  
2007-03-22 19:35 26,037 moyu.exe  
2007-03-22 19:35 70,413 chajian.exe  
2007-03-22 19:35 58,369 rs.bin  
2007-03-24 09:07 23,657 update.txt.exe  
2007-03-24 09:07 23,657 update.txt.bat  
2007-03-24 19:45 13,312 NTUP1.dll  
2007-03-27 11:42 17,408 WOW3.exe.bat  
2007-03-27 11:51 32 sinfo.ini  
2007-03-30 09:35 20,845 xy2.exe.bat  
2007-04-02 08:18 32,380 xy2ok.exe.bat  
2007-04-05 03:06 215,264 FNTCACHE.DAT  
2007-04-16 08:18 11,264 mutou.exe.exe  
2007-04-16 08:18 11,264 mutou.exe.bat  
2007-04-17 08:38 25,088 s159.exe.bat  
2007-04-18 12:52 24,086 szzy.exe.bat  
(略)  
\---/

到[http://purpleendurer.ys168.com][http_purpleendurer.ys168.com] 下载 FileInfo 和 bat\_do。用 FileInfo 提取了其中一些文件的信息。

文件说明符 : C:/WINDOWS/10Sy.exe  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-3-22 19:7:25  
修改时间 : 2007-3-24 8:42:40  
访问时间 : 2007-5-8 0:0:0  
大小 : 72568 字节 70.888 KB  
MD5 : 12b7b3d7773dcf24492e83ffcc34eb86

瑞星报为 **Trojan.PSW.QQhx.af**

文件说明符 : C:/WINDOWS/wms3.exe  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-3-26 10:10:30  
修改时间 : 2007-3-26 10:10:32  
访问时间 : 2007-5-8 0:0:0  
大小 : 69730 字节 68.98 KB  
MD5 : d39aa9d7c7448d126ca6cc8f54ce0a21

Kaspersky报为 **Trojan.Win32.Pakes**，瑞星报为 **Trojan.PSW.OnlineGames.xb**

文件说明符 : C:/WINDOWS/jts3.exe  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-3-26 10:10:32  
修改时间 : 2007-3-26 10:10:34  
访问时间 : 2007-5-8 0:0:0  
大小 : 69095 字节 67.487 KB  
MD5 : b009e2c68ad3be89fc97365769f50a3a

Kaspersky报为 **Trojan-PSW.Win32.OnLineGames.bs**，瑞星报为 **Trojan.PSW.OnlineGames.xd**

文件说明符 : C:/WINDOWS/system32/dongdi.exe  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-3-22 19:25:41  
修改时间 : 2007-3-22 19:25:42  
访问时间 : 2007-5-8 0:0:0  
大小 : 70413 字节 68.781 KB  
MD5 : c95ddf24696e51abcc08d83a44dba90b

Kaspersky报为 **not-a-virus:AdWare.Win32.Delf.g**，瑞星报为 **Trojan.DL.Bho.iv**

文件说明符 : C:/WINDOWS/system32/wanmei.exe  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-3-22 19:35:52  
修改时间 : 2007-3-22 19:35:54  
访问时间 : 2007-5-8 0:0:0  
大小 : 21657 字节 21.153 KB  
MD5 : 9c97cc090d9c87fcb797a212e12b327f

文件说明符 : C:/WINDOWS/system32/moyu.exe  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-3-22 19:35:53  
修改时间 : 2007-3-22 19:35:56  
访问时间 : 2007-5-8 0:0:0  
大小 : 26037 字节 25.437 KB  
MD5 : 434ebf20c6532f2fec71c208e53f42aa

文件说明符 : C:/WINDOWS/system32/rs.bin  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-3-22 19:25:42  
修改时间 : 2007-3-22 19:35:58  
访问时间 : 2007-5-8 0:0:0  
大小 : 58369 字节 57.1 KB  
MD5 : 536a919d0cc058c00a73cb1a3f266f12

文件说明符 : C:/WINDOWS/system32/chajian.exe  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-3-22 19:35:55  
修改时间 : 2007-3-22 19:35:58  
访问时间 : 2007-5-8 0:0:0  
大小 : 70413 字节 68.781 KB  
MD5 : c95ddf24696e51abcc08d83a44dba90b

Kaspersky报为 **not-a-virus:AdWare.Win32.Delf.g**，瑞星报为 **Trojan.DL.Bho.iv**

文件说明符 : C:/WINDOWS/system32/update.txt.exe  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-3-24 9:7:33  
修改时间 : 2007-3-24 9:7:34  
访问时间 : 2007-5-8 0:0:0  
大小 : 23657 字节 23.105 KB  
MD5 : c385ed2bc5ea41568892a4a0b6e5f0ab

瑞星报为 **Trojan.DL.Multi.whn**

文件说明符 : C:/WINDOWS/system32/update.txt.bat  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-3-24 9:7:33  
修改时间 : 2007-3-24 9:7:34  
访问时间 : 2007-5-8 0:0:0  
大小 : 23657 字节 23.105 KB  
MD5 : c385ed2bc5ea41568892a4a0b6e5f0ab

文件说明符 : C:/WINDOWS/system32/xy2.exe.bat  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-3-30 9:35:7  
修改时间 : 2007-3-30 9:35:8  
访问时间 : 2007-5-8 0:0:0  
大小 : 20845 字节 20.365 KB  
MD5 : c168697e596c7183ab28eee23e3ed73e

文件说明符 : C:/WINDOWS/system32/xy2ok.exe.bat  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-4-2 8:18:30  
修改时间 : 2007-4-2 8:18:32  
访问时间 : 2007-5-8 0:0:0  
大小 : 32380 字节 31.636 KB  
MD5 : c014040a36e1ae2c4294a18d24756c88

Kaspersky报为 **Backdoor.Win32.PcClient.za**，瑞星报为 **Backdoor.Gpigeon.voo**  
  
文件说明符 : C:/WINDOWS/system32/mutou.exe.exe  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-4-5 8:31:32  
修改时间 : 2007-4-16 8:18:46  
访问时间 : 2007-5-8 0:0:0  
大小 : 11264 字节 11.0 KB  
MD5 : 900c5ccc44a5f7a58952f4bdac0c7e5e

文件说明符 : C:/WINDOWS/system32/mutou.exe.bat  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-4-5 9:58:1  
修改时间 : 2007-4-16 8:18:48  
访问时间 : 2007-5-8 0:0:0  
大小 : 11264 字节 11.0 KB  
MD5 : 900c5ccc44a5f7a58952f4bdac0c7e5e

文件说明符 : C:/WINDOWS/system32/szzy.exe.bat  
属性 : A---  
获取文件版本信息大小失败!  
创建时间 : 2007-4-18 12:52:40  
修改时间 : 2007-4-18 12:52:42  
访问时间 : 2007-5-8 0:0:0  
大小 : 24086 字节 23.534 KB  
MD5 : 47c6c4411c19f9d3c8f321b9eb299dc1

用bat\_do将其中一部分打包备份。

下载Dr.Web CureIt扫描，结果如下：  
==========================  
Dr.Web(R) Scanner for Windows v4.33.2 (4.33.2.10067)  
Copyright (c) Igor Daniloff, 1992-2006  
Log generated on: 2007-05-08, 12:18:30 \[Administrator\]  
Operating system:Windows XP Professional x86 (Build 2600), Service Pack 2  
==========================  
c:/documents and settings/administrator/local settings/temp/hyso.exe infected with **Trojan.PWS.Wsgame** \- deleted  
c:/documents and settings/administrator/local settings/temp/mhso.exe infected with **Trojan.PWS.Wsgame** \- deleted  
c:/documents and settings/administrator/local settings/temp/myso.exe infected with **Trojan.PWS.Wsgame**\- deleted  
c:/documents and settings/administrator/local settings/temp/qqso.exe infected with **Trojan.PWS.Wsgame**\- deleted  
>c:/documents and settings/administrator/local settings/temp/rundl132.exe infected with **Trojan.PWS.Wsgame**\- deleted  
c:/documents and settings/administrator/local settings/temp/rxso.exe infected with **Trojan.PWS.Wsgame**\- deleted  
>c:/documents and settings/administrator/local settings/temp/winlog0n.exe infected with **Trojan.PWS.Wsgame**\- deleted  
c:/documents and settings/administrator/local settings/temp/ztso.exe infected with **Trojan.PWS.Wsgame**\- deleted  
c:/program files/common files/microsoft shared/msinfo/syswfgqq2.dll infected with **Trojan.PWS.Qqpass.623** \- deleted  
c:/windows/jts3.exe - read error  
>c:/windows/kernelmh.exe infected with **Trojan.PWS.Wow** \- deleted  
c:/windows/qqs3.exe infected with **Trojan.PWS.Wsgame**\- deleted  
c:/windows/wgs3.exe infected with **Trojan.PWS.Wsgame**\- deleted  
c:/windows/wls3.exe infected with **Trojan.PWS.Wsgame**\- deleted  
c:/windows/wms3.exe - read error  
c:/windows/wos3.exe infected with **Trojan.PWS.Wsgame**\- deleted  
C:/Documents and Settings/Administrator/Local Settings/Temp/mhso0.dll infected with **Trojan.PWS.Wsgame**\- will be cured after reboot  
C:/Documents and Settings/Administrator/Local Settings/Temp/ztso0.dll infected with **Trojan.PWS.Wsgame**\- will be cured after reboot  
C:/Documents and Settings/Administrator/Local Settings/Temp/rxso0.dll infected with **Trojan.PWS.Wsgame**\- will be cured after reboot  
C:/Documents and Settings/Administrator/Local Settings/Temp/wos0.dll infected with **Trojan.PWS.Wsgame**\- will be cured after reboot  
C:/Documents and Settings/Administrator/Local Settings/Temp/wls0.dll infected with **Trojan.PWS.Wsgame**\- will be cured after reboot  
C:/Documents and Settings/Administrator/Local Settings/Temp/iexpl0re.exe - read error  
C:/Documents and Settings/Administrator/Local Settings/Temp/wgs0.dll infected with **Trojan.PWS.Wsgame**\- will be cured after reboot  
C:/Documents and Settings/Administrator/Local Settings/Temp/qqso0.dll infected with **Trojan.PWS.Wsgame**\- will be cured after reboot  
C:/Documents and Settings/Administrator/Local Settings/Temp/hyso0.dll infected with **Trojan.PWS.Wsgame**\- will be cured after reboot  
>C:/Documents and Settings/Administrator/Local Settings/Temp/~Tm22.tmp.rom probably infected with **DLOADER.Trojan**  
C:/Documents and Settings/Administrator/Local Settings/Temp/~Tm23.tmp..rom infected with **Trojan.PWS.Wsgame**\- will be cured after reboot  
>C:/Program Files/Common Files/System/commond.pifC:/Program Files/Internet Explorer/WINLOGON.EXE infected with **Trojan.PWS.Wsgame**\- deleted  
C:/Program Files/Thunder Network/Thunder/Program/Ad/n1175509284861.swf infected with **Trojan.PWS.Wsgame**\- deleted  
>C:/WINDOWS/KB726255.logC:/WINDOWS/SMSS.EXE infected with **Trojan.PWS.Wsgame**\- deleted  
C:/WINDOWS/8Sy.exe infected with **Trojan.PWS.Wsgame**\- deleted  
C:/WINDOWS/9Sy.exe infected with **Trojan.PWS.Wsgame**\- deleted  
C:/WINDOWS/wms3.exe - read error  
C:/WINDOWS/jts3.exe - read error  
C:/WINDOWS/system32/sysi.dll probably infected with **DLOADER.Trojan**  
C:/WINDOWS/system32/syst.dll probably infected with **DLOADER.Trojan**  
>C:/WINDOWS/system32/moyu.exe>C:/WINDOWS/system32/fengyun.exe infected with **Trojan.PWS.Qqpass.503** \- deleted  
C:/WINDOWS/system32/chuanqi.exe infected with **Trojan.PWS.Lineage** \- deleted  
>C:/WINDOWS/system32/windowstools.exe infected with **Trojan.PWS.Gamania** \- deleted  
>C:/WINDOWS/system32/xy2.exe.bat>C:/WINDOWS/system32/xy2ok.exe.bat probably infected with **BACKDOOR.Trojan**  
C:/WINDOWS/system32/s159.exe.bat - read error  
>>C:/WINDOWS/system32/szzy.exe.bat probably infected with **DLOADER.Trojan**  
C:/WINDOWS/system32/WOW3.exe.bat - read error  
>C:/WINDOWS/system32/sl\_xy2.exe.bat infected with **Trojan.PWS.Wsgame**\- deleted  
>C:/WINDOWS/system32/sl\_my0324.exe.bat infected with **Trojan.PWS.Wsgame**\- deleted  
C:/WINDOWS/system32/feizhujixi.exe.bat infected with **Trojan.PWS.Wsgame**\- deleted  
>C:/WINDOWS/system32/sl\_wl0325.exe.bat infected with **Trojan.PWS.Wsgame**\- deleted

到 [http://endurer.ys168.com][http_endurer.ys168.com]下载 HijackThis，修复除O24以外的项目；下载 auto\_del下次启动时删除漏网的（添加待删文件时，如果提示“文件不存在或者是目录，是否添加？”时，点击“是”）。  
安装瑞星卡卡安全助手，卸载O24中的项目。

[http_purpleendurer.ys168.com]: http://purpleendurer.ys168.com
[http_endurer.ys168.com]: http://endurer.ys168.com