木马下载者
trojan-downloader.win32.killav.bzd
捕获时间
2011-09-15
危害等级
中
病毒症状
该样本是使用“dephi”编写的下载器，由微点主动防御软件自动捕获，采用“upx”加壳方式试图躲避特征码扫描,加壳后长度为“33，263”字节，图标为“”，使用“exe”扩展名，通过移动存储介质、文件捆绑、网页挂马、下载器下载等方式进行传播。病毒主要目的是指引用户计算机到黑客指定的url地址去下载更多的病毒或木马后门文件并运行。
用户中毒后会出现一些软件和注册表打不开，出现许多未知进程，电脑运行缓慢等现象。
感染对象
windows 2000/windows xp/windows 2003/windows vista/ windows 7
传播途径
文件捆绑、网页挂马、下载器下载
防范措施
已安装使用微点主动防御软件的用户，无须任何设置，微点主动防御将自动保护您的系统免受该病毒的入侵和破坏。无论您是否已经升级到最新版本，微点主动防御都能够有效清除该病毒。如果您没有将微点主动防御软件升级到最新版，微点主动防御软件在发现该病毒后将报警提示您发现“未知木马”，请直接选择删除处理（如图1）
图1 微点主动防御软件自动捕获未知病毒（未升级）
如果您已经将微点主动防御软件升级到最新版本，微点将报警提示您发现木马"trojan-downloader.win32.killav.bzd”，请直接选择删除（如图2）。
图2 微点主动防御软件升级后截获已知病毒
未安装微点主动防御软件的手动解决办法：
手动删除以下文件：
%programfiles%\common files\heoifz.pif
%systemroot%\system32\（随机名）.dlu
%systemroot%\system\（随机名）.dzx
%systemroot%\temp\oau.ini
手动删除注册表项：
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\360rpt.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\360safe.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\360tray.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\adam.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\agentsvr.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\appsvc32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\arswp.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ast.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\autoruns.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avconsol.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avgrssvc.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avmonitor.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avp.com
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avp.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ccenter.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ccsvchst.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\eghost.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\filedsty.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ftcleanershell.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\fyfirewall.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\hijackthis.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\icesword.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\iparmo.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\iparmor.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ispwdsvc.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kabaload.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kascrscn.scr
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kasmain.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kastask.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kav32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavdx.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavpf.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavpfw.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavsetup.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavstart.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kislnchr.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kmailmon.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kmfilter.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kpfw32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kpfw32x.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kpfwsvc.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kregex.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\krepair.com
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ksloader.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvcenter.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvdetect.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvfwmcl.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvmonxp.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvmonxp_1.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvol.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvolself.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvreport.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvscan.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvsrvxp.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvstub.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvupload.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvwsc.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvxp.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvxp_1.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kwatch.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kwatch9x.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kwatchx.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\loaddll.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\magicset.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\mcconsol.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\mmqczj.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\mmsk.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\navapsvc.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\navapw32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\nod32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\nod32krn.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\nod32kui.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\npfmntor.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\pfw.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\pfwliveupdate.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qhset.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qqdoctor.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qqkav.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ras.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rav.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ravmon.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ravmond.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ravstub.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ravtask.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\regclean.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rfwcfg.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rfwmain.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rfwsrv.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rsagent.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rsaupd.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rstrui.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\runiep.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\safelive.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\scan32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\shcfg32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\smartup.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\sreng.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\symlcsvc.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\syssafe.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\trojandetector.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\trojanwall.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\trojdie.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\uihost.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxagent.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxattachment.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxcfg.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxfwhlp.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxpol.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\upiea.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\uplive.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\usbcleaner.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\vsstat.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\webscanx.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\wopticlean.exe
修改注册表项
hkey_classes_root\clsid\{e6fb5e20-de35-11cf-9c87-00aa005127ed}\inprocserver32的"（默认）"键值为"c:\windows\system32\webcheck.dll"
变量声明：
%systemdriver% 系统所在分区，通常为“c:\”
%systemroot% windodws所在目录，通常为“c:\windows”
%documents and settings% 用户文档目录，通常为“c:\documents and settings”
%temp% 临时文件夹，通常为“c:\documents and settings\当前用户名称\local settings\temp”
%programfiles% 系统程序默认安装目录，通常为：“c:\programfiles”
病毒分析：
1.创建名为"zodanon"的互斥变量，防止进程多次启动
2.获得"sedebugprivilege"权限，创建进程快照寻找"ekrn.exe"进程，找到则利用sc.exe删除ekrn服务，cmd命令结束"ekrn.exe"、"egui.exe"进程
3.在"%programfiles%\common files\"路径下创建"realteck"文件夹，拷贝原病毒到该文件夹下，重命名为"heoifz.pif"
4.释放"随机名.dlu"到"%systemroot%\system32"路径下然后加载
5.枚举窗体，找到进程名为"avp.exe"的窗体，进程快照找到进程名为、"360tray.exe"、"qqpcrtp.exe"、"360rp.exe"等进程，利用改变其父窗体然后销毁父窗体的手法来结束其进程
6.修改注册表hkcr\clsid\{e6fb5e20-de35-11cf-9c87-00aa005127ed}\inprocserver32子键""里的值为"%systemroot%\system32\随机名.dlu"，起到开机加载的目的，该病毒模块启动后判断所在进程是否是"explorer.exe"，是则创建互斥变量"6222020711000112559"，
目的是使自己只寄生在"explorer.exe"进程里
7.在"%systemroot%\system"目录下释放随"(随机命名).dzx"的文件，用驱动服务的方式加载该文件，删除该文件，控制驱动添加360rp.exe、360sd.exe等杀软进程的映像劫持，然后退出驱动程序、删除服务
8.创建线程无限循环查找用户电脑的可移动磁盘，找到后隐藏磁盘内文件夹，拷贝病毒到磁盘伪装成原文件夹，诱导用户启动病毒，起到移动磁盘传播病毒的目的
9.从"http://e.****.com/s.gif"下载病毒列表到本地"%systemroot%\temp\"路径下命名为"oau.ini"
10.下载列表里的病毒到"%documents and settings%\all users\documents\"目录下，然后执行
病毒创建文件：
%programfiles%\common files\heoifz.pif
%systemroot%\system32\（随机名）.dlu
%systemroot%\system\（随机名）.dzx
%systemroot%\temp\oau.ini
病毒创建注册表：
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\360rpt.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\360safe.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\360tray.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\adam.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\agentsvr.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\appsvc32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\arswp.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ast.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\autoruns.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avconsol.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avgrssvc.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avmonitor.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avp.com
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avp.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ccenter.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ccsvchst.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\eghost.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\filedsty.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ftcleanershell.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\fyfirewall.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\hijackthis.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\icesword.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\iparmo.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\iparmor.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ispwdsvc.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kabaload.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kascrscn.scr
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kasmain.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kastask.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kav32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavdx.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavpf.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavpfw.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavsetup.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kavstart.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kislnchr.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kmailmon.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kmfilter.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kpfw32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kpfw32x.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kpfwsvc.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kregex.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\krepair.com
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ksloader.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvcenter.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvdetect.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvfwmcl.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvmonxp.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvmonxp_1.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvol.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvolself.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvreport.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvscan.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvsrvxp.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvstub.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvupload.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvwsc.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvxp.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kvxp_1.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kwatch.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kwatch9x.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\kwatchx.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\loaddll.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\magicset.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\mcconsol.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\mmqczj.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\mmsk.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\navapsvc.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\navapw32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\nod32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\nod32krn.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\nod32kui.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\npfmntor.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\pfw.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\pfwliveupdate.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qhset.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qqdoctor.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\qqkav.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ras.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rav.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ravmon.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ravmond.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ravstub.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ravtask.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\regclean.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rfwcfg.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rfwmain.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rfwsrv.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rsagent.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rsaupd.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\rstrui.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\runiep.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\safelive.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\scan32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\shcfg32.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\smartup.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\sreng.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\symlcsvc.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\syssafe.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\trojandetector.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\trojanwall.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\trojdie.kxp
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\uihost.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxagent.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxattachment.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxcfg.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxfwhlp.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\umxpol.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\upiea.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\uplive.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\usbcleaner.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\vsstat.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\webscanx.exe
键：hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\wopticlean.exe
病毒删除文件：
%systemroot%\system\(即命名).dzx
病毒访问网络：
http://e.****.com/s.gif
