再战wincfgs.exe、KB20060111.exe

野性酷女 2024-02-05 21:51 17阅读 0赞

**endurer** 原创  
2006-10-27 第**1**版

有位网友的电脑最近开机时自动弹出一个空的记事本窗口，让偶帮忙检查看看。

到 [http://endurer.ys168.com][http_endurer.ys168.com] 下载 HijackThis 和 ProcView。

先用 HijackThis 扫描log，发现如下可疑项目：

/------  
Logfile of HijackThis v1.99.1  
Platform: Windows XP SP2 (WinNT 5.01.2600)  
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:  
C:/windows/system32/wincfgs.exe  
C:/WINDOWS/KB20060111.exe

F3 - REG:win.ini: load=C:/windows/system32/wincfgs.exe  
\------/

运行ProcView，让进程按修改时间逆序排列，发现：  
C:/WINDOWS/KB20060111.exe 排在第 1 位，修改时间为：2006-10-27 20:47，图标与Windows自带的记事本相同。  
c:/windows/system32/wincfgs.exe 排在第 3 位，修改时间为：2006-10-27 20:47，图标为一个黄色问号。

c:/windows/system32/wincfgs.exe，文件大小为 47,104 字节，上传在线扫描，都报了：

File: wincfgs.exe

Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)

MD5: 07adddef653a702b9a11edbcee07e82b

Packers detected: UPX

Scanner results

<table> 
 <tbody> 
  <tr> 
   <td>AntiVir</td> 
   <td>Found <font>Worm/Delf.AJ.1</font></td> 
  </tr> 
  <tr> 
   <td>ArcaVir</td> 
   <td>Found <font>Worm.Delf.Aj</font></td> 
  </tr> 
  <tr> 
   <td>Avast</td> 
   <td>Found <font>Win32:Trojan-gen.</font></td> 
  </tr> 
  <tr> 
   <td>AVG Antivirus</td> 
   <td>Found <font>Downloader.Generic2.RPB</font></td> 
  </tr> 
  <tr> 
   <td>BitDefender</td> 
   <td>Found <font>Trojan.Agent.AAE</font></td> 
  </tr> 
  <tr> 
   <td>ClamAV</td> 
   <td>Found <font>Worm.Delf-21</font></td> 
  </tr> 
  <tr> 
   <td>Dr.Web</td> 
   <td>Found <font>Trojan.MulDrop.3780</font></td> 
  </tr> 
  <tr> 
   <td>F-Prot Antivirus</td> 
   <td>Found <font>W32/Sillyworm.RE</font></td> 
  </tr> 
  <tr> 
   <td>Fortinet</td> 
   <td>Found <font>W32/Delf.AJ!worm</font></td> 
  </tr> 
  <tr> 
   <td>Kaspersky Anti-Virus</td> 
   <td>Found <font>Worm.Win32.Delf.aj</font></td> 
  </tr> 
  <tr> 
   <td>NOD32</td> 
   <td>Found <font>Win32/Delf.AJ</font></td> 
  </tr> 
  <tr> 
   <td>Norman Virus Control</td> 
   <td>Found <font>W32/Delf.OMO</font></td> 
  </tr> 
  <tr> 
   <td>VirusBuster</td> 
   <td>Found <font>Worm.Delf.AZX</font></td> 
  </tr> 
  <tr> 
   <td>VBA32</td> 
   <td>Found <font>Worm.Win32.Delf.aj</font></td> 
  </tr> 
 </tbody> 
</table>

c:/windows/KB20060111.exe 则 不见红。

STATUS: FINISHED

Complete scanning result of "KB20060111.exe", received in VirusTotal at 10.27.2006, 15:34:30 (CET).

<table> 
 <thead> 
  <tr> 
   <td>Antivirus</td> 
   <td>Version</td> 
   <td>Update</td> 
   <td>Result</td> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>AntiVir</td> 
   <td>7.2.0.34</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Authentium</td> 
   <td>4.93.8</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Avast</td> 
   <td>4.7.892.0</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>AVG</td> 
   <td>386</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>BitDefender</td> 
   <td>7.2</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>CAT-QuickHeal</td> 
   <td>8.00</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>ClamAV</td> 
   <td>devel-20060426</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>DrWeb</td> 
   <td>4.33</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>eTrust-InoculateIT</td> 
   <td>23.73.38</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>eTrust-Vet</td> 
   <td>30.3.3162</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Ewido</td> 
   <td>4.0</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Fortinet</td> 
   <td>2.82.0.0</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>F-Prot</td> 
   <td>3.16f</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>F-Prot4</td> 
   <td>4.2.1.29</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Ikarus</td> 
   <td>0.2.65.0</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Kaspersky</td> 
   <td>4.0.2.24</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>McAfee</td> 
   <td>4882</td> 
   <td>10.26.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Microsoft</td> 
   <td>1.1609 </td> 
   <td>10.26.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>NOD32v2</td> 
   <td>1.1841</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Norman</td> 
   <td>5.80.02</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Panda</td> 
   <td>9.0.0.4</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Sophos</td> 
   <td>4.10.0</td> 
   <td>10.26.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>TheHacker</td> 
   <td>6.0.1.106</td> 
   <td>10.26.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>UNA</td> 
   <td>1.83</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>VBA32</td> 
   <td>3.11.1</td> 
   <td>10.26.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>VirusBuster</td> 
   <td>4.3.15:9</td> 
   <td>10.27.2006 </td> 
   <td>no virus found</td> 
  </tr> 
 </tbody> 
</table>

Aditional Information

File size: 66560 bytes

MD5: 89fe32de8587b0dfd76efce00396eb56

SHA1: 1572b3c4d3dd39832ae500abccc1d2df27ef1b8c

[http_endurer.ys168.com]: http://endurer.ys168.com