Trojan-Downloader.Win32.Small.ege专杀

病毒名称：Trojan-Downloader.Win32.Small.ege （Kaspersky）
病毒大小：14888 bytes
加壳方式：NsPack
样本MD5：c22272c7dbb194cacfc5242730cfbd78
样本SHA1：f8f890586955ccc25244d684e98f0a74631d4176
编写语言：Borland Delphi 6.0-7.0

行为分析：

病毒运行后，复制自身到病毒创建的Web Publish文件夹下：
C:\Program Files\Web Publish\IDrivers.pif  

添加注册表项：
[HKLM\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\
{2bf41073-b2b1-21c1-b5c1-0701f4155588}]
"StubPath"="C:\Program Files\Web Publish\IDrivers.pif"

尝试关闭相关进程和相关窗体：
Setup.exe     

Symantec AntiVirus 企业版                                                                                     

江民杀毒软件 KV2004：实时监视                                                                                 

RavMon.exe                                                                                                    

RavMonClass
ZoneAlarm
ZAFrameWnd                                                                                                    

TfLockDownMain
天网防火墙企业版
Tapplication
TFireWall_Form
Q360SafeMainClass
Symantec AntiVirus
LANDeskVPC32
天网防火墙个人版                                                                                              

RogueCleaner.exe
rfwmain.exe"
KVXP.KXP
KVMonXP.KXP
EGHOST.EXE
Iparmor.exe
MAILMON.EXE
KAVPFW.EXE
WoptiClean.exe

调用IE，联网下载：
http://www.86dx.net/1.exe
http://www.86dx.net/2.exe
http://www.86dx.net/3.exe
http://www.86dx.net/4.exe
http://www.86dx.net/5.exe
http://www.86dx.net/6.exe
http://www.86dx.net/7.exe
http://www.86dx.net/8.exe
http://www.86dx.net/9.exe
http://cool.47555.com/up.asp
保存为：
C:\Program Files\Web Publish\temp[1].exe
C:\Program Files\Web Publish\temp[2].exe
C:\Program Files\Web Publish\temp[3].exe
C:\Program Files\Web Publish\temp[4].exe
C:\Program Files\Web Publish\temp[5].exe
C:\Program Files\Web Publish\temp[6].exe
C:\Program Files\Web Publish\temp[7].exe
C:\Program Files\Web Publish\temp[8].exe
C:\Program Files\Web Publish\temp[9].exe
C:\Program Files\Web Publish\temp[10].exe
并自动运行

病毒通过删除以下注册表项使病毒生成的临时程序可以被正常执行:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\WinOldApp\NoRealMode]

反汇编还可以看到病毒会查找如下注册表键值：
[HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE]
" "="%programfiles%\Internet Explorer\IEXPLORE.EXE"
[HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\MSMSGS.EXE]
" "="%programfiles%\Messenger\msmsgs.exe"
[HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\wmplayer.EXE]
" "="%programfiles%\Windows Media Player\wmplayer.EXE"
[HKLM\SOFTWARE\TENCENT\PLATFORM_TYPE_LIST\1]
"TypePath"="%programfiles%\TENCENT\QQ.exe"
我不明白想干嘛~                                                                                               

释放批处理删除自身