S168.exe、msvcrt.dll、Relive.dll木马群

比较恶劣,可能导致杀软监控初始化失败``

 

Aditional information
File name: S168.exe
File size: 23087 bytes
CRC32     : 1F9AA9F7
MD5: 3d4d01638f3e206c7bbbde769a3f2182
SHA1: 8d6d71216a588155554226efe84eed2c8011c38a
SHA160    : 8D6D71216A588155554226EFE84EED2C8011C38A
packers: UPX 0.89.6 - 1.02 / 1.05 - 1.24
Languages:   Borland Delphi 6.0 - 7.0

 

 

 

C:\Program Files\Common Files\Relive.dll 14895 字节

C:\Program Files\Internet Explorer\msvcrt.bak   23087 字节

C:\Program Files\Internet Explorer\msvcrt.dll 14895 字节

 

 

ws2_32.dll的文件夹（H，S）

可能导致杀软的监控（初始化）失败！

 

 

%Systemroot%\system32\drivers\etc\Hosts （域名解析文件）

 

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

指向：C:\Program Files\Internet Explorer\msvcrt.dll

 

实现msvcrt.dll开机插入Explorer.exe进程。

 

随后，msvcrt.dll附宿主，反弹连接202.59.153.9*，下了一大推木马`

 

释放在：C:\Documents and Settings\%User%\Local Settings\Temp\，并执行。

 

都是Drop，每个释放一个Dll插进程，盗号木马哈。30多个吧=。=

 

 

http://free.ys168.com/?gudugengkekao1下载

 

冰刃.rar 2,110KB

 

sreng2.5.zip 780KB

 

 

 

 

 

C:\Program Files\Common Files\Relive.dll

C:\Program Files\Internet Explorer\msvcrt.bak

C:\Program Files\Internet Explorer\msvcrt.dll

然后到C:\Documents and Settings\%User%\Local Settings\Temp\下，强制删除：

（注意，%User%是你的用户名）

mhso.exe
woso.exe
ztso.exe
jtso.exe
wlso.exe
wgso.exe
wmso.exe
fyso.exe
qjso.exe
rxso.exe
wdso.exe
tlso.exe
daso.exe
zxso.exe

mhso0.dll
woso0.dll
ztso0.dll
jtso0.dll
wlso0.dll
wgso0.dll
wmso0.dll
fyso0.dll
qjso0.dll
rxso0.dll
wdso0.dll
tlso0.dll
daso0.dll
zxso0.dll

 

 

 

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

     <mhsa><C:\DOCUME~1\admin\LOCALS~1\Temp\mhso.exe>   []
     <wosa><C:\DOCUME~1\admin\LOCALS~1\Temp\woso.exe>   []
     <ztsa><C:\DOCUME~1\admin\LOCALS~1\Temp\ztso.exe>   []
     <jtsa><C:\DOCUME~1\admin\LOCALS~1\Temp\jtso.exe>   []
     <wlsa><C:\DOCUME~1\admin\LOCALS~1\Temp\wlso.exe>   []
     <wgsa><C:\DOCUME~1\admin\LOCALS~1\Temp\wgso.exe>   []
     <wmsa><C:\DOCUME~1\admin\LOCALS~1\Temp\wmso.exe>   []
     <fysa><C:\DOCUME~1\admin\LOCALS~1\Temp\fyso.exe>   []
     <qjsa><C:\DOCUME~1\admin\LOCALS~1\Temp\qjso.exe>   []
     <rxsa><C:\DOCUME~1\admin\LOCALS~1\Temp\rxso.exe>   []
     <wdsa><C:\DOCUME~1\admin\LOCALS~1\Temp\wdso.exe>   []
     <tlsa><C:\DOCUME~1\admin\LOCALS~1\Temp\tlso.exe>   []
     <dasa><C:\DOCUME~1\admin\LOCALS~1\Temp\daso.exe>   []
     <zxsa><C:\DOCUME~1\admin\LOCALS~1\Temp\zxso.exe>   []

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

<C:\Program Files\Internet Explorer\msvcrt.dll>   [Microsoft Corporation]