Win32.TrojDownloader.Hmir.339968 手动专杀及 病毒资料

这是一个下载者病毒。它伪装为jpg格式的图片文件，欺骗用户点击。运行起来后，会修改系统日期，造成一些杀毒软件失效。然后就下载并运行大量其它病毒。

1.释放病毒文件
C:\WINDOWS\system32\vq201a5.dll
C:\WINDOWS\system32\drivers\7zotrcmy.sys
C:\WINDOWS\system32\drivers\p0s7tw6r.sys

2.创建键值，建立服务，可以自启动
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7zotrcmy
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7zotrcmy Type dword:00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7zotrcmy Start dword:00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7zotrcmy ErrorControl dword:00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7zotrcmy ImagePath hex(2):53,79,73,74,65,6d,33,32,5c,44,52,49,56,45,52,53,5c,37,7a,6f,74,72,63,6d,79,2e,73,79,73,00,
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7zotrcmy DisplayName "7zotrcmy"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p0s7tw6r
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p0s7tw6r Type dword:00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p0s7tw6r Start dword:00000002
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p0s7tw6r ErrorControl dword:00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p0s7tw6r ImagePath hex(2):5c,3f,3f,5c,43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,64,72,69,76,65,72,73,5c,70,30,73,37,74,77,36,72,2e,73,79,73,00,
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p0s7tw6r DisplayName "p0s7tw6r"

3.病毒会用cmd命令删除自身

4.伪装为jpg图片文件类型，点击后运行起来，系统日期被更改，杀毒软件失效，下载大量病毒，然后运行下载病毒。