新AV终结者采用ring3级hook技术对抗杀毒软件

新客网 XKER.COM 2007-09-21 来源：李铁军收藏本文

截获最新的AV终结者，该变种采用ring3级hook技术直接删除杀毒软件，劫持众多网站，阻止杀毒软件更新。专杀程序紧张制作中，测试通过会及时发布，老版本AV终结者专杀运行后会自动升级。

以下是详细分析报告：

病毒名：Win32.Troj.AvKiller.hd.212992

病毒利用WH_CALLWNDPROC类型的挂钩将自身注入其他进程

**释放文件**
C:\WINDOWS\system32\nfxphzn.jbt 该文件为kernel32.dll的拷贝
c:\WINDOWS\system32\yqia.btl    该文件为病毒自身的拷贝

**下载文件**
w3.hao5555.com/v3/pic.bmp
w3.hao5555.com/v3/Riched32.dll
w3.hao5555.com/v3/search.asp
w3.hao5555.com/bd.dll

**修改的注册表**
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"xphz"="{1b5f93d7-93d7-0a4e-4e82-93d71b5f93d7}" 
[HKEY_CLASSES_ROOT\CLSID\{1b5f93d7-93d7-0a4e-4e82-93d71b5f93d7}\InprocServer32]
@="C:\\WINDOWS\\system32\\yqia.btl""ThreadingModel"="Apartment"
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System]
"DisableCMD"=dword:00000001

**挂接函数**
RegEnumValueA
RegEnumValueW -- 目的为隐藏病毒添加的注册表键值

CreateFileA
CreateFileW   -- 目的为保护病毒释放的文件

**卸载组件**
regsvr32.exe /u /s wshom.ocx

病毒自身通过nfxphzn.jbt来调用CreateFileA和CreateFileW函数，病毒注入系统的其他进程后

(1)创建一个线程来保护其添加的注册表键值不被删除；

(2)结束杀毒软件进程；

(3)通过将ZwCreateFile的前两个字节填0加以破坏；

(4)并试图删除以下文件，（主要是杀毒软件和流氓软件清除工具的驱动、程序文件）

"mmskskin.dll"
"KKClean.dll"
"VirUnk.def"
"AntiActi.dll"
"Rsaupd.exe"
"Iereset.dll"
"Libclsid.dat"
"KNetWch.SYS"
"CleanHis.dll"
"WoptiClean.sys"
"kakalib.def"
"libdll.dat"
"kkinst.ini"
"KASearch.DLL"
"KAVBootC.sys"
"Ras.exe"
"iehelp.exe"
"trojandetector.exe"
"KAConfig.DLL"
"KAVPassp.DLL"
"hsfw.dll"

**修改hosts文件为**

hosts文件被修改后，会影响很多杀毒软件和反流氓软件的升级，影响访问相关网站

（注意一下61.152.244.167这个IP，下面发现众多流量很高的站点被劫持到61.152.244.167，可以尝试一下在IE地址栏中输入这个IP，你发现去了cn.yahoo.com）难道这个病毒在替yahoo做流量？我是不相信的，马云成功在望，不会采取这种流氓手段劫持其它网站的流量，我怀疑是栽赃。或者，中国yahoo的网盟政策被利用了。

127.0.0.1       localhost
61.152.244.167    search.114.vnet.cn
61.152.244.167    auto.search.msn.com
61.152.244.167    search.msn.com
61.152.244.167    cnweb.search.live.com
61.152.244.167    search.live.com
61.152.244.167    www.hao123.com
61.152.244.167    hao123.com
61.152.244.167    www.360safe.com
61.152.244.167    360safe.com
222.73.126.115    update.360safe.com
61.152.244.167    dl.360safe.com
61.152.244.167    bbs.360safe.com
61.152.244.167    www.btbaicai.com
61.152.244.167    btbaicai.com
61.152.244.167    www.pctutu.com
61.152.244.167    www.7322.com
61.152.244.167    www.5566.net
61.152.244.167    www.9991.com
61.152.244.167    9991.com
61.152.244.167    forum.ikaka.com
61.152.244.167    www.ikaka.com
222.73.126.115    update.ikaka.com
61.152.244.167    forum.jiangmin.com
222.73.126.115    update.jiangmin.com
61.152.244.167    post.baidu.com
222.73.126.115    update.rising.com.cn
61.152.244.167    online.rising.com.cn
222.73.126.115    center.rising.com.cn   
61.152.244.167    up.duba.net
61.152.244.167    shadu.baidu.com
61.152.244.167    security.symantec.com
61.152.244.167    shadu.duba.net
61.152.244.167    online.jiangmin.com
61.152.244.167    cn.mcafee.com
61.152.244.167    www.ahn.com.cn
61.152.244.167    www.kaspersky.com.cn
61.152.244.167    www.pcav.cn
61.152.244.167    mopery.hits.io
61.152.244.167    www.luosoft.com
61.152.244.167    luosoft.com
61.152.244.167    www.im286.com
61.152.244.167    bbs.htmlman.net
61.152.244.167    10000.286er.com
61.152.244.167    im286.net
61.152.244.167    cool.47555.com
61.152.244.167    ju.qihoo.com
61.152.244.167    bbs.chinaz.com
222.73.126.115 dnl-cn1.kaspersky-labs.com
222.73.126.115 dnl-cn2.kaspersky-labs.com
222.73.126.115 dnl-cn3.kaspersky-labs.com
222.73.126.115 dnl-cn4.kaspersky-labs.com
222.73.126.115 dnl-cn5.kaspersky-labs.com
222.73.126.115 dnl-cn6.kaspersky-labs.com
222.73.126.115 dnl-cn7.kaspersky-labs.com
222.73.126.115 dnl-cn8.kaspersky-labs.com
222.73.126.115 dnl-cn9.kaspersky-labs.com
222.73.126.115 dnl-cn10.kaspersky-labs.com
222.73.126.115 dnl-cn11.kaspersky-labs.com
222.73.126.115 dnl-cn12.kaspersky-labs.com
222.73.126.115 dnl-cn13.kaspersky-labs.com
222.73.126.115 dnl-cn14.kaspersky-labs.com
222.73.126.115 dnl-cn15.kaspersky-labs.com
222.73.126.115    dnl-eu1.kaspersky-labs.com
222.73.126.115   dnl-eu2.kaspersky-labs.com
222.73.126.115    dnl-eu3.kaspersky-labs.com
222.73.126.115    dnl-eu4.kaspersky-labs.com
222.73.126.115    dnl-eu5.kaspersky-labs.com
222.73.126.115    dnl-eu6.kaspersky-labs.com
222.73.126.115    dnl-eu7.kaspersky-labs.com
222.73.126.115    dnl-eu8.kaspersky-labs.com
222.73.126.115    dnl-eu9.kaspersky-labs.com
222.73.126.115    dnl-eu10.kaspersky-labs.com
222.73.126.115    dnl-eu11.kaspersky-labs.com
222.73.126.115    dnl-eu12.kaspersky-labs.com
222.73.126.115    dnl-eu13.kaspersky-labs.com
222.73.126.115    dnl-eu14.kaspersky-labs.com
222.73.126.115    dnl-eu15.kaspersky-labs.com
222.73.126.115    dnl-us1.kaspersky-labs.com
222.73.126.115    dnl-us2.kaspersky-labs.com
222.73.126.115    dnl-us3.kaspersky-labs.com
222.73.126.115    dnl-us4.kaspersky-labs.com
222.73.126.115    dnl-us5.kaspersky-labs.com
222.73.126.115    dnl-us6.kaspersky-labs.com
222.73.126.115    dnl-us7.kaspersky-labs.com
222.73.126.115    dnl-us8.kaspersky-labs.com
222.73.126.115    dnl-us9.kaspersky-labs.com
222.73.126.115    dnl-us10.kaspersky-labs.com
222.73.126.115    dnl-us11.kaspersky-labs.com
222.73.126.115    dnl-us12.kaspersky-labs.com
222.73.126.115    dnl-us13.kaspersky-labs.com
222.73.126.115    dnl-us14.kaspersky-labs.com
222.73.126.115    dnl-us15.kaspersky-labs.com
222.73.126.115    dnl-ru1.kaspersky-labs.com
222.73.126.115    dnl-ru2.kaspersky-labs.com
222.73.126.115    dnl-ru3.kaspersky-labs.com
222.73.126.115    dnl-ru4.kaspersky-labs.com
222.73.126.115    dnl-ru5.kaspersky-labs.com
222.73.126.115    dnl-ru6.kaspersky-labs.com
222.73.126.115    dnl-ru7.kaspersky-labs.com
222.73.126.115    dnl-ru8.kaspersky-labs.com
222.73.126.115    dnl-ru9.kaspersky-labs.com
222.73.126.115    dnl-ru10.kaspersky-labs.com
222.73.126.115    dnl-ru11.kaspersky-labs.com
222.73.126.115    dnl-ru12.kaspersky-labs.com
222.73.126.115    dnl-ru13.kaspersky-labs.com
222.73.126.115    dnl-ru14.kaspersky-labs.com
222.73.126.115    dnl-ru15.kaspersky-labs.com
222.73.126.115    dnl-jp1.kaspersky-labs.com
222.73.126.115    dnl-jp2.kaspersky-labs.com
222.73.126.115   dnl-jp3.kaspersky-labs.com
222.73.126.115    dnl-jp4.kaspersky-labs.com
222.73.126.115   dnl-jp5.kaspersky-labs.com
222.73.126.115   dnl-jp6.kaspersky-labs.com
222.73.126.115   dnl-jp7.kaspersky-labs.com
222.73.126.115   dnl-jp8.kaspersky-labs.com
222.73.126.115   dnl-jp9.kaspersky-labs.com
222.73.126.115   dnl-jp10.kaspersky-labs.com
222.73.126.115   dnl-jp11.kaspersky-labs.com
222.73.126.115   dnl-jp12.kaspersky-labs.com
222.73.126.115   dnl-jp13.kaspersky-labs.com
222.73.126.115   dnl-jp14.kaspersky-labs.com
222.73.126.115   dnl-jp15.kaspersky-labs.com
222.73.126.115    dnl-kr1.kaspersky-labs.com
222.73.126.115   dnl-kr2.kaspersky-labs.com
222.73.126.115   dnl-kr3.kaspersky-labs.com
222.73.126.115    dnl-kr4.kaspersky-labs.com
222.73.126.115    dnl-kr5.kaspersky-labs.com
222.73.126.115    dnl-kr6.kaspersky-labs.com
222.73.126.115    dnl-kr7.kaspersky-labs.com
222.73.126.115    dnl-kr8.kaspersky-labs.com
222.73.126.115    dnl-kr9.kaspersky-labs.com
222.73.126.115    dnl-kr10.kaspersky-labs.com
222.73.126.115    dnl-kr11.kaspersky-labs.com
222.73.126.115    dnl-kr12.kaspersky-labs.com
222.73.126.115    dnl-kr13.kaspersky-labs.com
222.73.126.115    dnl-kr14.kaspersky-labs.com
222.73.126.115    dnl-kr15.kaspersky-labs.com
222.73.126.115 dnl-cd1.kaspersky-labs.com
222.73.126.115 dnl-cd2.kaspersky-labs.com
222.73.126.115 dnl-cd3.kaspersky-labs.com
222.73.126.115 dnl-cd4.kaspersky-labs.com
222.73.126.115 dnl-cd5.kaspersky-labs.com
222.73.126.115 dnl-cd6.kaspersky-labs.com
222.73.126.115 dnl-cd7.kaspersky-labs.com
222.73.126.115 dnl-cd8.kaspersky-labs.com
222.73.126.115 dnl-cd9.kaspersky-labs.com
222.73.126.115 dnl-cd10.kaspersky-labs.com
222.73.126.115 dnl-cd11.kaspersky-labs.com
222.73.126.115 dnl-cd12.kaspersky-labs.com
222.73.126.115 dnl-cd13.kaspersky-labs.com
222.73.126.115 dnl-cd14.kaspersky-labs.com
222.73.126.115 dnl-cd15.kaspersky-labs.com
61.152.244.167    ishare.sina.com.cn
61.152.244.167    search.cn.yahoo.com
61.152.244.167    www.google.com
61.152.244.167    google.com
61.152.244.167    www.google.cn
61.152.244.167    www.sogou.com
61.152.244.167    www.yahoo.com.cn
61.152.244.167    cn.yahoo.com
222.73.210.148    www.comewz.com
61.152.244.167    search.tom.com
61.152.244.167    page.so.163.com
61.152.244.167    www.soso.com
61.152.244.167    sou.china.com
61.152.244.167   toolsbar.kuaiso.com
61.152.244.167   www.kuaiso.com

查询61.152.244.167，位于上海电信机房，whois信息如下：

WHOIS results for: 61.152.244.167
% Joint Whois
%  This server accepts single ASN, IPv4 or IPv6 queries
 
% [whois.apnic.net node-2]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:      61.152.244.160 - 61.152.244.191
netname:      ZhongXin
descr:       ZhongXin
country:      CN
admin-c:      XCM3-AP
tech-c:       HY174-AP
mnt-by:       MAINT-CHINANET-SH
changed:      coconut-huang@edatahome.com  20030423
status:       ASSIGNED NON-PORTABLE
source:       APNIC

person:       Xu Chun Ming
address:      15F,618 East Yanan Road,Shanghai  200001
country:      CN
phone:        +86-21-50600014
fax-no:       +86-21-53854142
e-mail:       springknow@online.sh.cn
nic-hdl:      XCM3-AP
mnt-by:       MAINT-CN-SHTELE-DATAIDC
changed:      coconut-huang@edatahome.com    20021007
source:       APNIC

person:       Huang Yi
address:      15F,618 East Yanan Road,Shanghai  200001
country:      CN
phone:        +86-21-50600014
fax-no:       +86-21-53854142
e-mail:       coconut-huang@edatahome.com
nic-hdl:      HY174-AP
mnt-by:       MAINT-CN-SHTELE-DATAIDC
changed:      coconut-huang@edatahome.com    20021007
source:       APNIC

APNIC手动解决该病毒的办法：使用金山清理专家，将下列文件添加到彻底删除的列表，粉碎掉，然后立即重启电脑。

C:\WINDOWS\system32\nfxphzn.jbt
c:\WINDOWS\system32\yqia.btl

重启电脑，使用金山清理专家全面检测修复功能，将下面的系统执行挂钩项修复掉。

**修改的注册表**
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"xphz"="{1b5f93d7-93d7-0a4e-4e82-93d71b5f93d7}" 
[HKEY_CLASSES_ROOT\CLSID\{1b5f93d7-93d7-0a4e-4e82-93d71b5f93d7}\InprocServer32]
@="C:\\WINDOWS\\system32\\yqia.btl""ThreadingModel"="Apartment"
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System]"DisableCMD"=dword:00000001

手动编辑hosts文件，对多数用户来说，在这里：c:\windows\system32\drivers\etc\hosts除保留127.0.0.1 localhost这一行外，其它内容全部清空。(责任编辑：李磊)

上一篇：Win32/Nuvens伪装假软件下载恶意程序变体下一篇：雅虎通ActiveX控件远程栈缓冲区溢出漏洞

【收藏】【评论】【推荐】【投稿】【打印】【关闭】