该用户匿名发帖 发表于 2008-7-11 23:19 只看TA 1楼 |
---|
该用户已被删除 |
[交流] Trojan-Spy.Goldun!sd6病毒后门(datmps.dll)手动解决 文件名称:datmps.dll文件大小:33,760 bytes AV命名:Trojan-Spy.Goldun!sd6 加壳方式:UPX 文件MD5:3F5A6FB14D49675A62293B83863A8186 病毒类型:后门 主要行为: 1、释放文件: C:\Windows\System32\datmps.dll 21,984 byte C:\Windows\System32\wlite.sys 8,816 bytes 2、添加启动项: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\datmps] DllName = 64 61 74 6D 70 73 2E 64 6C 6C 00 00 Startup = "datmps" Impersonate = 0x00000001 Asynchronous = 0x00000001 MaxWait = 0x00000001 NGIX = "[1062522C5803A23AD]" 64 61 74 6D 70 73 2E 64 6C 6C 00 00 解密得:datmps.dll 3、注册驱动: [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wlite\Security] Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wlite] Type = 0x00000001 Start = 0x00000001 ErrorControl = 0x00000000 ImagePath = "system32\wlite.sys" DisplayName = "WMV9 Codec" 4、添加注册表,保证安全模式依然加载: [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\wlite.sys] (Default) = "Driver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\wlite.sys] (Default) = "Driver" 5、调用IE傀儡进程,后台连接外部:rushprot***.net 解决方法: 1、下载PowerRmv,后断开网络连接: 如下: 2、依次删除C:\Windows\System32\datmps.dll和wlite.sys。 3、删除启动项(开始菜单-运行-输入“regedit”进入注册表依次找到说明选项并按提示操作): [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\datmps] |
0 |