材星网 > 电脑资讯  >  正文

CFEDAC5E.dll,CFEDAC5E.dat(Trojan-PSW.Win32.OnLineGames.mu)的

发布时间:2020-08-12 21:55:02 来源:材星网
---------------------------------- teYqiu【天下无毒】原创文章,转载请标明。http://hi.baidu.com/teyqiu 百度知道反病毒知识专家崔衍渠 授权。 『转载请保留此申明!』 ----------------------------------

本文的眼:IFEO劫持 比比皆是...

实战案例

问题:某同事WL,今天告诉我他的卡巴斯基启动不了,CAD也起不来。过去一看,发现很多EXE点击无反应,即使改成.com后缀也不行。一下就想到了 IFEO劫持,打开注册表一看(还好丫的没屏蔽regedit.exe),蔚为壮观,稍微有些名气的都挂了...如卡巴、瑞星、360safe等,hijackthis.exe也不能幸免。。

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR] "Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"

既然普通的删除工具不管用,只有祭出XDELBOX, CMD下:C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO用ATTRIB看到有两个 SHR 属性的文件,CFEDAC5E.dll和CFEDAC5E.dat。

操作部分:使用XDELBOX先填入这两个(CFEDAC5E.dll和CFEDAC5E.dat),立即重启后删除,发现 SRENG能用了,又删了几个灰鸽子和小木马。

将病毒添加的IFEO劫持条目全部删除(上面方框中的红字部分),重启后卡巴恢复了活力,扫描内存中的病毒,54个全部成功杀掉... 打ANI漏洞补丁,升级最新的XP关键更新,收工,感谢云云不再赘述。。。

将样本发到我机子上用卡巴一扫居然是Trojan-PSW.Win32.OnLineGames.mu

卡巴报毒显示:

已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.mu 文件: F:\Documents and Settings\qiu\桌面\临时【样本】\wangLi\CFEDAC5E.dll 已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.mu 文件: F:\Documents and Settings\qiu\桌面\临时【样本】\wangLi\CFEDAC5E.dat/UPX

材星网