U盘病毒setup.exe,internt.exe,progmon.exe专杀

File: setup.exe
Size: 156672 bytes
Modified: 2008年1月27日, 14:19:59
MD5: 3B62DBAD27AA08DFC74C763EE1CF9CB7
SHA1: 8AD226CFD7FCC24B049795F1388EDB4A7ED085EB
CRC32: FFEA4192

1.病毒运行后，衍生如下副本：
%systemroot%\system32\IME\svchost.exe
%systemroot%\system32\internt.exe
%systemroot%\system32\progmon.exe

各个盘根目录下面生成setup.exe和autorun.inf

修改system32目录属性为隐藏

2.获得系统日期 然后把系统日期的年份加上21年

3.建立服务ALERTER_COM+ 达到开机启动自身的目的
服务相关键值：
HKLM\SYSTEM\ControlSet001\Services\Alerter COM+\Start: 0x00000002
HKLM\SYSTEM\ControlSet001\Services\Alerter COM+\ErrorControl: 0x00000000
HKLM\SYSTEM\ControlSet001\Services\Alerter COM+\ImagePath: "C:\WINDOWS\system32\IME\svchost.exe"
HKLM\SYSTEM\ControlSet001\Services\Alerter COM+\DisplayName: "Alerter COM+"
HKLM\SYSTEM\ControlSet001\Services\Alerter COM+\ObjectName: "LocalSystem"

4.在software\microsoft\windows\currentversion\run下面创建自启动项目指向
%systemroot%\system32\internt.exe
%systemroot%\system32\progmon.exe

5.在临时文件夹内释放rs.bat用于删除程序本身

6.通过FindWindowA查找"Windows 任务管理器"的窗口 找到后发送消息WM_DESTROY关闭窗口

7.通过GetWindowsTextA函数获得窗口的标题 找到后发送消息WM_DESTROY，WM_CLOSE关闭窗口 这些关键字包括
安全卫士
扫描
专杀
注册表
process
进程
毒
木马
防御
防火墙
病毒
检测
firewall
virus
anti
金山
江民
卡巴斯基
worm
杀毒
360
专杀
微点
micropoint
克星
广告
kaspersky
avk
f-secure
escan
norton
诺顿
mcafee
virus
panda
熊猫
trojan
door
avg

8.破坏显示隐藏文件
software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall的checkedvalue值改为0x00000000

9.连接网络获得http://tools.hxstat.com/ip/本机IP地址
之后会下载两个文件分别复制到%systemroot%\system32\servrr.exe和%systemroot%\system32\psexec.exe

之后会使用%s\psexec.exe \\%s -u %s -p %s -c %s\servrr.exe -d 的命令把servrr.exe复制到同网段的其他机器的%systemroot%\system32文件夹下 使用的用户名和密码的字典如下：

administrator                                 
admin                                         
guest                                         
alex                                          
home                                          
love                                          
user                                          
game                                          
movie                                         
time                                          
yeah                                          
money                                         
xpuser                                        
java                                          
fuck                                          
asdfasdf                                      
qwerqwer                                      
12341234                                      
zxcvzxcv                                      
1qaz2wsx                                      
rose                                          
mylove                                        
.147258369                                     
123456789                                     
0987654321                                    
987654321                                     
666666                                        
88888888                                      
******                                        
********                                      
hunry      

密码
NULL                                    
password                                
123456                                  
qwerty                                  
abc123                                  
memory                                  
home                                    
12345678                                
love                                    
88888                                   
5201314                                 
1314520                                 
asdfgh                                  
alex                                    
angel                                   
asdf                                    
baby                                    
woaini                                  
movie                                   
java                                    
fuck                                    
asdfasdf                                
qwerqwer                                
12341234                                
.zxcvzxcv                                
1qaz2wsx                                
rose                                    
mylove                                  
147258369                               
123456789                               
0987654321                              
987654321                               
666666                                  
88888888  

servrr.exe是一个具有arp欺骗功能的病毒

解决方法：
下载sreng:/Anti-virus/anti_virus_2292.html

Icesword:/Anti-virus/anti_virus_2292.html

1.打开Icesword
进程－找到%systemroot%\system32\IME\svchost.exe 结束进程（注意路径）

删除如下文件
%systemroot%\system32\IME\svchost.exe
%systemroot%\system32\internt.exe
%systemroot%\system32\progmon.exe
以及各个分区下面的setup.exe和autorun.inf

2.打开sreng
“启动项目”-“服务”-“Win32服务应用程序”中点“隐藏经认证的微软项目”，
选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：
[Alerter COM+ / Alerter COM+]
 

系统修复-Windows Shell/IE 全选 修复

重启计算机即可.