Trojan-Spy.Win32.VB.oe

Trojan-Spy.Win32.VB.oe是病毒屬木馬類，病毒運行後複製自身到%system32%下，並衍生Microsoft Visual Basic所必須的控制項mswinsck.ocx 到%system32%目錄下，修改註冊表，添加啟動項，以達到隨機啟動的目的。

基本介紹

• 中文名：Trojan-Spy.Win32.VB.oe
• 病毒名稱：Trojan-Spy.Win32.VB.oe
• 感染系統：windows98以上版本
• 公開範圍：完全公開
• 危害等級：中

病毒名稱

Trojan-Spy.Win32.VB.oe

病毒類型

木馬

檔案MD5值

B61DF4379D30063FDFCA883E8B9FA2AC

公開範圍

完全公開

危害等級

中

感染系統

windows98以上版本

開發工具

Microsoft Visual Basic 5.0 / 6.0

加殼類型

無

命名對照

Symentec[]

Mcafee[]

病毒描述

該病毒屬木馬類，病毒運行後複製自身到%system32%下，並衍生Microsoft Visual Basic所必須的控制項mswinsck.ocx 到%system32%目錄下，修改註冊表，添加啟動項，以達到隨機啟動的目的。

行為分析

1、病毒運行後複製自身到%system32%下，並釋放Microsoft Visual Basic所必須的控制項：

%system32%\mswinsck.ocx

%system32%\病毒名.exe

2、修改註冊表，添加啟動項，以達到隨機啟動的目的：

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

\CurrentVersion\Run

鍵值: 字串: "病毒名"="C:\WINDOWS\system32\病毒名"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

鍵值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories

\{0DE86A53-2BAA-11CF-A229-00AA003D7352}\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories

\{0DE86A57-2BAA-11CF-A229-00AA003D7352}\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories

\{40FC6ED4-2438-11CF-A3DB-080036F12502}\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories

\{40FC6ED5-2438-11CF-A3DB-080036F12502}\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\

鍵值: 字串: "@"="C:\WINDOWS\system32\MSWINSCK.OCX"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32

鍵值: 字串: "ThreadingModel "="Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1

鍵值: 字串: "@"="132497"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC

0080C7E7B78D}\MiscStatus

鍵值: 字串: "@"="0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID

鍵值: 字串: "@"="MSWinsock.Winsock.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32

鍵值: 字串: "@"="C:\WINDOWS\system32\MSWINSCK.OCX, 1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib

鍵值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{248DD896-BB45-

11CF-9ABC-0080C7E7B78D}\Version

鍵值: 字串: "@"="1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

\VersionIndependentProgID

鍵值: 字串: "@"="MSWinsock.Winsock"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

{248DD897-BB45-11CF-9ABC-0080C7E7B78D}

鍵值: 字串: "@"="Winsock General Property Page Object"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32

鍵值: 字串: "@"="C:\WINDOWS\system32\MSWINSCK.OCX"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}

鍵值: 字串: "@"="IMSWinsockControl"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32

鍵值: 字串: "@"="{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid

鍵值: 字串: "@"="{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib

鍵值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib

鍵值: 字串: "Version "="1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}

鍵值: 字串: "@"="DMSWinsockControlEvents"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32

鍵值: 字串: "@"="{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid\

鍵值: 字串: "@"="{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\

鍵值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib

鍵值: 字串: "Version"="1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1

鍵值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\

鍵值: 字串: "@"="{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\

鍵值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\

鍵值: 字串: "@"="{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\

鍵值: 字串: "@"="MSWinsock.Winsock.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib

\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib

\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib

\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLi

b\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\

鍵值: 字串: """="C:\WINDOWS\system32\MSWINSCK.OCX"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib

\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0

鍵值: 字串: "@"="Microsoft Winsock Control 6.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib

\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\

鍵值: 字串: "@"="2"

註：% System%是一個可變路徑。病毒通過查詢作業系統來決定當前System資料夾的位置。Windows2000/NT中默認的安裝路徑是C:\Winnt\System32，windows95/98/me中默認的安裝路徑是C:\Windows\System，windowsXP中默認的安裝路徑是C:\Windows\System32。

清除方案

1、使用安天木馬防線可徹底清除此病毒(推薦)。

2、手工清除請按照行為分析刪除對應檔案，恢復相關係統設定。

(1) 使用安天木馬防線“進程管理”關閉病毒進程

(2) 刪除病毒檔案

%system32%\mswinsck.ocx

%system32%\病毒名.exe

(3) 恢復病毒修改的註冊表項目，刪除病毒添加的註冊表項

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

\CurrentVersion\Run

鍵值: 字串: "病毒名"="C:\WINDOWS\system32\病毒名"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

鍵值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories

\{0DE86A52-2BAA-11CF-A229-00AA003D7352}\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories

\{0DE86A53-2BAA-11CF-A229-00AA003D7352}\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories

\{0DE86A57-2BAA-11CF-A229-00AA003D7352}\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories

\{40FC6ED5-2438-11CF-A3DB-080036F12502}\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\

鍵值: 字串: "@"="C:\WINDOWS\system32\MSWINSCK.OCX"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32

鍵值: 字串: "ThreadingModel "="Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1

鍵值: 字串: "@"="132497"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus

鍵值: 字串: "@"="0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID

鍵值: 字串: "@"="MSWinsock.Winsock.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32

鍵值: 字串: "@"="C:\WINDOWS\system32\MSWINSCK.OCX, 1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib

鍵值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version

鍵值: 字串: "@"="1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID

鍵值: 字串: "@"="MSWinsock.Winsock"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}

鍵值: 字串: "@"="Winsock General Property Page Object"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32

鍵值: 字串: "@"="C:\WINDOWS\system32\MSWINSCK.OCX"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}

鍵值: 字串: "@"="IMSWinsockControl"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32

鍵值: 字串: "@"="{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid

鍵值: 字串: "@"="{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib

鍵值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib

鍵值: 字串: "Version "="1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}

鍵值: 字串: "@"="DMSWinsockControlEvents"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32

鍵值: 字串: "@"="{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid\

鍵值: 字串: "@"="{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\

鍵值: 字串: "@"="{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface

\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib

鍵值: 字串: "Version"="1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1

鍵值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\

鍵值: 字串: "@"="{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\

鍵值: 字串: "@"="Microsoft WinSock Control, version 6.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\

鍵值: 字串: "@"="{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\

鍵值: 字串: "@"="MSWinsock.Winsock.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib

\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib

\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib

\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib

\{248DD890-BB45-11CF-9ABC

0080C7E7B78D}\1.0\0\win32\

鍵值: 字串: """="C:\WINDOWS\system32\MSWINSCK.OCX"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib

\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0

鍵值: 字串: "@"="Microsoft Winsock Control 6.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib

\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\

鍵值: 字串: "@"="2"