最近网站挂马比较验证,我的电脑的也超卡,建议大家下360safe,
文件名称:image.JPG-www.photobucket.com
文件大小:10752bytes
AV命名:(暂无,哈哈``因为全部过了``)
加壳方式:未知
编写语言:Delphi
病毒类型:IRCBot
文件MD5:0e404cb8b010273ef085afe9c90e8de1
行为:
1、释放病毒副本:
%Systemroot%system32rpmsvc.exe10752字节
C:DocumentsandSettings%Users%LocalSettingsTempimage11.zip10912字节
2、添加启动项,开机启动:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
注册表值RemoteTerminalService=REG_SZ,"rpmsvc.exe"
3、连接IRC服务器(s**.gnode.com),接受远程控制,感染的计算机沦为肉机。
4、查找MSN好友,发送临时文件夹的病毒压缩包和一些诱人词语:
可能是下面的随机一条:
Quote:
Thispictureisntyou...right?
newestpicsforya:)
heydidievershowyouthispictureofme?
isitokifIaddthispictomynewslideshow?
caniupsomeofthesepicsofyatomymyspaceprofile?
Wowithinkifoundyourpiconmyspace!
hahIthinkIfoundanoldpicofus!
hahaletshopeyourparentsdontseethispictureofyou:D
youcareifiputthispictuerofyouinmynewalbum?
OMFG!!!!!!!!:D
wow!lookatthisoldpictureifound
sorryaboutthemessupifixedthepic!Tryitonemoretimepz
isthispictooosexyforphotobucket??
wowIjustdyedmyhair...Youwillneverbelievethecoloritisnow.lolAnddontlaugh
mycrazysisterwantsutoseethesepicsforsomereason...takealook
Caniputthispicofyouintomynewmyspacealbum?
Takealookatthenewpicsalready!:p
Icantbelievetheywantedmetouploadthispicturetofacebooklol.Itsterrible.Likemyoutfittho?
Lmfaoheyimsendingmynewpictures!Checkemout!
I'vebeeneditingsomepicsyoushoulddefseeemlol!
dudeijustgotthesepicturesoffmydigitalforyou!Gimmeamomenttofindemandsend
Wannaseemypicsbeforeisendemtofacebook?
doyouthinkthispictureistookinkyforMyspace?
Heyacceptmypictures,igotabunchfromwheniwaslikeatoddler:X
Ithinkthispictureisterrible.butmyfriendsonmyspacewanttoseeit.pleasedontshownoone.
Heyjustfinishednewmyspacealbum!:)theresafewkinkyonesinthere!
OMG,ifoundurpiconcuteornot.com!Checkitout
heyyougotamyspacealbum?anywaysheresmynewmyspacealbum:)acceptk?
doIlookdumbinthispicture?Iwanttoputitonmyspace.
heymanacceptmypics.:(ijusteditedittolookmaadfunny..
Dudeifoundyourpictureonhotornot.com!Takealook!
瀑布汗,又是这套,I服了You。
(对方如果接收并执行的话,将成为新的传播体)
解决方法:
哈哈``不需要任何工具
1、关闭网络连接。
2、打开任务管理器(ctrl+alt+del组合键调用任务管理器),结束rpmsvc.exe进程。
3、打开注册表(开始菜单-运行-输入“regedit”进入注册表依次找到说明选项并按提示操作),到HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun。
删除:<RemoteTerminalService><rpmsvc.exe>
4、删除rpmsvc.exe(C:Windowssystem32那里)
5、记得要清空临时文件夹。
PS:病毒文件名如果不一样的话,可自己变通哈`