标题：Trojan.Win32.Agent.uc
病毒标签
病毒名称： Trojan.Win32.Agent.uc 
病毒类型： 木马 
文件 MD5： dc3536d9a7f57ec7ee29cdf0256a3608 
公开范围： 完全公开 
文件长度：353,532 字节 
开发工具： Microsoft Visual C++ 6.0 - 7.0 
加壳类型： 未知壳
命名对照
Symentec[无] 
Mcafee[无]
病毒危害
危害等级： 中 
感染系统： Windows98以上版本
行为分析
1、该病毒是一个文件，其中含有两个可执行的病毒文件：HLP.exe、SYN.exe。病毒运行后将自身文件复制到%system32%下： 
%system32%\mypic.jpg 
%system32%\packet.dll 
%system32%\wanpacket.dll 
%system32%\wpcap.dll 
%system32%\drivers\npf.sys 
2、删除注册表项： 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\DependOnGroup 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\DependOnService 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\Description 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\DisplayName 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\Enum\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\Enum\0 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\Enum\Count 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\Enum\NextInstance 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\ErrorControl 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\FailureActions 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\ImagePath 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\ObjectName 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\Parameters\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\Parameters\ServiceDll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\Security\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\Security\Security 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\Start 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS 
\Type 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\DependOnGroup 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\DependOnService 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Description 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\DisplayName 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Enum\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Enum\0 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Enum\Count 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Enum\NextInstance 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Epoch\Epoch 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\ErrorControl 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\ImagePath 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\ObjectName 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Parameters\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Parameters\Firewall Policy\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Parameters\Firewall Policy\DomainProfile\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Parameters\Firewall Policy\DomainProfile 
\AuthorizedApplications\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Parameters\Firewall Policy\DomainProfile 
\AuthorizedApplications\List\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Parameters\Firewall Policy\DomainProfile 
\AuthorizedApplications\List\%windir%\system32\sessmgr.exe 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Parameters\Firewall Policy\StandardProfile\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Parameters\Firewall Policy\StandardProfile 
\AuthorizedApplications\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Parameters\Firewall Policy\StandardProfile 
\AuthorizedApplications\List\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess 
\Parameters\Firewall Policy\StandardProfile\AuthorizedApplications 
\List\%windir%\system32\sessmgr.exe 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Parameters\FirewallPolicy\StandardProfile 
\AuthorizedApplications\List\C:\Program Files\ThunderNetwork 
\Thunder\Thunder.exe 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Parameters\Firewall Policy\StandardProfile 
\EnableFirewall 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Parameters\ServiceDll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Setup\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate\All 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Setup\ServiceUpgrade 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Start 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\SharedAccess\Type 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\DependOnGroup 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\DependOnService 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\Description 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\DisplayName 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\Enum\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\Enum\0 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\Enum\Count 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\Enum\NextInstance 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\ErrorControl 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\ImagePath 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\ObjectName 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\Parameters\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\Parameters\ServiceDll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\Security\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\Security\Security 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\Start 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\srservice\Type 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\DependOnService 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\Description 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\DisplayName 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\Enum\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\Enum\0 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\Enum\Count 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\Enum\NextInstance 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\ErrorControl 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\ImagePath 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\ObjectName 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\Parameters\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\Parameters\ServiceDll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\Security\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\Security\Security 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\Start 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wscsvc\Type 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\Description 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\DisplayName 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\Enum\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\Enum\0 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\Enum\Count 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\Enum\NextInstance 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\ErrorControl 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\ImagePath 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\ObjectName 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\Parameters\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\Parameters\ServiceDll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\Security\ 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\Security\Security 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\Start 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 
\wuauserv\Type 
3、终止以下服务： 
Windows Firewall/Internet Connection Sharing(ICS) 
Background Intelligent Transfer Service 
System Restore Service 
SecurityCenter 
Automatic Updates 
4、新建注册表项： 
HKEY_CURRENT_USER\Software\Microsoft\Windows 
\ShellNoRoam\MUICache\ 
键值：字串：(原病毒所在路径)= "MyPic" 
HKEY_CURRENT_USER\Software\Microsoft\Windows 
\ShellNoRoam\MUICache\ 
键值：字串："C:\WINDOWS\HLP.exe"= "HLP" 
HKEY_CURRENT_USER\Software\Microsoft\Windows 
\ShellNoRoam\MUICache 
键值：字串："C:\WINDOWS\system32\shimgvw.dll 
"= "Windows 图片和传真查看器" 
HKEY_CURRENT_USER\Software\WinRAR SFX\ 
键值：字串："C%WINDOWS%"="C:\WINDOWS" 
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Internet\ 
键值：字串："Description "="为 Internet 连接提供基础服务 
，如果此服务被停止，多数 Internet 软件将无法正常运行。如果此服务被 
禁用，任何依赖它的服务将无法启动。" 
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Internet\ 
键值：字串："DisplayName"="Internet" 
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Internet\ 
键值：字串："ImagePath "=""C:\Program Files\Windows NT 
\lsass.exe" ServiceStart" 
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Internet\ 
键值：字串："ObjectName "="LocalSystem" 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Internet\ 
键值：字串："Description"="为 Internet 连接提供基础服务，如果此 
服务被停止，多数 Internet 软件将无法正常运行。如果此服务被禁用， 
任何依赖它的服务将无法启动。" 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Internet\ 
键值：字串："DisplayName"="Internet" 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Internet\ 
键值：字串："ImagePath "=""C:\Program Files\Windows NT 
\lsass.exe" ServiceStart" 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Internet\ 
键值：字串："ObjectName"= "LocalSystem" 
5、新建服务: 
HKEY_LOCAL_MATHIN\SYSTEM\CurrentControlSet\Services\Internet。 
(为 Internet 连接提供基础服务E，如果此服务被停止，多数 Internet 软件将无法正常运行。如果此服务被禁用，任何依赖它的服务将无法启动) 
6、尝试关闭反病毒进程，如： 
kav.exe 
kavsvc.exe 
Rav.exe 
RavMon.exe 
…… 
7、尝试下载： 
http://goowy.box.*****static/e6efh1kgde.jpg 
http://notidgbwds*****ewebspace.com/not_v1/not_ini_v1.jpg 
http://notidgbwd*****rfreewebspace.com/ 
http://notidgbwdsg.5****.com/not_v1/not_ini_v1.jpg 
……
清除方案
1、使用安天木马防线可彻底清除此病毒(推荐)。 
2、手工清除请按照行为分析删除对应文件，恢复相关系统设置。 
(1) 使用安天木马防线“进程管理”关闭病毒进程 
(2) 删除病毒文件 
%system32%mypic.jpg 
packet.dll 
wanpacket.dll 
wpcap.dll 
%system32%\driversnpf.sys 
(3) 恢复病毒修改的注册表项目，删除病毒添加的注册表项 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012006052220060529\ 
键值：字串：”CachePath”= "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012006052220060529” 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012006060120060602\ 
键值：字串：“CachePrefix”= ":2006060120060602: " 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\ 
键值：字串：” C:\Clean.bat”= "Clean" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\ 
键值：字串："C:\Documents and Settings\commander\桌面\MyPic.exe"= "MyPic" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\ 
键值：字串："C:\WINDOWS\HLP.exe"= "HLP" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache 
键值：字串："C:\WINDOWS\system32\shimgvw.dll"= "Windows 图片和传真查看器" 
HKEY_CURRENT_USER\Software\WinRAR SFX\ 
键值：字串： "C%WINDOWS%"="C:\WINDOWS" 
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Internet\ 
键值：字串："Description "="为 Internet 连接提供基础服务，如果此服务被停止，多数 Internet 软件将无法正常运行。如果此服务被 
用，任何依赖它的服务将无法启动。" 
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Internet\ 
键值：字串："DisplayName"="Internet" 
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Internet\ 
键值：字串："ImagePath "=""C:\Program Files\Windows NT\lsass.exe" ServiceStart" 
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Internet\ 
键值：字串："ObjectName "="LocalSystem" 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Internet\ 
键值：字串："Description"="为 Internet 连接提供基础服务，如果此服务被停止，多数 Internet 软件将无法正常运行。如果此服务被 
用，任何依赖它的服务将无法启动。" 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Internet\ 
键值：字串："DisplayName"="Internet" 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Internet\ 
键值：字串："ImagePath "=""C:\Program Files\Windows NT\lsass.exe" ServiceStart" 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Internet\ 
键值：字串："ObjectName"= "LocalSystem"
注
% System%是一个可变路径。病毒通过查询操作系统来决定当前System文件夹的位置。Windows2000/NT中默认的安装路径是C:\Winnt\System32，windows95/98/me中默认的安装路径是C:\Windows\System，windowsXP中默认的安装路径是C:\Windows\System32。