标题：Trojan-Dropper.Win32.Agent.bdo
简介
病毒名称： Trojan-Dropper.Win32.Agent.bdo 
中文名称： 下载者变种 
病毒类型： 木马类 
文件 MD5： 85EC8DB377E6849DBDA9A1321C049AAA 
公开范围： 完全公开 
危害等级： 4 
文件长度： 加壳后 83,456 字节，脱壳后120,832 字节 
感染系统： Win9X以上系统 
开发工具： Microsoft Visual C++ 6.0 
加壳类型： UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus &amp; Laszlo
行为分析：
1 、衍生下列副本与文件：
%WinDir%\sclgntfys.dll 
%WinDir%\winamps.dll 
%WinDir%\SysSun1\Ghook.dll 
%WinDir%\SysSun1\svchost.exe 
%WinDir%\cmdbcs.exe 
%WinDir%\gv.dll 
%WinDir%\mppds.exe 
%WinDir%\javhavm.exe 
%WinDir%\msccrt.exe 
%WinDir%\shualai.exe 
%WinDir%\winform.exe 
%System32%\upnpsvc.exe 
%System32%\systemt.exe 
%System32%\systemm.exe 
%System32%\SMSSS.exe 
%System32%\servet.exe 
%System32%\MSTCS.exe 
%System32%\alg32.exe 
%System32%\8.exe 
%System32%\system\.setupq\*.* 
%System32%\system\sysbacks\*.* 
%Documents and settings%\ 当前用户名 \local settings\temp\*.* 
……………
2 、新建注册表键值：
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UMWdfmgr\Description 
Value: String: " 启用 windows 用户模式驱动程序。 " 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UMWdfmgr\DisplayName 
Value: String: "Windows User Mode Driver" 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UMWdfmgr\ImagePath 
Value: Type: REG_EXPAND_SZ Length: 46 (0x2e) bytes 
rundll32.exe C:\WINDOWS\winamps. dll _start@16. 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msupdate 
Value: String: "%WINDOWS%\AntiAdwa.exe other" 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ 
Winlogon\Notify\sclgntfys\DllName 
Value: String: "%\WINDOWS%\sclgntfys.dll 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\0c4 
Value: String: "%WINDOWS%\AntiAdwa.exe other" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\cmdbcs 
Value: String: "%WINDOWS%\cmdbcs.exe " 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\cmdbs 
Value: String: "%WINDOWS%\cmds.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\javhavm 
Value: String: "%WINDOWS%\javhavm.exer" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ 
Run\KernelFaultcheck 
Value: String: "%WINDOWS%\system32\dumprep.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\mppds 
Value: String: "%WINDOWS%\mppds.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\pxdnd 
Value: String: "%Documents and settings%\ 当前用户名 \ 
local settings\temp\win4.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\shualai 
Value: String: "%WINDOWS%\shualai.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\testrun 
Value: String: "%WINDOWS%\testexe.exer" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\upxdndq 
Value: String: "%Documents and settings%\ 当前用户名 \ 
local settings\temp\upxdnd.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ 
Policies\Explorer\Run\sun 
Value: String: "%WINDOWS%\syssun1\svchost.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ 
Policies\Explorer\Run\wm 
Value: String: "%WINDOWS%\syswm7\svchost.exe"
4 、下载的病毒体
novel.exe会发起ARP 欺骗
注： % System% 是一个可变路径。病毒通过查询操作系统来决定当前 System 文件夹的位置。 Windows2000/NT 中默认的安装路径是 C:\Winnt\System32 ， windows95/98/me 中默认的安装路径是 C:\Windows\System ， windowsXP 中默认的安装路径是 C:\Windows\System32
清除方案：
1 、 使用安天木马防线可彻底清除此病毒 ( 推荐 ) 
2 、 手工清除请按照行为分析删除对应文件，恢复相关系统设置。 
(1) 使用安天木马防线断开网络，结束病毒进程： 
IEXPLORE.EXE 
novel.exe 
upnpsvc.exe 　 
(2) 删除并恢复病毒添加与修改的注册表键值： 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ 
Services\UMWdfmgr\Description 
Value: String: " 启用 windows 用户模式驱动程序。 " 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ 
Services\UMWdfmgr\DisplayName 
Value: String: "Windows User Mode Driver" 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ 
Services\UMWdfmgr\ImagePath 
Value: Type: REG_EXPAND_SZ Length: 46 (0x2e) bytes 
rundll32.exe C:\WINDOWS\winamps. dll _start@16. 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Run\msupdate 
Value: String: "%WINDOWS%\AntiAdwa.exe other" 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\ 
CurrentVersion\Winlogon\Notify\sclgntfys\DllName 
Value: String: "%\WINDOWS%\sclgntfys.dll 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Run\0c4 
Value: String: "%WINDOWS%\AntiAdwa.exe other" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Run\cmdbcs 
Value: String: "%WINDOWS%\cmdbcs.exe " 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Run\cmdbs 
Value: String: "%WINDOWS%\cmds.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Run\javhavm 
Value: String: "%WINDOWS%\javhavm.exer" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Run\KernelFaultcheck 
Value: String: "%WINDOWS%\system32\dumprep.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Run\mppds 
Value: String: "%WINDOWS%\mppds.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Run\pxdnd 
Value: String: "%Documents and settings%\ 当前用户 \ 
localsettings\temp\win4.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Run\shualai 
Value: String: "%WINDOWS%\shualai.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Run\testrun 
Value: String: "%WINDOWS%\testexe.exer" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Run\upxdndq 
Value: String: "%Documents and settings%\ 
当前用户名 \local settings\temp\upxdnd.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Policies\Explorer\Run\sun 
Value: String: "%WINDOWS%\syssun1\svchost.exe" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Policies\Explorer\Run\wm 
Value: String: "%WINDOWS%\syswm7\svchost.exe" 
(3) 删除病毒释放文件： 
%WinDir%\sclgntfys.dll 
%WinDir%\winamps.dll 
%WinDir%\SysSun1\Ghook.dll 
%WinDir%\SysSun1\svchost.exe 
%WinDir%\cmdbcs.exe 
%WinDir%\gv.dll 
%WinDir%\mppds.exe 
%WinDir%\javhavm.exe 
%WinDir%\msccrt.exe 
%WinDir%\rising390.exe 
%WinDir%\shualai.exe 
%WinDir%\winform.exe 
%System32%\upnpsvc.exe 
%System32%\systemt.exe 
%System32%\systemm.exe 
%System32%\SMSSS.exe 
%System32%\servet.exe 
%System32%\MSTCS.exe 
%System32%\alg32.exe 
%System32%\8.exe 
%WINDOWS%\syssun1\*.* 
%System32%\syswm7\*.* 
%System32%\system\.setupq\*.* 
%System32%\system\sysbacks\*.* 
%Documents and settings%\ 当前用户名 \ 
local settings\temp\*.* 
……………