标题：Trojan.Win32.Qhost.it
概要
病毒名称： Trojan.Win32.Qhost. it 
中文名称： MHost 
病毒类型： 木马类 
文件 MD5： 21FE5BDA68A6D95AF49ACBCD2877D2D6 
公开范围： 完全公开 
危害等级： 3 
文件长度： 212,992 字节 
感染系统： Win9X以上系统 
开发工具： Microsoft Visual C++ 6.0 
病毒描述
： 
该病毒运行后，衍生病毒文件到系统程序目录下。添加注册表自动运行项以随机引导病毒体，从某服务器下载压缩文件，释放后自动运行。修改 Host 文件，以阻止用户查询病毒信息。 
行为分析
： 
1 、衍生下列副本与文件： 
%System32%\ltcyvsj.dll 
%System32%\abcdefgh.dll 
%WinDir%\msdrvctrl.exe 
%WinDir%\msdrv.exe 
%WinDir%\iedrives.dll 
%System32%\msdrivers\driverpp.sys 
%System32%\msdrivers\iedrives.dll 
%System32%\msdrivers\msdrv.exe 
%System32%\msdrivers\msdrvctrl.exe 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\di.exe 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\driverpp.sys 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\iedrives.dll 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\install.bat 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\install2.bat 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\maindll.dll 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\msdrv.exe 
2 、新建注册表键值： 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ 
CurrentVersion\policies\Explorer\Run\msdrvctrl 
Value: String: "C:\WINDOWS\msdrvctrl.exe" 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ 
CurrentVersion\Run\Svcs: Dnscache 
Value: String: "C:\DOCUME~1\ 当前用户名 \LOCALS~1\Temp\17292\explorer.exe" 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WS2IFSL\DisplayName 
Value: String: "Windows 套接字 2 .0 Non-IFS 服务提供程序支持环境 " 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WS2IFSL\ImagePath 
Value: Type: REG_EXPAND_SZ Length: 41 (0x29) bytes 
\SystemRoot\System32\drivers\ws2ifsl.sys. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\driverpp\DisplayName 
Value: String: "Plug and Play Support Driver" 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\driverpp\ImagePath 
Value: Type: REG_EXPAND_SZ Length: 46 (0x2e) bytes 
\C:\WINDOWS\system32\msdrives\driverpp.sys. 
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ 
{2C1CD3D7-86AC-4068-93BC-A02304B60787}\InProcServer32\@ 
Value: String: "C:\WINDOWS\System32\oqjje.dll" 
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ 
{2C1CD3D7-86AC-4068-93BC-A02304B60787}\InProcServer32\ThreadingModel 
Value: String: "Apartment" 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ 
Explorer\SharedTaskScheduler\{2C1CD3D7-86AC-4068-93BC-A02304B60787} 
Value: String: "DCOM Server 60787" 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ 
ShellServiceObjectDelayLoad\DCOM Server 60787 
Value: String: "{2C1CD3D7-86AC-4068-93BC-A02304B60787}" 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\ 
Parameters\Protocol_Catalog9\Catalog_Entries\000000000012\PackedCatalogItem 
Value: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\ 
Parameters\Protocol_Catalog9\Catalog_Entries\000000000013\PackedCatalogItem 
Value: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\ 
Parameters\Protocol_Catalog9\Catalog_Entries\000000000014\PackedCatalogItem 
Value: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\ 
Parameters\Protocol_Catalog9\Catalog_Entries\000000000015\PackedCatalogItem 
Value: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\rsvpsp.dll . 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\ 
Parameters\Protocol_Catalog9\Catalog_Entries\000000000016\PackedCatalogItem 
Value: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\rsvpsp.dll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\ 
Parameters\Protocol_Catalog9\Catalog_Entries\000000000017\PackedCatalogItem 
Value: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\ 
Parameters\Protocol_Catalog9\Catalog_Entries\000000000018\PackedCatalogItem 
Value: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\ 
Protocol_Catalog9\Catalog_Entries\000000000019\PackedCatalogItem 
Value: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\ 
Protocol_Catalog9\Catalog_Entries\000000000020\PackedCatalogItem 
Value: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\ 
Parameters\Protocol_Catalog9\Catalog_Entries\000000000021\PackedCatalogItem 
Value: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\ 
Parameters\Protocol_Catalog9\Catalog_Entries\000000000022\PackedCatalogItem 
Value: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\ 
Parameters\Protocol_Catalog9\Catalog_Entries\000000000023\PackedCatalogItem 
Value: Type: REG_BINARY Length: 888 (0x378) bytes 
abcdefgh.dll.system32\mswsock.dll. 
3 、修改下列注册 LSP 项： 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000001\PackedCatalogItem 
New: Type: REG_BINARY Length: 888 (0x378) bytes 
abcdefgh.dll.system32\mswsock.dll. 
Old: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000002\PackedCatalogItem 
New: Type: REG_BINARY Length: 888 (0x378) bytes 
abcdefgh.dll.system32\mswsock.dll. 
Old: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000003\PackedCatalogItem 
New: Type: REG_BINARY Length: 888 (0x378) bytes 
abcdefgh.dll.system32\mswsock.dll. 
Old: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000004\PackedCatalogItem 
New: Type: REG_BINARY Length: 888 (0x378) bytes 
abcdefgh.dll.system32\mswsock.dll. 
Old: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\rsvpsp.dll .. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000005\PackedCatalogItem 
New: Type: REG_BINARY Length: 888 (0x378) bytes 
abcdefgh.dll.system32\mswsock.dll. 
Old: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\rsvpsp.dll .. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000006\PackedCatalogItem 
New: Type: REG_BINARY Length: 888 (0x378) bytes 
abcdefgh.dll.system32\mswsock.dll. 
Old: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000007\PackedCatalogItem 
New: Type: REG_BINARY Length: 888 (0x378) bytes 
abcdefgh.dll.system32\mswsock.dll. 
Old: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000008\PackedCatalogItem 
New: Type: REG_BINARY Length: 888 (0x378) bytes 
abcdefgh.dll.system32\mswsock.dll. 
Old: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000009\PackedCatalogItem 
New: Type: REG_BINARY Length: 888 (0x378) bytes 
abcdefgh.dll.system32\mswsock.dll. 
Old: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000010\PackedCatalogItem 
New: Type: REG_BINARY Length: 888 (0x378) bytes 
abcdefgh.dll.system32\mswsock.dll. 
Old: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000011\PackedCatalogItem 
New: Type: REG_BINARY Length: 888 (0x378) bytes 
abcdefgh.dll.system32\mswsock.dll. 
Old: Type: REG_BINARY Length: 888 (0x378) bytes 
%SystemRoot%\system32\mswsock.dll 
4 、病毒修改 host 文件，试图阻止用户连接把反病毒厂商 Web： 
5 、从下列服务器下载压缩文件： 
6*.1*1.1*5.1*9/data15.tgz HTTP:80 
注： % System% 是一个可变路径。病毒通过查询操作系统来决定当前 System 文件夹的位置。 Windows2000/NT 中默认的安装路径是 C:\Winnt\System32 ， windows95/98/me 中默认的安装路径是 C:\Windows\System ， windowsXP 中默认的安装路径是 C:\Windows\System32 。 
-------------------------------------------------------------------------------- 
清除方案
： 
1 、 使用安天木马防线可彻底清除此病毒 ( 推荐 ) 
2 、 手工清除请按照行为分析删除对应文件，恢复相关系统设置。 
(1) 删除病毒添加的注册表项 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ 
CurrentVersion\policies\Explorer\Run\msdrvctrl 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ 
CurrentVersion\Run\Svcs: Dnscache 
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ 
{2C1CD3D7-86AC-4068-93BC-A02304B60787} 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current 
Version\ShellServiceObjectDelayLoad\DCOM Server 60787 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000012\PackedCatalogItem 
………………. 
………………. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000023\PackedCatalogItem 
参考“修改注册表项”修改下列注册表项为原值： 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
00000000001\PackedCatalogItem 
………………. 
………………. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 
WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ 
000000000011\PackedCatalogItem 
(2) 重新启动计算机 
(3) 删除病毒释放文件 
%System32%\ltcyvsj.dll 
%System32%\abcdefgh.dll 
%WinDir%\msdrvctrl.exe 
%WinDir%\msdrv.exe 
%System32%\msdrivers\driverpp.sys 
%System32%\msdrivers\iedrives.dll 
%System32%\msdrivers\msdrv.exe 
%System32%\msdrivers\msdrvctrl.exe 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\di.exe 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\driverpp.sys 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\iedrives.dll 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\install.bat 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\install2.bat 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\maindll.dll 
%\DOCUME~1\% 当前用户名 \LOCALS~1\Temp\msdrv.exe