SpamTool.Win32.Agent.u

該病毒運行後，從某網際網路地址下載病毒病毒體到本機運行，並添加註冊表自動運行項與系統服務項、修改 LSP ，以達到隨系統啟動的目的。通過內建的 SMTP 蠕蟲程式連線到網際網路 SMTP 伺服器，獲得需要偽造的郵件信息，進而大量傳送垃圾郵件，嚴重占用網路資源。

基本介紹

• 中文名：派送器
• 外文名：SpamTool.Win32.Agent.u
• 病毒類型：蠕蟲類
• 危害等級：5
• 加殼類型：UPX 變形殼

行為分析

衍生下列副本與檔案

%System32%\mfolpnzbz.dll

修改下列驅動檔案

%System32%\mfolpnzbz.dll

%System32%\dirvers\ndis.sys

新建註冊表鍵值

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ntldr.sys\DisplayName

Value: Type: REG_EXPAND_SZ Length: 10 (0xa) bytes ntldr.sys.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ntldr.sys\ImagePath

Value: Type: REG_EXPAND_SZ Length: 17 (0x11) bytes C:\ntldr.sys .

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WS2IFSL\DisplayName

Value: String: "Windows 套接字 2 .0 Non-IFS 服務提供程式支持環境 "

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WS2IFSL\ImagePath

Value: Type: REG_EXPAND_SZ Length: 41 (0x29) bytes

\SystemRoot\System32\drivers\ws2ifsl.sys.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000012\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000012\PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000013\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000013\PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000014\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000014\PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000015\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000015\PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\rsvpsp.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000016\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000016\PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\rsvpsp.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000017\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000017\PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000018\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000018\PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000019\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000019\PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000020\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000020\PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000021\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000021\PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000022\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000022\PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000023\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000023\PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

C:\WINDOWS\System32\mfolpnzbz.dll

修改下列註冊表

修改下列註冊表鍵值，破壞 LSP 。並可實現檢測網路啟動自身與蒐集用戶信息：

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000001\PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

C:\WINDOWS\System32\mfolpnzbz.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000002\PackedCatalogItem

C:\WINDOWS\System32\mfolpnzbz.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000003\PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

C:\WINDOWS\System32\mfolpnzbz.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000004\PackedCatalogItem

C:\WINDOWS\System32\mfolpnzbz.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\rsvpsp.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000005\PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

C:\WINDOWS\System32\mfolpnzbz.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\rsvpsp.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000006\PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

C:\WINDOWS\System32\mfolpnzbz.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000007\PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

C:\WINDOWS\System32\mfolpnzbz.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000008\PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

C:\WINDOWS\System32\mfolpnzbz.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000009\PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

C:\WINDOWS\System32\mfolpnzbz.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000010\PackedCatalogItem

C:\WINDOWS\System32\mfolpnzbz.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\

Protocol_Catalog9\Catalog_Entries\000000000011\PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

C:\WINDOWS\System32\mfolpnzbz.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%\system32\mswsock.dll

郵件

包含一張帶有連結的圖片，誘使用戶點擊：連結地址為某男性藥品網站首頁：

病毒可能傳送帶有附屬檔案的郵件

偽造郵件

向下列搜尋引擎地址提交查詢信息，從而獲得相關郵件信息，進而偽造郵件：

註： % System% 是一個可變路徑。病毒通過查詢作業系統來決定當前 System 資料夾的位置。 Windows2000/NT 中默認的安裝路徑是 C:\Winnt\System32 ， windows95/98/me 中默認的安裝路徑是 C:\Windows\System ， windowsXP 中默認的安裝路徑是 C:\Windows\System32 。

清除方法

1 、 使用安天木馬防線可徹底清除此病毒 ( 推薦 )

2 、 手工清除請按照行為分析刪除對應檔案，恢復相關係統設定。

(1) 使用 安天木馬防線 “進程管理”關閉病毒進程

刪除下列新建項：

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\

ntldr.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WS2IFSL\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\

Parameters\Protocol_Catalog9\Catalog_Entries\000000000012\

…………..

…………..

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\

Parameters\Protocol_Catalog9\Catalog_Entries\000000000023\

恢復下列修改項

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\

Parameters\Protocol_Catalog9\Catalog_Entries\000000000001\

PackedCatalogItem

…………..

…………..

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\

Parameters\Protocol_Catalog9\Catalog_Entries\0000000000011\

PackedCatalogItem

恢復鍵值為

%SystemRoot%\system32\mswsock.dll

(2) 重新啟動計算機

(3) 刪除病毒衍生檔案：

%System32%\mfolpnzbz.dll

%System32%\dirvers\ndis.sys