彻底清除Infostealer.Gampass病毒

<BR><P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-ALIGN: left; mso-pagination: widow-orphan" align=left><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">&nbsp;&nbsp;&nbsp; </SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">前段时间有个同事说他的诺顿不停的出现高危警报对话框，关闭了又弹出，反复如此，严重影响了他的工作，请我帮忙检查一下是不是中了<FONT color=#000000>病毒</FONT>。</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt"><?xml:namespace prefix = o ns = "urn:schemas-<a
href=http://detail.zol.com.cn/mice_index/subcate32_364_list_1.html
style=text-decoration:underline
target=_blank>microsoft</a>-com:office:office" /><o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-ALIGN: left; mso-pagination: widow-orphan" align=left><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">&nbsp;&nbsp;&nbsp; </SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">我看了警报上提示的内容，是一个名为</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">Infostealer.Gampass</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">的病毒。从名字上看，应该是个盗取<FONT color=#000000>游戏</FONT>密码的病毒，从现象上看，好像对系统中的文件并没有什么影响，系统运行也不慢，只是诺顿不断弹出警报对话框确实是个问题，于是更新了病毒库，在文件选项中选择显示所有文件，再重新启动到安全模式下全盘扫描。并告诉同事完成后重启电脑就</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">OK</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">。</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt"><o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-ALIGN: left; mso-pagination: widow-orphan" align=left><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">&nbsp;&nbsp;&nbsp; </SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">本以为是个小病毒，诺顿杀杀应该就没问题了。结果一会同事打来电话说诺顿又开始弹出警报，还是那个病毒。看样子是在注册表中隐藏了什么自启动的东东，说不定就是这个病毒的主体文件，诺顿不行，只有手动来清除了。</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt"><o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-ALIGN: left; mso-pagination: widow-orphan" align=left><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">&nbsp;&nbsp;&nbsp; </SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">首先检查各分区根目录，没有发现</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">autorun.inf</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">的目录或可疑的可执行文件。</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">c:\windows</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">和</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">c:\windows\system32</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">两个系统目录，也是重点，发现下面有很多</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">"</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">数字</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">.exe"</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">或</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">"</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">数字</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">+</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">字母</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">.exe"</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">的文件以及同名的</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">.dll</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">文件，估计是病毒自动生成的，但这些绝对不是主体病毒文件，所以估计删除了也没太大作用，还是先删了再说。</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt"><o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-ALIGN: left; mso-pagination: widow-orphan" align=left><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">&nbsp;&nbsp;&nbsp; </SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">病毒应该隐藏得更深一些。</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt"><o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-ALIGN: left; mso-pagination: widow-orphan" align=left><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">&nbsp;&nbsp;&nbsp; </SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">接着开始检查注册表。</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt"><o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-ALIGN: left; mso-pagination: widow-orphan" align=left><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">&nbsp;&nbsp;&nbsp; </SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">检查</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN<o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-ALIGN: left; mso-pagination: widow-orphan" align=left><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN<o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-ALIGN: left; mso-pagination: widow-orphan" align=left><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN<o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-ALIGN: left; mso-pagination: widow-orphan" align=left><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN<o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-ALIGN: left; mso-pagination: widow-orphan" align=left><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">&nbsp;&nbsp;&nbsp; </SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">四个键值下面的可疑程序，在后面两个键下面，果然发现如下的项有问题：</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt"><o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-INDENT: 21.75pt; TEXT-ALIGN: left; mso-pagination: widow-orphan" align=left><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">C:\windows\system32\winbill*.dll, c:\program files\internet explorer\use19.dll<o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-INDENT: 15pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-char-indent-count: 1.5" align=left><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">其中的</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">*</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">代表数字。</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt"><o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-INDENT: 10pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-char-indent-count: 1.0" align=left><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">删除和上面两个文件有关的键，此时不能删除这两个文件。重启电脑进入安全模式，删除以上两个文件（在</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">c:\program files\internet explorer\</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">下还发现一个</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt">use32.dll</SPAN><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">的文件，同样删掉。），这就是病毒的主体文件。再次全盘扫描，清除系统目录下的病毒尸体。重新启动，诺顿再也没有弹出警报。</SPAN><SPAN lang=EN-US style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: Tahoma; mso-font-kerning: 0pt"><o:p></o:p></SPAN></P>
<P class=MsoNormal style="MARGIN: 0cm 0cm 0pt; WORD-BREAK: break-all; TEXT-INDENT: 10pt; TEXT-ALIGN: left; mso-pagination: widow-orphan; mso-char-indent-count: 1.0" align=left><SPAN style="FONT-SIZE: 10pt; COLOR: #333333; FONT-FAMILY: 宋体; mso-font-kerning: 0pt; mso-ascii-font-family: Tahoma; mso-hansi-font-family: Tahoma; mso-bidi-font-family: Tahoma">分析了一下，这个病毒实际是个间谍<FONT color=#000000>软件</FONT>，对系统没有太大影响和破坏力。诺顿可以查出这个病毒，也可以抑制，但由于病毒在系统启动时就加载了，所以诺顿无法彻底清除，故只能采用手动与自动相结合的办法来杀毒了。</SPAN></P> <BR>