杀毒 ysv15.exe/dlod15.exe/ctfmon.exe/svchost.exe/midimap*.dll

最新推荐文章于 2025-12-12 12:48:45 发布

最新推荐文章于 2025-12-12 12:48:45 发布 · 324 阅读

文章标签：

本文详细介绍了一种复杂的病毒入侵案例，病毒通过替换关键系统文件如explorer.exe和ctfmon.exe来实现其目的，并利用多种手段隐藏自身。文章提供了具体的感染文件列表及修改注册表项的方法。

中毒症状：电脑莫名重启
病毒把windows目录下的explorer.exe复制到了system32目录下，不清楚是否已被病毒感染；在windows目录下建立了假的ctfmon.exe和svchost.exe，真品在system32目录下，而且文件大小也不一致。其他一大堆小喽啰文件见下面的列表中。
该windows目录下的scfmon.exe&svchost.exe 和 system32目录下的explorer.exe文件在安全模式下也不容易清理，须使用冰刃等工具。

autoruns记录中的病毒信息，可以使用autoruns清理,也可依此手动清理注册表

HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon/Shell
+ Explorer.exe,ysv15.exe Windows Explorer Microsoft Corporation c:/windows/system32/explorer.exe
HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/ShellServiceObjectDelayLoad
+ midimaptl Microsoft MIDI Mapper Plugin Microsoft Corporation c:/windows/system32/midimaptl.dll
+ midimapwd Microsoft MIDI Mapper Plugin Microsoft Corporation c:/windows/system32/midimapwd.dll
HKLM/Software/Microsoft/Windows/CurrentVersion/Explorer/ShellExecuteHooks
+ apfocdet.dll c:/windows/system32/apfocdet.dll
+ cedafb.dll c:/windows/system32/cedafb.dll
+ hhrdxd.dll c:/windows/system32/hhrdxd.dll
+ jdsaex.dll c:/windows/system32/jdsaex.dll
+ jhrcar.dll c:/windows/system32/jhrcar.dll
+ midimaptl.dll Microsoft MIDI Mapper Plugin Microsoft Corporation c:/windows/system32/midimaptl.dll
+ midimapwd.dll Microsoft MIDI Mapper Plugin Microsoft Corporation c:/windows/system32/midimapwd.dll
+ mndhddwd.dll c:/windows/system32/mndhddwd.dll
+ mndsfsrv.dll c:/windows/system32/mndsfsrv.dll
+ mnmhfsrv.dll c:/windows/system32/mnmhfsrv.dll
+ mpmydapi.dll c:/windows/system32/mpmydapi.dll
+ nhmxbjkl.dll c:/windows/system32/nhmxbjkl.dll
+ pedadt.dll c:/windows/system32/pedadt.dll
+ rfdswc.dll c:/windows/system32/rfdswc.dll
+ sgrefg.dll c:/windows/system32/sgrefg.dll
+ wrqszl.dll c:/windows/system32/wrqszl.dll
+ yxcschlp.dll c:/windows/system32/yxcschlp.dll
+ zdesfx.dll c:/windows/system32/zdesfx.dll
+ zgfdet.dll c:/windows/system32/zgfdet.dll
HKLM/Software/Microsoft/Windows/CurrentVersion/Explorer/Browser Helper Objects
+ {27AC9076-C898-B098-D098-A18319080972} c:/windows/system32/nhmxbjkl.dll
+ {35671234-7890-ABCD-CDEF-567801237653} c:/windows/system32/yxcschlp.dll
+ {3E035987-F585-68D1-AC28-98FA58E459E3} c:/windows/system32/apfocdet.dll
+ {4629FF4F-ACDB-5C90-A098-FACB3456A264} c:/windows/system32/mpmydapi.dll
+ {4C648541-1025-9650-9057-6541258720C4} c:/windows/system32/mndhddwd.dll
+ {67FD640A-158F-48AC-FD14-1597F14A9776} c:/windows/system32/mndsfsrv.dll
+ {6C8D1401-A58D-A81C-CD24-A5915C4517C6} c:/windows/system32/mnmhfsrv.dll
HKLM/System/CurrentControlSet/Services
+ axd214fo File not found: C:/WINDOWS/System32/Drivers/axd214fo.sys
+ HiddFldy c:/windows/system32/d32dx9.sys
HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Windows/Appinit_Dlls
+ nhmxbjkl.dll c:/windows/system32/nhmxbjkl.dll
+ SysDaJHv.dll Windows XP MSPLAY API DLL Microsoft Corporation c:/windows/system32/sysdajhv.dll
+ SysWmWacz.dll Windows XP MSPLAY API DLL Microsoft Corporation c:/windows/system32/syswmwacz.dll
+ SysZxacC.dll Windows XP MSPLAY API DLL Microsoft Corporation c:/windows/system32/syszxacc.dll

补充SREng记录中的隐藏进程

隐藏进程
[2472] C:/WINDOWS/system32/dlod15.exe

两个位于C:/windows/目录下的病毒体，假冒scvhost.exe和ctfmon.exe

[C:/WINDOWS/svchost.exe] [Microsoft Corporation, 6, 0, 2900, 2180]
MD5值：f09dcd72f53931d3946fcfa384d7c51a
文件大小：976896Byte
C:/WINDOWS/ctfmon.exe
MD5值：a52619ae2702506a346888db5768bdeb
文件大小：5076Byte

C:/windows/system32目录下的病毒体

C:/windows/system32/的目录
2004-08-08 11:20 535,560 apfocdet.dll
2008-06-01 11:20 23,648 biuw13.exe
2008-06-01 11:20 23,444 bwbz8.exe
2008-06-01 11:21 225,792 cedafb.dll
2008-06-01 11:21 6,592 d32dx9.sys
2008-06-01 11:21 23,724 dlod15.exe
2008-06-01 10:43 23,444 eytr8.exe
2004-08-08 11:20 520 gpfoadet.sys
2004-08-08 11:20 520 gsdhadwd.sys
2008-06-01 11:20 232,960 hhrdxd.dll
2004-08-08 11:21 14,979 isdsasrv.exe
2004-08-08 11:20 17,465 ismhasrv.exe
2008-06-01 11:21 215,040 jdsaex.dll
2008-06-01 11:21 218,624 jhrcar.dll
2004-08-08 11:20 15,674 lpfoadet.exe
2004-08-08 11:21 15,666 lpmxajkl.exe
2001-06-01 11:20 288 midimaptl.dat
2001-06-01 11:20 20,768 midimaptl.dll
2001-06-01 11:20 288 midimapwd.dat
2001-06-01 11:20 21,792 midimapwd.dll
2004-08-08 11:20 536,072 mndhddwd.dll
2004-08-08 11:21 533,512 mndsfsrv.dll
2004-08-08 11:20 538,120 mnmhfsrv.dll
2004-08-08 11:20 535,560 mpmydapi.dll
2004-08-08 11:21 535,560 nhmxbjkl.dll
2008-06-01 10:27 23,648 nkjj13.exe
2008-06-01 11:21 225,792 pedadt.dll
2008-06-01 11:15 67,990 perfc009.dat
2008-06-01 11:15 431,832 perfh009.dat
2004-08-08 11:20 16,344 pldhadwd.exe
2008-06-01 10:27 23,444 pnru8.exe
2008-06-01 11:15 181,510 prfc0804.dat
2008-06-01 11:15 359,366 prfh0804.dat
2008-06-01 10:44 23,648 rcqw13.exe
2008-06-01 11:21 250,880 rfdswc.dll
2004-08-08 11:21 520 rnmxajkl.sys
2008-06-01 11:20 218,624 sgrefg.dll
2004-08-08 11:20 15,959 simyaapi.exe
2004-08-08 11:21 520 smdsbsrv.sys
2004-08-08 11:20 520 smmhbsrv.sys
2004-08-08 11:20 520 spmybapi.sys
2008-06-01 11:20 19,113 SysDaJHv.dll
2008-06-01 11:20 18,714 SysWmWacz.dll
2008-06-01 11:20 18,888 SysZxacC.dll
2008-06-01 10:44 23,724 uysv15.exe
2008-06-01 10:26 2,206 wpa.dbl
2008-06-01 11:21 225,792 wrqszl.dll
2008-06-01 11:21 24 wymxajkl.sys
2008-06-01 10:43 23,284 xasr6.exe
2004-08-08 11:21 520 xzcsbhlp.sys
2004-08-08 11:21 533,512 yxcschlp.dll
2008-06-01 10:27 23,284 yydh6.exe
2008-06-01 11:20 218,624 zdesfx.dll
2008-06-01 11:20 229,376 zgfdet.dll
2008-06-01 11:20 23,284 zmph6.exe
2004-08-08 11:21 14,915 zxcsahlp.exe
2004-08-08 10:44 14,915 zxcsahlp.exe

上面的文件不一定完全对应，大部分都是隐藏的，还加了系统属性。还有你应该根据你中毒的时间搜寻出这些个文件，一般中一次所中的病毒体文件的创建时间应该是一致的。注意，不是所有的病毒体创建日期都一致，但是如果你确定了一个病毒体，那么与这个病毒体创建时间一致的文件都要注意了。