查看完整版本: 杀灭病毒广告程序yayyAsPJ.dll（TROJ_VUNDO.EJZ）查杀

杀灭病毒广告程序yayyAsPJ.dll（TROJ_VUNDO.EJZ）查杀

文件名称：yayyAsPJ.dll


文件大小：33,792 bytes


AV命名：TROJ_VUNDO.EJZ


加壳方式：UPX


文件MD5：AC58E584C8B8BCC90EA3B031BB625853


病毒类型：广告程序


主要行为：


1、释放文件：


C:\Windows\System32\yayyAsPJ.dll 25,600 bytes


2、添加注册表：


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13F20E4F-F379-41EA-8F80-CCAAE787362A}\InprocServer32]

(Default) = "%System%\yayyAsPJ.dll"

ThreadingModel = "Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Settings]

Time = F0 71 A3 1F 83 51 C8 01 00 00 00 00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

{13F20E4F-F379-41EA-8F80-CCAAE787362A} = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yayyAsPJ]

Asynchronous = 0x00000001

DllName = "yayyAsPJ.dll"

Impersonate = 0x00000000

Logon = "o"

Logoff = "f"


开机注入Explorer.exe和Winlogon.exe启动。