病毒搜索：
首页
A
B
C
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Z
0-9
other
Win32.Troj.xfilter是什么病毒信息？
Win32.Troj.xfilter 病毒信息
病毒别名：
N/A
中文名称：
N/A
威胁级别：
★★
处理时间：
N/A
病毒类型：
木马
影响系统：
Win9x/Win2000/WinXP/Win2003
病毒行为：
编写工具： Delphi
传染条件:
发作条件:
系统修改:
释放文件到 %System%
jxhwxj.dll 和 c:filedebug
修改注册表，添加：
[HKEY_CLASSES_ROOTQPWorkFile]
[HKEY_CLASSES_ROOTQPWorkFile]
"EFile"="052034074052039074047117050044088244174069155003143226175040196060132196115114202169224193030068236097086176002045218004223"
[HKEY_CLASSES_ROOTQPWorkFile]
"DFile"="051036066052037069063176050034084104161066198094084009070246077096139208096164230189003123109239045161109039040061175072044099"
[HKEY_CLASSES_ROOTQPWorkFile]
"UC"="052039077052039077039086050045093239037049154173172027136176"
[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHook]
[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHook]
@="Maihook7003"
[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHookClsid]
[HKEY_CLASSES_ROOTRJXHWXJ.ShellExecuteHookClsid]
@="{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}"
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}]
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}]
@="Maihook7003"
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}InprocServer32]
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}InprocServer32]
@="C:\WINDOWS\SYSTEM\RJXHWXJ.DLL"
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}InprocServer32]
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}ProgID]
[HKEY_CLASSES_ROOTCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}ProgID]
@="RJXHWXJ.ShellExecuteHook"
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionexplorerShellExecuteHooks]
"{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}"="Maihook7003"
[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]
[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]
"EFile"="052034074052039074047117050044088244174069155003143226175040196060132196115114202169224193030068236097086176002045218004223"
[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]
"DFile"="051036066052037069063176050034084104161066198094084009070246077096139208096164230189003123109239045161109039040061175072044099"
[HKEY_LOCAL_MACHINESoftwareCLASSESQPWorkFile]
"UC"="052039077052039077039086050045093239037049154173172027136176"
[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHook]
[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHook]
@="Maihook7003"
[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHookClsid]
[HKEY_LOCAL_MACHINESoftwareCLASSESRJXHWXJ.ShellExecuteHookClsid]
@="{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}"
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}]
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}]
@="Maihook7003"
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}InprocServer32]
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}InprocServer32]
@="C:\WINDOWS\SYSTEM\RJXHWXJ.DLL"
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}InprocServer32]
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}ProgID]
[HKEY_LOCAL_MACHINESoftwareCLASSESCLSID{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}ProgID]
@="RJXHWXJ.ShellExecuteHook"
发作现象:
盗窃边锋、QQ密码，并发送给木马作者的邮箱。可以杀常见国产杀毒软件的进程。
特别说明:
点击数：
杀杀毒病毒信息库 2007 www.shashadu.com
联系QQ：669044
