每日病毒及木马播报(2008-05-15)

木马病毒 Trojan.Virantix.C
        根据墨者安全专家介绍，Trojan.Virantix.C 一个木马病毒，长度 71,168 字节,感染 Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000　系统，它结束杀毒软件，显示虚假信息，
下载执行恶意代码，
    当打开此病毒时，主要有以下危害：
    
    A 显示信息 
    B 生成文件
    系统目录\braviax.exe
    系统目录\dllcache\figaro.sys
    当前目录\delself.bat
    系统目录\univrs32.dat
    C 使用　figaro.sys　替换以下文件
    Win目录\drivers\beep.sys
    系统目录\dllcache\beep.sys
    系统目录\drivers\beep.sys
    D 创建注册表项
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"braviax" = "％System％\braviax.exe"
    使得病毒每次开机后自动执行
    E 修改以下注册表项，减低系统安全设置
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityCenter\"AntiVirusDisableNotify" = "01000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityCenter\"FirewallDisableNotify" <= "01000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityCenter\"UpdatesDisableNotify" = "01000000"
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\SecurityCenter\"AntiVirusDisableNotify" = "01000000"
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\SecurityCenter\"FirewallDisableNotify" = "01000000"
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\SecurityCenter\"UpdatesDisableNotify" = "01000000"
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Standa
    rdProfile\EnableFirewall" = "00000000"
    F 修改以下注册表项，该变internet设置
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\0\"1200" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\0\"1201" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\0\"1208" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\0\"1608" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\0\"1804" = "01000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\0\"2500" = "03000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\1\"1200" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\1\"1201" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\1\"1208" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\1\"1608" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\1\"1804" = "01000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\1\"2500" = "03000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\2\"1200" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\2\"1201" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\2\"1208" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\2\"1608" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\2\"1804" = "01000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\2\"2500" = "03000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3\"1200" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3\"1201" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3\"1208" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3\"1608" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3\"1804" = "01000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3\"2500" = "03000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\4\"1200" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\4\"1201" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\4\"1208" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\4\"1608" = "00000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\4\"1804" = "01000000"
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\4\"2500" = "03000000"
    G 修改注册表项
    HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Main\"EnableBrowserExtensions" = "yes"
    HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Main\"SearchBar" = "http://www.google.ie"
    HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Main\"SearchPage" = "http://www.google.com"
    HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Main\"StartPage" = "http://www.google.com"
    HKEY_LOCAL_MACHINE\Software\Microsoft\InternetExplorer\Main\"Default_Search_URL" = "http://www.google.ie"
    HKEY_LOCAL_MACHINE\Software\Microsoft\InternetExplorer\Main\"SearchPage" = "http://www.google.com"
    HKEY_LOCAL_MACHINE\Software\Microsoft\InternetExplorer\Main\"StartPage" = "http://www.google.com"
    HKEY_LOCAL_MACHINE\Software\Microsoft\InternetExplorer\Search\"SearchAssistant" = "http://www.google.com"
    H 从　http://www.softcashier.com/members/link[已删除]　下载执行其他病毒
墨者安全专家建议：
1、下载并安装“墨者安全专家”，并开启“革离术”并根据提示创建安全用户，保护自己的系统。
2、使用系统安全漏洞中心，检查系统漏洞，发现漏洞请点击“修复”完成漏洞修补。
3、养成良好的网络使用习惯，及时开启防火墙监控功能，切断病毒传播的途径，不给病毒以可乘之机。
4、没有安装杀毒软件的用户可以下载安装终身免费的正版“趋势反病毒软件”，并开启自动升级功能将病毒库更新为最新。
5、定期对系统进行扫描。