Win32.Troj.QQPass.rq

该病毒是一个QQ盗号木马。建议电脑用户升级病毒库查杀该病毒，以免中毒造成损失。

1、生成的文件
C:\WINNT\system32\QQhx.dat
C:\WINNT\system32\axvvuu.exe
C:\WINNT\system32\axvvuu.dll
C:\WINNT\system32\noruns.reg
D:\sxs.exe
D:\autorun.inf

2、添加注册表启动项
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
"aphkga"="C:\WINNT\system32\axvvuu.exe"

3、设置系统隐藏所有隐藏文件
HKLM\software\microsoft\windows\currentversion\explorer\advanced\folder\hidde

n\showall\CheckedValue SUCCESS "0"

4、尝试删除下列启动项
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\RavTask

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\KvMonXP

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\YLive.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\yassistse

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\KAVPersonal50

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NTdhcp
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Winhoxt
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\aphkga

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\yes

5、添加d盘自动播放启动病毒
autorun.inf
------------------------------
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe
------------------------------

6、该病毒在系统中安装类型为：WH_MOUSE，WH_KEYBOARD，WH_CALLWNDPROC的消息钩子

监视用户鼠标键盘等消息。其申请进程为：C:\WINNT\system32\axvvuu.exe

7、结束下列进程
SKYNET_PERSONAL_FIREWALL
KingsoftAntivirusScanProgram
TBMon.exe
kav32.exe
kvwsc.exe
CCAPP.exe
conime.exe
EGHOST.exe
KRegEx.exe
kavsvc.exe
VPTray.exe
RAVMON.exe
KavPFW.exe
SHSTAT.exe
RavTask.exe
TrojDie.kxp
Iparmor.exe
MAILMON.exe
MCAGENT.exe
KAVPLUS.exe
RavMonD.exe
Rtvscan.exe
Nvsvc32.exe
KVMonXP.exe
Kvsrvxp.exe
CCenter.exe
KpopMon.exe
RfwMain.exe
KWATCHUI.exe
MCVSESCN.exe
MSKAGENT.exe
kvolself.exe
KVCenter.kxp
kavstart.exe
RAVTIMER.exe
RRfwMain.exe
FireTray.exe
UpdaterUI.exe
KVSrvXp_1.exe
RavService.exe