HackTool.Win32.OneKeyRe.A

它以文件的形式出现在系统中，可能是其他恶意软件投放的，或者是用户在访问恶意网站时无意中下载的。

新病毒详细信息

它以文件的形式出现在系统中，可能是其他恶意软件投放的，或者是用户在访问恶意网站时无意中下载的。

安装

它植入下列文件：

• %System Root%\Boot\BCD_.LOG{Number}
• %System Root%\okldr
• %System Root%\okldr.mbr
• %System Root%\YlmF.ima
• %System Root%\Ghost.ba_
• %User Temp%\Ghost.exe
• %User Temp%\WimaDll.dll
• {Backup Path}\{Backup Filename} → set by the user when creating a backup of the system

(注意： %System Root% 是根文件夹，通常位于 C:\。它也是操作系统所在的位置。. %User Temp% 是当前用户的 Temp 文件夹。通常位于 C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)、XP 和 Server 2003(32-bit))、C:\Users\{user name}\AppData\Local\Temp (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit)。)

它添加下列进程：

• %System%\BCDEdit.exe /export %System Root%\Boot\BCD_
• %System%\BCDEdit.exe /create {GUID} /d "OneKey Recovery" /application bootsector
• %System%\BCDEdit.exe /set {GUID} path \okldr.mbr
• %System%\BCDEdit.exe /displayorder {GUID} /addlast
• %System%\BCDEdit.exe /timeout 3
• %System%\BCDEdit.exe /default {GUID}
• %System%\BCDEdit.exe /set {GUID} device partition=\Device\HarddiskVolume1

(注意： %System Root% 是根文件夹，通常位于 C:\。它也是操作系统所在的位置。)

其他详细信息

该程序执行以下操作：

• The dropped Ghost.ba_ contains the following batch commands:
  • Ghost.exe -noide -nousb -clone,mode=pdump,src="{Source Partition Index}",dst="{Destination Partition Index}\Ghost\Bak.GHO" -fr restart
• It is a system backup and restore tool that allows users to create a full system image and restore it when needed.
• It integrates Norton Ghost as its core engine for disk imaging and restoration.
• It offers options to restore or back up the operating system.
• It allows users to install or repair the recovery system.
• It contains a field that allows users to select or input the location of the backup image file.
• It displays all detected drives and partitions which includes the following information:
  • Partition Sequence
  • Volume Label
  • File System Format
  • Free Space
  • Total Capacity
• It allows users to select specific drives or partitions for restoration or backup.
• It allows users to search for backup files such as .GHO within a specified directory depth.
• It offers the following compression levels:
  • No Compression
  • Fast Compression
  • High Compression
  • Maximum Compression
• Users can choose between the following Ghost versions:
  • 11.0.2
  • 11.5.1
  • Other Ghost executables provided by the user
• It has an option to disable access to IDE devices during backup operations.
• It allows users to choose between the operating system boot menu or a hotkey for recovery.
• It provides the following hotkey options for triggering the recovery process during boot:
  • F7
  • F8
  • F10
  • F11
  • F12