Ransom.Win32.NOESCAPE.D
Win32:Evo-gen [Trj] (AVAST)
Windows
恶意软件类型:
Ransomware
有破坏性?:
没有
加密?:
In the Wild:
是的
概要
它以其他恶意软件释放的文件或用户访问恶意网站时不知不觉下载的文件的形式到达系统。
技术详细信息
新病毒详细信息
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
安装
它植入下列文件:
- %Application Data%\wallpaper.jpg
(注意: %Application Data% 是当前用户的 Application Data 文件夹,通常位于 C:\Windows\Profiles\{user name}\Application Data (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Application Data (Windows NT)、C:\Documents and Settings\{user name}\Local Settings\Application Data (Windows 2000(32-bit)、XP 和 Server 2003(32-bit)) 和 C:\Users\{user name}\AppData\Roaming (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit))。)
它添加下列进程:
- wmic SHADOWCOPY DELETE /nointeractive
- wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
- wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
- wbadmin DELETE BACKUP -deleteOldest
- wbadmin DELETE BACKUP -keepVersions:0
- vssadmin Delete Shadows /All /Quiet
- bcdedit /set {default} recoveryenabled No
- bcdedit /set {default} bootstatuspolicy ignoreallfailures
它添加下列互斥条目,确保一次只会运行一个副本:
- Global\{Hash of Machine GUID}
其他系统修改
它修改下列注册表项:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = 0
(Note: The default value data of the said registry entry is 1.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorAdmin = 0
(Note: The default value data of the said registry entry is 5.)
它将系统的桌面壁纸设置为下列图像:
- %Application Data%\wallpaper.jpg
进程终止
它终止在受感染的系统上运行的下列服务:
- Culserver
- DefWatch
- GxBlr
- GxCIMgr
- GxCVD
- GxFWD
- GxVss
- QBCFMonitorService
- QBIDPService
- RTVscan
- SavRoam
- VMAuthdService
- VMUSBArbService
- VMnetDHCP
- VMwareHostd
- backup
- ccEvtMgr
- ccSetMgr
- dbeng8
- dbsrv12
- memtas
- mepocs
- msexchange
- msmdsrv
- sophos
- sql
- sqladhlp
- sqlagent
- sqlbrowser
- sqlservr
- sqlwriter
- svc$
- tomcat6
- veeam
- vmware-
- converter
- vmware-usbarbitator64
- vss
它终止在受感染的系统内存中运行的下列进程:
- 360doctor
- 360se
- Culture
- Defwatch
- GDscan
- MsDtSrvr
- QBCFMonitorService
- QBDBMgr
- QBIDPService
- QBW32
- RAgui
- RTVscan
- agntsvc
- agntsvcencsvc
- agntsvcisqlplussvc
- anvir
- anvir64
- apache
- axlbridge
- backup
- ccleaner
- ccleaner64
- dbeng50
- dbsnmp
- encsvc
- excel
- far
- fdhost
- fdlauncher
- httpd
- infopath
- isqlplussvc
- java
- kingdee
- msaccess
- msftesql
- mspub
- mydesktopqos
- mydesktopservice
- mysqld-nt
- mysqld-opt
- mysqld
- ncsvc
- ocautoupds
- ocomm
- ocssd
- onedrive
- onenote
- oracle
- outlook
- powerpnt
- procexp
- qbupdate
- sqbcoreservice
- sql
- sqlagent
- sqlbrowser
- sqlmangr
- sqlserver
- sqlservr
- sqlwriter
- steam
- supervise
- synctime
- taskkill
- tasklist
- tbirdconfig
- thebat
- thunderbird
- tomcat
- tomcat6
- u8
- ufida
- visio
- wdsw
- fsafe
- winword
- wordpad
- wuau
- clt
- wxServer
- wxServerView
- xfssvccon
信息窃取
它收集下列数据:
- Host Name
- IP Address
其他详细信息
该程序执行以下操作:
- Empties Recycle Bin
- It encrypts files from local drives, removable drives, and network shares.
解决方案
Step 2
对于Windows ME和XP用户,在扫描前,请确认已禁用系统还原功能,才可全面扫描计算机。
Step 3
请注意,在执行此恶意软件/间谍软件/灰色软件期间,并非所有文件、文件夹、注册表项和条目都安装在您的计算机上。这可能是由于安装不完整或其他操作系统条件造成的。如果找不到相同的文件/文件夹/注册表信息,请继续下一步。
Step 4
Restore this modified registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator’s help. You may also check out this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
- EnableLUA = 0
- EnableLUA = 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
- ConsentPromptBehaviorAdmin = 0
- ConsentPromptBehaviorAdmin = 0
Step 5
搜索和删除该文件
- %Application Data%\wallpaper.jpg
Step 6
使用趋势科技产品扫描计算机,并删除检测到的Ransom.Win32.NOESCAPE.D文件 如果检测到的文件已被趋势科技产品清除、删除或隔离,则无需采取进一步措施。可以选择直接删除隔离的文件。请参阅知识库页面了解详细信息。
Step 7
从备份中还原被加密的文件。