这只鸽子提示：中招后，贴日志求助的日子即将结束！做好系统基础安全防护是每个用户的当务之急。“基础安全防护”绝不仅仅是打几个补丁的问题。熟悉一两个性能好的安全软件的使用也是必要的。否则，中招后，你自己就着急吧！
这只鸽子的要害是c:\windows\winlogon.dll。如果想办法禁止这个dll加载运行，鸽子的文件全部可见
这只鸽子的要害是那个c:\windows\winlogon.dll。
如果用SSM禁止c:\windows\winlogon.dll加载运行，则这只鸽子的文件全部可见。
这是Movgear.exe中捆绑的一只灰鸽子（Movgear.exe样本来自安全12公里）。winlogon.exe的MD5值为：2de9f62c2b405e16cb66773747cf0f2d。
一、自Movgear.exe中提取winlogon.exe并将其植入系统后，autoruns、HijackThis、SREng日志中均无任何异常发现。
winlogon.exe释放的文件有：
1、c:\windows\winlogon.exe
2、c:\windows\winlogon.dll
3、c:\windows\winlogonKey.dll
这两个dll插入IE浏览器进程。
即使不打开IE浏览器，IceSword的进程列表中依然可见iexplore.exe。
c:\windows\winlogonKey.dll动态跟踪所有应用程序进程（一旦开启，立即插入。）
注意：即使显示隐藏文件，用WINDOWS的资源管理器也看不到灰鸽子释放的这三个文件。用IceSword才能看到。
二、注册表改动包括：
1、在HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
添加：winlogon.exe（指向c:\windows\winlogon.exe）
2、在HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping
添加：
"{92780B25-18CC-41C8-B9BE-3C9C571A8263}"=dword:00002002
"{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6}"=dword:00002002
"{FB5F1910-F110-11d2-BB9E-00C04F795683}"=dword:00002001
3、在HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Connection Wizard
添加："Completed"=hex:01,00,00,00
4、在HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
添加：
"ITBarLayout"=hex:11,00,00,00,5c,00,00,00,00,00,00,00,34,00,00,00,1f,00,00,00,56,\
00,00,00,01,00,00,00,20,07,00,00,a0,0f,00,00,05,00,00,00,62,05,\
00,00,26,00,00,00,02,00,00,00,21,07,00,00,a0,0f,00,00,04,00,00,\
00,21,01,00,00,a0,0f,00,00,03,00,00,00,20,03,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ |
