病毒现象：CPU占用接近100%，出现进程game1~game13，局域网报IP冲突后掉线。根据对Gameservet.exe病毒样本分析，方舟广谱疫苗已对此病毒文件加以提取，经测试完全可以防范木马下载器。

方舟广谱疫苗下载地址：/view-398.html

病毒行为及手工清除：

File: Gameservet.exe
Size: 18432 bytes
MD5: BA4A429C23099F62EEE31699D5E920F8
SHA1: AA0713E2DEF90CE7A1FB4B49717ECE7CB2621C1D
CRC32: F68BFF78
加壳方式 UPX 0.89.6 - 1.02 / 1.05 - 1.24

运行后建立服务
WindowsGame

HKLM\SYSTEM\CurrentControlSet\Services\WindowsGame\Security\Security: 01 00 14 80 90 00 00 00 9C 00

00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01

00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00

18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00

00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01

00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\SYSTEM\CurrentControlSet\Services\WindowsGame\Type: 0x00000110
HKLM\SYSTEM\CurrentControlSet\Services\WindowsGame\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\WindowsGame\ErrorControl: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\WindowsGame\ImagePath: "C:\WINDOWS\system32\Gameservet.exe"
HKLM\SYSTEM\CurrentControlSet\Services\WindowsGame\DisplayName: "Windows_Down"
HKLM\SYSTEM\CurrentControlSet\Services\WindowsGame\ObjectName: "LocalSystem"
HKLM\SYSTEM\CurrentControlSet\Services\WindowsGame\Description: "Windows_Down"

下载http://w.xxxxxx.com/down/game1.exe～game13.exe
和http://w.xxxxxx.com/down/8888-521ww.exe到system32文件夹

8888-521ww.exe继续执行下载 下载servet.exe （又一个木马下载器）到system32文件夹
servet.exe下载http://www.xxxxx.cn/1.exe~15.exe到system32文件夹

所有的木马都植入成功后的sreng日志是这样的

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<msupdate><C:\WINDOWS\AntiAdwa.exe other> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<winform><C:\WINDOWS\winform.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<cmdbs><C:\WINDOWS\cmdbs.exe> []
<upxdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<wosa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\woso.exe> []
<qjsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\qjso.exe> []
<mhsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mhso.exe> []
<intian><C:\WINDOWS\wintexe.exe> []
<load><C:\WINDOWS\uninstall\rundl132.exe> []
<testrun><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\testexe.exe> []
<Kvsc3><C:\WINDOWS\Kvsc3.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<visin><C:\WINDOWS\system32\ctfnom.exe> [Microsoft Corporation]
<twin><C:\WINDOWS\system32\ctfnom.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}><C:\WINDOWS\system32\msacn.dll> []

服务
[Windows User Mode Driver / UMWdfmgr][Stopped/Auto Start]
<rundll32.exe C:\WINDOWS\winamps.dll _start@16><N/A>
[Windows_Down / WindowsGame][Stopped/Auto Start]
<C:\WINDOWS\system32\Gameservet.exe><N/A>
[WinWMServiceNow / WinWMServiceNow][Stopped/Auto Start]
<C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RAVWM.EXE><N/A>
[Windows_SysDown / WindowsDown][Stopped/Auto Start]
<C:\WINDOWS\system32\servet.exe><N/A>
驱动
[CelInDrv / CelInDrv][Stopped/Disabled]
<\??\C:\WINDOWS\system32\Drivers\CelInDriver.sys><N/A>
正在运行的进程
[PID: 696][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180

(xpsp_sp2_rtm.040803-2158)]
C:\WINDOWS\system32\RAVWM506.dll] [N/A, ]
[PID: 852][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180

(xpsp_sp2_rtm.040803-2158)]
C:\WINDOWS\system32\fksdy.dll] [N/A, ]
C:\WINDOWS\system32\fdbohu.dll] [N/A, ]
C:\WINDOWS\system32\iakpsa.dll] [N/A, ]
[PID: 1392][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-

2158)]
C:\WINDOWS\system32\wscsv.dll] [N/A, ]
C:\WINDOWS\system32\fksdy.dll] [N/A, ]
C:\WINDOWS\system32\wgptl.dll] [N/A, ]
C:\WINDOWS\system32\wtrmm.dll] [N/A, ]
C:\WINDOWS\system32\hreax.dll] [N/A, ]
C:\WINDOWS\system32\mppds.dll] [N/A, ]
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.dll] [N/A, ]
C:\WINDOWS\system32\winform.dll] [N/A, ]
C:\WINDOWS\system32\cmdbs.dll] [N/A, ]
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\testdll.dll] [N/A, ]
C:\WINDOWS\system32\cmdbcs.dll] [N/A, ]
C:\WINDOWS\system32\wintdll.dll] [N/A, ]