virus Name: trojan-PSW.Win32.Magania.rxk

Manual Solution:

1. Manually delete the following files

% SystemRoot% \ system32 \ cjvesk.dat
% SystemRoot% \ system32 \ bvkiwp1.dat
% SystemRoot% \ system32 \ bvkiwp2.dat
% SystemRoot% \ system32 \ bvkiwp3.dat
% SystemRoot% \ system32 \ bvkiwp4.dat
% SystemRoot% \ system32 \ bvkiwp5.dat
% ProgramFiles% \ hgreag \ elijnixxb.dll (random name)

Variable declaration:

% SystemDriver% system partition, usually “C: \”
% SystemRoot% WINDODWS directory, usually “C: \ Windows”
% Documents and Settings% user’s documents directory, usually “C: \ Documents and Settings”
% Temp% temp folder, usually “C: \ Documents and Settings \ current user name \ Local Settings \ Temp”
% ProgramFiles% system program the default installation directory, typically: “C: \ ProgramFiles”

Analysis of the virus:

(1), to create a snapshot of the process, through search process “360tray.exe”, “ravmond.exe”, “qqpctray.exe” process, if the sign were found.
(2) determine whether there is% SystemRoot% \ system32 \ cjvesk.dat, if you exit the program, use the file to indicate whether the machine is running a virus.
(3), were created in the system directory under the file “bvkiwp1.dat”, “bvkiwp 2.dat”, “bvkiwp 3.dat”, “bvkiwp 4.dat”, “bvkiwp 5.dat”, the configuration information are written into five files created and set to hidden attribute.
(4), create the directory “% ProgramFiles% \ hgreag \”, and in this directory, create elijnixxb.dll (random name), the release of the virus code to the file.
(5), by calling the LSP system function WSCEnumProtocols, WSCInstallProvider, WSCWriteProviderOrder network protocol installed xvzgnwowz.dll chain to the system to update the installation of all service providers in order to customize the service providers ranked in the forefront of all agreements, this winsock-based implementation, all programs are loaded xvzgnwowz.dll.
(6), and if we find there is a security system into the software process, then exit the program directly, or delete itself after exiting the program.
(7), by WSP series WSPSend () function, such as the interception of the game account passwords and other network users to send data to the hacker specified address.

Viruses create  files:

% SystemRoot% \ system32 \ cjvesk.dat
% SystemRoot% \ system32 \ bvkiwp1.dat
% SystemRoot% \ system32 \ bvkiwp2.dat
% SystemRoot% \ system32 \ bvkiwp3.dat
% SystemRoot% \ system32 \ bvkiwp4.dat
% SystemRoot% \ system32 \ bvkiwp5.dat
% ProgramFiles% \ hgreag \ elijnixxb.dll (random name)

Virus access to the network:

www.sz ***. com: 54325/anquan