20：00刚更新。看看是不是病毒。

显示全部楼层 · 发表于 2011-8-13 18:17:44

本帖最后由 zhangjianqwe 于 2011-8-13 20:00 编辑

看看是不是病毒。

显示全部楼层 · 发表于 2011-8-13 18:19:41

金山安全
运行结果:
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\COMCTL32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\COMCTL32.dll
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\COMCTL32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\COMCTL32.dll
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\WINDOWS\system32\WINSPOOL.DRV C:\WINDOWS\system32\WINSPOOL.DRV
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\WINDOWS\system32\IMM32.DLL C:\WINDOWS\system32\IMM32.DLL
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\WINDOWS\system32\LPK.DLL C:\WINDOWS\system32\LPK.DLL
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\WINDOWS\system32\USP10.dll C:\WINDOWS\system32\USP10.dll
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\program files\kingsoft\kingsoft antivirus\security\ksde\KisDcom.dll C:\program files\kingsoft\kingsoft antivirus\security\ksde\KisDcom.dll
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\WINDOWS\SYSTEM32\uxtheme.dll C:\WINDOWS\SYSTEM32\uxtheme.dll
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\program files\kingsoft\kingsoft antivirus\kwsui.dll C:\program files\kingsoft\kingsoft antivirus\kwsui.dll
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\WINDOWS\system32\PSAPI.DLL C:\WINDOWS\system32\PSAPI.DLL
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\program files\kingsoft\kingsoft antivirus\kswebshield.dll C:\program files\kingsoft\kingsoft antivirus\kswebshield.dll
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\WINDOWS\system32\WS2_32.dll C:\WINDOWS\system32\WS2_32.dll
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\WINDOWS\system32\WS2HELP.dll C:\WINDOWS\system32\WS2HELP.dll
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe创建注册表键值HKEY_USERS\S-1-5-21-1844237615-308236825-1177238915-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-1844237615-308236825-1177238915-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件D:\Program Files\360\360Safe\safemon\safemon.dll D:\Program Files\360\360Safe\safemon\safemon.dll
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\WINDOWS\system32\MSVCP60.dll C:\WINDOWS\system32\MSVCP60.dll
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\WINDOWS\system32\MSCTF.dll C:\WINDOWS\system32\MSCTF.dll
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe加载库文件C:\WINDOWS\system32\msctfime.ime C:\WINDOWS\system32\msctfime.ime
2011-08-13 18:18:31 C:\Documents and Settings\Administrator\桌面\17.exe发送消息C:\Program Files\KINGSOFT\kingsoft antivirus\ksandbox.exe C:\Program Files\KINGSOFT\kingsoft antivirus\ksandbox.exe
2011-08-13 18:18:41 C:\Documents and Settings\Administrator\桌面\17.exe创建文件C:\Documents and Settings\Administrator\桌面\17 C:\Documents and Settings\Administrator\桌面\17
2011-08-13 18:18:42 C:\Documents and Settings\Administrator\桌面\17.exe写文件C:\KSafeBox\662739CB\Documents and Settings\Administrator\桌面\17 C:\KSafeBox\662739CB\Documents and Settings\Administrator\桌面\17

显示全部楼层 · 发表于 2011-8-13 18:22:56

金山安全

http://camas.comodo.com/cgi-bin/ ... c4394f691c4cbf2adad

显示全部楼层 · 发表于 2011-8-13 18:29:10

大蜘蛛clean，文件加了壳：
17.exe packed by UPX
已上报

显示全部楼层 · 发表于 2011-8-13 18:31:46

多引擎全部过了。。

http://r.virscan.org/report/6f1fae204372acead4558a681cf09b92.html

另外用360扫也是安全

显示全部楼层 · 发表于 2011-8-13 18:35:08

Palkia 发表于 2011-8-13 18:31
多引擎全部过了。。

http://r.virscan.org/report/6f1fae204372acead4558a681cf09b92.html

这东西杀毒软件是杀不了的。除非手动的

显示全部楼层 · 发表于 2011-8-13 18:37:27

本帖最后由 Palkia 于 2011-8-13 18:42 编辑

zhangjianqwe 发表于 2011-8-13 18:35
这东西杀毒软件是杀不了的。除非手动的

上报卡巴，红伞，金山，瑞星，360，avg

RS20110813183214375472

显示全部楼层 · 发表于 2011-8-13 18:44:44

zhangjianqwe 发表于 2011-8-13 18:35
这东西杀毒软件是杀不了的。除非手动的

明天测主防

显示全部楼层 · 发表于 2011-8-13 18:45:31

樓主，這不是病毒呀

显示全部楼层 · 发表于 2011-8-13 18:46:35

a256886572008 发表于 2011-8-13 18:45
樓主，這不是病毒呀

按了EXTRACT有惊喜

[可疑文件] 20：00刚更新。看看是不是病毒。

本帖子中包含更多资源