貌似 Fake AV 母体进来释放衍生物，衍生物联网下载搞怪！重点测 qjx.zip，这是主谋！

firefox3

https://www.virustotal.com/file/ ... nalysis/1355840860/

https://www.virustotal.com/file/ ... nalysis/1355840869/

样本来源：oregonsitynet.net/?a=YWZmaWQ9MDAxMDI=

部分截图（病毒名称不一样是因为又进了一次毒网）：













2012-12-18 22:18:31         C:\Program Files\Java\jre7\bin\java.exe         创建进程         C:\Documents and Settings\Administrator\Local Settings\Temp\F2032D138C22EA42.exe
2012-12-18 22:19:04         C:\Documents and Settings\Administrator\Local Settings\Temp\F2032D138C22EA42.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe
2012-12-18 22:19:09         C:\Documents and Settings\Administrator\Local Settings\Temp\F2032D138C22EA42.exe         访问内存         C:\Program Files\Internet Explorer\iexplore.exe
2012-12-18 22:20:35         C:\Documents and Settings\Administrator\Local Settings\Temp\F2032D138C22EA42.exe         创建进程         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe
2012-12-18 22:20:45         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Application Data\1pb78m8n6he1l1565b3k36w7o7of8ksb88y53s63tpqg0vl
2012-12-18 22:20:55         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         修改文件         C:\Documents and Settings\All Users\Application Data\1pb78m8n6he1l1565b3k36w7o7of8ksb88y53s63tpqg0vl
2012-12-18 22:20:58         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         修改文件         C:\Documents and Settings\Administrator\Templates\1pb78m8n6he1l1565b3k36w7o7of8ksb88y53s63tpqg0vl
2012-12-18 22:21:05         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         访问内存         C:\Program Files\SogouExplorer\SogouExplorer.exe
2012-12-18 22:21:08         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         访问内存         C:\Program Files\SogouInput\6.3.0.8227\SogouCloud.exe
2012-12-18 22:21:16         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Clients\StartMenuInternet\
2012-12-18 22:21:20         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver
2012-12-18 22:21:31         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2012-12-18 22:21:36         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         访问COM接口         {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
2012-12-18 22:21:45         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-18 22:22:01         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         访问COM接口         C:\WINDOWS\explorer.exe
2012-12-18 22:22:08         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2012-12-18 22:22:41         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-18 22:23:05         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
2012-12-18 22:23:18         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         访问COM接口         C:\WINDOWS\explorer.exe
2012-12-18 22:23:42         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         访问COM接口         C:\WINDOWS\explorer.exe
2012-12-18 22:23:53         C:\Documents and Settings\Administrator\Local Settings\Application Data\qjx.exe         访问COM接口         C:\WINDOWS\explorer.exe
报告结束

ELOHIM

MSE： 恶意。

（qjx+F2032D138C22EA42）:    Rogue:Win32/FakeRean

http://www.microsoft.com/securit ... threatid=2147607809

PS：动作很多，查杀过程比较长。

无聊学个单词：

rogue   US: [ roʊɡ ] UK: [ rəʊɡ ]  
英汉英英网络释义n.

1歹徒,恶棍;流氓,无赖;乞丐;骗子
2爱捉弄人者;淘气孩子,小淘气
3【园】变劣了的实生苗;劣种;

【生】变劣4家伙5离群的象,离群的野兽;(赛马或行猎时的)腿懒的马

更多释义收起释义v.1骗,欺诈2
【农】间苗;去劣;去杂,淘汰3流浪,游荡;行骗

katatlove

BULLGUARD 杀了第一个, QJX 这个双击以后被过了, 然后每次上网都弹出推荐的那个假杀毒..  别的网页都打不开了

而且,拿360卫士修复完系统,重起以后360自己都没了,火狐浏览器也没了.IE 也挂掉 真惨烈

ELOHIM

katatlove 发表于 2012-12-18 22:54
BULLGUARD 杀了第一个, QJX 这个双击以后被过了, 然后每次上网都弹出推荐的那个假杀毒..  别的网页都打不开 ...

从楼主截图看，还是利用java漏洞兴风作浪。

lbb9432

看VT没过ESET，我表示很欣慰

katatlove

再贴上 BD 2013 , 成功防御住

carefree

Mamutu

katatlove

小A 的2个

firefox3

katatlove 发表于 2012-12-18 22:54
BULLGUARD 杀了第一个, QJX 这个双击以后被过了, 然后每次上网都弹出推荐的那个假杀毒..  别的网页都打不开 ...

重起以后360自己都没了

哈哈哈哈 你太搞笑了你

firefox3

ELOHIM 发表于 2012-12-18 23:04
从楼主截图看，还是利用java漏洞兴风作浪。

下到本地是利用java，别的拼实力