有新鲜货，国际惯例，先上一部分截图（动作太多……）质量不高，对付看看吧，动作多

firefox3

2012-12-21 22:55:54         C:\Program Files\Java\jre7\bin\java.exe         创建进程         C:\Documents and Settings\Administrator\Local Settings\Temp\0.4004212068548566.exe
2012-12-21 22:57:17         C:\Documents and Settings\Administrator\Local Settings\Temp\0.4004212068548566.exe         创建进程         C:\Documents and Settings\Administrator\Local Settings\Temp\SVCH0ST.exe
2012-12-21 22:58:22         C:\Documents and Settings\Administrator\Local Settings\Temp\0.4004212068548566.exe         创建进程         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe
2012-12-21 22:58:42         C:\Documents and Settings\Administrator\Local Settings\Temp\0.4004212068548566.exe         创建进程         C:\Documents and Settings\Administrator\Local Settings\Temp\~DeL!.bAt
2012-12-21 22:59:35         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-21 22:59:39         C:\Documents and Settings\Administrator\Local Settings\Temp\SVCH0ST.exe         创建进程         C:\WINDOWS\system32\cmd.exe
2012-12-21 22:59:43         C:\Documents and Settings\Administrator\Local Settings\Temp\0.4004212068548566.exe         创建进程         C:\WINDOWS\system32\cmd.exe
2012-12-21 22:59:45         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2012-12-21 22:59:48         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-21 22:59:51         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
2012-12-21 22:59:55         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver
2012-12-21 23:00:34         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改文件         C:\WINDOWS\system32\clientex.exe
2012-12-21 23:00:44         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         创建进程         C:\WINDOWS\system32\clientex.exe
2012-12-21 23:02:45         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改文件         C:\Program Files\360\360zip\360ExtLoader.exe
2012-12-21 23:02:47         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         创建进程         C:\WINDOWS\system32\clientex.exe
2012-12-21 23:02:53         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改文件         C:\Program Files\360\360zip\360zip.exe
2012-12-21 23:02:57         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改文件         C:\Program Files\360\360zip\360zipInst.exe
2012-12-21 23:02:59         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改文件         C:\Program Files\360\360zip\360zipUpdate.exe
2012-12-21 23:03:16         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改文件         C:\Program Files\360\360zip\DumpReport.exe
2012-12-21 23:03:24         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改文件         C:\Program Files\360\360zip\DumpUper.exe
2012-12-21 23:03:26         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改文件         C:\Program Files\360\360zip\MenuMgr.exe
2012-12-21 23:03:28         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改文件         C:\Program Files\360\360zip\tools\360kantu\360kantu.exe
2012-12-21 23:03:47         C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe         修改文件         C:\Program Files\360\360zip\tools\360kantu\360kantu.exe
报告结束

pangzy

老货了~~~

VT
https://www.virustotal.com/file/d2f23aeb98567ff9ad0c5927d79fc5da33922f3ef87aec2f2ac2c79772663869/analysis/
火眼
http://fireeye.ijinshan.com/analyse.html?md5=0f60f21c1a968c1092e9757127a143c9&type=1#full

来诺顿社区的鉴定下

Nocria

李不知

firefox3

pangzy 发表于 2012-12-21 23:14
老货了~~~

VT

你放几个质量高的我看看

pangzy

firefox3 发表于 2012-12-21 23:38
你放几个质量高的我看看

放了啊~~~

firefox3

pangzy 发表于 2012-12-21 23:44
放了啊~~~

来样本区混的放一个两个好意思吗

pangzy

firefox3 发表于 2012-12-21 23:48
来样本区混的放一个两个好意思吗

那啥~~小生不才

eternity.

ESET NOD32 detected.

0.4004212068548566.exe - a variant of Win32/Injector.DY trojan
clientex.exe - Win32/TrojanDownloader.Small.PBN trojan
SVCH0ST.exe - Win32/TrojanDownloader.Small.OXU trojan

firefox3

pangzy 发表于 2012-12-21 23:50
那啥~~小生不才

你测你的高质量  我玩我的低质量，懂了吧