金山云鉴定安全

绅博周幸

jayavira

to eset

http://camas.comodo.com/cgi-bin/ ... a66ef53683936faa52a

http://samples.nod32.com.hk/inde ... d32a9285f7eb5a3fe9a

a256886572008

http://camas.comodo.com/cgi-bin/submit?file=b3612c98ab9220c4c1d9b257d70df4816049ac9f26920a66ef53683936faa52a

• Verdict
Auto Analysis Verdict
Suspicious++

• Description
Suspicious Actions Detected
Copies self to other locations
Deletes self
--------------------------------------------------------------------------
comodo 雲查殺

2011-06-29 07:39:58   C:\Documents and Settings\Roger\桌面\VIRUS\readme\readme.exe   TrojWare.Win32.Trojan.Agent.Gen@1   

2011-06-29 07:40:22   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   TrojWare.Win32.Trojan.Agent.Gen@1   

-------------------------------------------------------------------------
進程樹狀圖：

readme.exe
-->BhhqeHCgNhJwFyu.exe
    -->attrib.exe
    -->17686308.exe

readme.exe

2011-06-29 07:39:54   C:\Documents and Settings\Roger\桌面\VIRUS\readme\readme.exe   Sandboxed As   Partially Limited   

2011-06-29 07:39:59   C:\Documents and Settings\Roger\桌面\VIRUS\readme\readme.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr   

2011-06-29 07:39:59   C:\Documents and Settings\Roger\桌面\VIRUS\readme\readme.exe   Modify File   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   

2011-06-29 07:40:05   C:\Documents and Settings\Roger\桌面\VIRUS\readme\readme.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\BhhqeHCgNhJwFyu   

2011-06-29 07:40:09   C:\Documents and Settings\Roger\桌面\VIRUS\readme\readme.exe   Scanned Online and Found Malicious      

2011-06-29 07:40:10   C:\Documents and Settings\Roger\桌面\VIRUS\readme\readme.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable   

2011-06-29 07:40:22   C:\Documents and Settings\Roger\桌面\VIRUS\readme\readme.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures   

2011-06-29 07:40:22   C:\Documents and Settings\Roger\桌面\VIRUS\readme\readme.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments   

2011-06-29 07:40:27   C:\Documents and Settings\Roger\桌面\VIRUS\readme\readme.exe   Modify File   C:\Documents and Settings\Roger\Local Settings\Temp\tmp1A07.tmp   

2011-06-29 07:40:27   C:\Documents and Settings\Roger\桌面\VIRUS\readme\readme.exe   Modify Key   HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations   

BhhqeHCgNhJwFyu.exe   刪除快捷方式

2011-06-29 07:39:59   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Sandboxed As   Partially Limited   

2011-06-29 07:40:05   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Control Panel\Desktop\WallpaperOld   

2011-06-29 07:40:05   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop   

2011-06-29 07:40:10   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop   

2011-06-29 07:40:10   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\Uninstall Unwanted Apps.lnk   
2011-06-29 07:40:10   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\Advanced SystemCare 4\User Manual.lnk   
2011-06-29 07:40:10   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\COMODO\COMODO Internet Security\COMODO Internet Security.lnk   
2011-06-29 07:40:10   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\COMODO\COMODO Programs Manager\COMODO Programs Manager.lnk   
2011-06-29 07:40:17   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\K-Lite Codec Pack\Codec Tweak Tool\Manage ACM and VFW codecs.lnk   
2011-06-29 07:40:17   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\K-Lite Codec Pack\Configuration\ffdshow VFW interface.lnk   
2011-06-29 07:40:17   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\K-Lite Codec Pack\Help\Frequently Asked Questions.lnk   
2011-06-29 07:40:17   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\K-Lite Codec Pack\Tools\MediaInfo.lnk   
2011-06-29 07:40:22   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\K-Lite Codec Pack\Uninstall\Uninstall K-Lite Codec Pack.lnk   
2011-06-29 07:40:22   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\Windows Live\Windows Live Call.lnk   
2011-06-29 07:40:22   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\WinRAR\WinRAR.lnk   
2011-06-29 07:40:22   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\啟動\desktop.ini   
2011-06-29 07:40:22   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\遊樂場\網際網路黑白棋.lnk   

2011-06-29 07:40:23   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Scanned Online and Found Malicious      

2011-06-29 07:40:27   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\金山毒霸\访问金山公司网站\金山毒霸网站.lnk   
2011-06-29 07:40:27   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\附屬應用程式\小算盤.lnk   
2011-06-29 07:40:27   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\附屬應用程式\通訊\新增連線精靈.lnk   

2011-06-29 07:43:35   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden   

2011-06-29 07:43:35   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\Roger\Recent\1.htm.lnk   

2011-06-29 07:43:35   C:\Documents and Settings\All Users\Application Data\BhhqeHCgNhJwFyu.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\Uninstall Unwanted Apps.lnk   

attrib.exe 修改文件屬性為隱藏

2011-06-29 07:40:28   C:\WINDOWS\system32\attrib.exe   Sandboxed As   Partially Limited   

2011-06-29 07:40:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\Advanced SystemCare 4\Advanced SystemCare 4.lnk   
2011-06-29 07:40:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\IObit\Uninstall Unwanted Apps.lnk   
2011-06-29 07:40:47   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\#SharedObjects\7DAE63NT\banners.securedataimages.com   
2011-06-29 07:40:47   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#banners.securedataimages.com   
2011-06-29 07:40:47   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll   
2011-06-29 07:41:12   C:\WINDOWS\system32\attrib.exe   Modify File   D:\My Documents\My Music\範例音樂.lnk   
2011-06-29 07:41:12   C:\WINDOWS\system32\attrib.exe   Modify File   D:\My Documents\My Pictures\範例圖片.lnk   
2011-06-29 07:41:12   C:\WINDOWS\system32\attrib.exe   Modify File   D:\My Documents\我的遊戲\picaball.exe   

2011-06-29 07:41:37   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\PPStream\Codec\real\Codecs\14_43260.dll   
2011-06-29 07:41:37   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\PPStream\Codec\real\Codecs\raac.dll   
  
2011-06-29 07:42:21   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\CLT\plugins\AdvancedProcessTermination.dll   
2011-06-29 07:42:26   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\CLT\plugins\DupHandles.dll   
2011-06-29 07:42:26   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\CLT\plugins\SetThreadContext.dll   
2011-06-29 07:42:26   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\CLT\clt.exe   
2011-06-29 07:42:32   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\convertz802\ConvertZ.exe   
2011-06-29 07:42:32   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Skype.exe   
2011-06-29 07:42:32   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\decoder2060\HTMLDecoder.exe   
2011-06-29 07:42:32   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\decoder2060\RICHTX32.OCX   
2011-06-29 07:42:37   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\FreeUPXenlv\fupx.exe   
2011-06-29 07:42:37   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\FreShow1.5\FreShow!.exe   
2011-06-29 07:42:42   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\gmer\gmer.exe   
2011-06-29 07:42:42   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\IceSword122cn\IceSword.exe   
2011-06-29 07:42:55   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\IDA5.0\IDA5.0\Flair\bin\dumpsig.exe   
2011-06-29 07:42:55   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\IDA5.0\IDA5.0\Flair\bin\ppsx.exe   
2011-06-29 07:42:55   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\IDA5.0\IDA5.0\Flair\pascal\samples\minmax.dll   
2011-06-29 07:43:03   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\IDA5.0\IDA5.0\Flair\startup\arm\startup.bat   
2011-06-29 07:43:03   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\IDA5.0\IDA5.0\Flair\startup\startup.bat   
2011-06-29 07:43:29   C:\WINDOWS\system32\attrib.exe   Sandboxed As   Partially Limited   
2011-06-29 07:43:29   C:\WINDOWS\system32\attrib.exe   Sandboxed As   Partially Limited   
2011-06-29 07:43:30   C:\WINDOWS\system32\attrib.exe   Sandboxed As   Partially Limited   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\Advanced SystemCare 4\Advanced SystemCare 4.lnk   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\IObit\Uninstall Unwanted Apps.lnk   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\Windows Live\Windows Live Call.lnk   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\#SharedObjects\7DAE63NT\banners.securedataimages.com\images\cams\flash\cams_in_a_box_flash10.swf\#cams.com   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\遊樂場\傷心小棧.lnk   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\#SharedObjects\7DAE63NT\banners.securedataimages.com   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\附屬應用程式\通訊\新增連線精靈.lnk   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\#SharedObjects\7DAE63NT\core.mochibot.com   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\附屬應用程式\通訊\網路安裝精靈.lnk   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\#SharedObjects\7DAE63NT\js.miaozhen.com   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\附屬應用程式\通訊\超級終端機.lnk   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\#SharedObjects\7DAE63NT\js.tudouui.com   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\附屬應用程式\WordPad.lnk   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\#SharedObjects\7DAE63NT\resources.infolinks.com   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\附屬應用程式\小畫家.lnk   
2011-06-29 07:43:35   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\#SharedObjects\7DAE63NT\s.ytimg.com   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\附屬應用程式\小算盤.lnk   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\#SharedObjects\7DAE63NT\seal.buysafe.com   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\附屬應用程式\相關字詞編輯工具.lnk   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\#SharedObjects\7DAE63NT\video.udn.com   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\附屬應用程式\通用輸入法編輯工具.lnk   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\#SharedObjects\7DAE63NT\www.okokgame.com   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\附屬應用程式\遠端桌面連線.lnk   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\#SharedObjects\7DAE63NT\www.paypalobjects.com   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\All Users\「開始」功能表\程式集\Adobe Reader X.lnk   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#banners.securedataimages.com   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   D:\My Documents\My Music\範例音樂.lnk   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#js.miaozhen.com   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   D:\My Documents\My Music\複製 -範例音樂.lnk   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#resources.infolinks.com   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   D:\My Documents\My Pictures\範例圖片.lnk   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll   

2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\PPStream\Codec\real\Codecs\14_43260.dll   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   D:\software\IDA5.0\IDA5.0\Flair\pascal\samples\minmax.dll   
2011-06-29 07:43:41   C:\WINDOWS\system32\attrib.exe   Modify File   C:\Documents and Settings\Roger\Application Data\Skype.exe   

17686308.exe

2011-06-29 07:40:29   C:\Documents and Settings\All Users\Application Data\17686308.exe   Sandboxed As   Partially Limited   

2011-06-29 07:44:04   C:\Documents and Settings\All Users\Application Data\17686308.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Start Menu  

wqcaokeyinwq

实机测试。。。。。。
过金山卫士。。。。。。。。。
过微点扫描。。。。。。。。。。
过红伞扫描。。。。。。。。。。。。
双击测试。。。。。。。。。。
微点立刻秒杀。。。。。。。。。。。
程序运行后试图修改注册表。。，阻止后。。微点回滚木马。。。

qq351100394

KIS2012未报，已上报

BHHZDQL

360云秒杀

星晨

BitDefender上报

jayavira

3L
to eset

http://camas.comodo.com/cgi-bin/ ... aeb24b1d39790993d86

http://samples.nod32.com.hk/inde ... 58d50b5bf77f60c4dc6

hzqedison

我找人看一下

生命在于运动

wqcaokeyinwq 发表于 2011-6-29 07:51
实机测试。。。。。。
过金山卫士。。。。。。。。。
过微点扫描。。。。。。。。。。

这么厉害  敢实机测试   万一漏报了  就等着被感染吧