K+防不住

显示全部楼层 · 发表于 2011-8-30 12:35:13

http://bbs.kafan.cn/thread-1068751-1-1.html

看这个样本，K+被过，双击运行的话你的电脑就悲剧了

显示全部楼层 · 发表于 2011-8-30 12:44:32

我双击了貌似没什么事~~

显示全部楼层 · 发表于 2011-8-30 12:51:01

金山的确没报毒，但双击后屁事都没有。

显示全部楼层 · 发表于 2011-8-30 12:59:16

都是牛人，敢双击的

显示全部楼层 · 发表于 2011-8-30 13:07:46

hips测试结果,写启动项和连网.

金山鉴定安全.

显示全部楼层 · 发表于 2011-8-30 13:11:20

sfsren 发表于 2011-8-30 12:59
都是牛人，敢双击的

支持金山，我有什么可怕的。

显示全部楼层 · 发表于 2011-8-30 13:15:57

看到帖子，只有MSE查杀确实是强悍啊。。哈哈。

显示全部楼层 · 发表于 2011-8-30 13:22:12

360KILL

显示全部楼层 · 发表于 2011-8-30 13:30:27

本帖最后由 K_Ghost! 于 2011-8-30 14:19 编辑

占楼测下

确定是毒

显示全部楼层 · 发表于 2011-8-30 13:35:25

本帖最后由李白vs苏轼于 2011-8-30 13:39 编辑

Values Created
Name Type Size Value
LM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Documents and Settings\User\Application Data\E-73473-3674-74335\winlivem.exe REG_SZ 224 "C:\Documents and Settings\User\Application Data\E-73473-3674-74335\winlivem.exe:*:Enabled:Messenger Live Update"

• Values Changed
Name Type Size Value
LM\System\CurrentControlSet\Services\SharedAccess\Epoch\Epoch REG_DWORD/REG_DWORD 4/4 0xd8/0xd9

• Values Deleted
• Directories Created
Name Last Write Time Creation Time Last Access Time Attr
C:\Documents and Settings\User\Application Data\E-73473-3674-74335 2009.01.09 10:54:28.796 2009.01.09 10:54:28.734 2009.01.09 10:54:28.796 0x17

• Directories Changed
• Directories Deleted
• Files Created
Name Size Last Write Time Creation Time Last Access Time Attr
C:\Documents and Settings\User\Application Data\E-73473-3674-74335\winlivem.exe 192590 2009.01.09 10:54:20.796 2009.01.09 10:54:28.796 2009.01.09 10:54:28.796 0x7

• Files Changed
• Files Deleted
• Directories Hidden
• Files Hidden
• Drivers Loaded
• Drivers Unloaded
• Processes Created
PId Process Name Image Name
0xdc sample.exe C:\TEST\sample.exe

• Processes Terminated
• Threads Created
PId Process Name TId Start Start Mem Win32 Start Win32 Start Mem
0xdc sample.exe 0xec 0x7c810867 MEM_IMAGE 0x4047d6 MEM_PRIVATE
0x348 svchost.exe 0x784 0x7c810856 MEM_IMAGE 0x7c910760 MEM_IMAGE

• Modules Loaded
• Windows Api Calls
PId Image Name Address Function ( Parameters ) | Return Value
0xdc C:\TEST\sample.exe 0x401f33 CopyFileA(lpExistingFileName: "C:\TEST\sample.exe", lpNewFileName: "C:\Documents and Settings\User\Application Data\E-73473-3674-74335\winlivem.exe", bFailIfExists: 0x0)|0x1

• DNS Queries
DNS Query Text
yesim.hoodrich.ru IN A +

• HTTP Queries
• Verdict
Auto Analysis Verdict
Suspicious+

• Description
Suspicious Actions Detected
Copies self to other locations
Disables windows firewall
Injects code into other processes

• Mutexes Created or Opened
PId Image Name Address Mutex Name
0x1c8 C:\Documents and Settings\User\Application Data\E-73473-3674-74335\winlivem.exe 0x401e02 segh3hsb2bs
0xdc C:\TEST\sample.exe 0x401e02 segh3hsb2bs

[金山] K+防不住

本帖子中包含更多资源