学期末没时间测了

bbbxyoiil

footman 发表于 2011-11-13 21:13
哦。我测试不开杀毒是照顾很多没装杀毒的人，毕竟很多装comodo都是不装杀毒的。

我知道了，，下次不敢了，但它也全部入沙了

footman

bbbxyoiil 发表于 2011-11-13 21:14
我知道了，，下次不敢了，但它也全部入沙了

就是入沙了，注册表还是被修改了

bbbxyoiil

footman 发表于 2011-11-13 21:15
就是入沙了，注册表还是被修改了

我不可能的，我去看看

mxf147

lll3-6.rar这东西确实很变态，动作太多了

bbbxyoiil

footman 发表于 2011-11-13 21:15
就是入沙了，注册表还是被修改了

我的没有，只是虚拟化，因为我全是*保护，入了沙它就不能运行了，

mxf147

11.13部分日志，动作太多，日志就不全贴了

2011-11-13 21:20:32   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   \Device\KsecDD   
2011-11-13 21:20:38   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改注册表项   HKUS\S-1-5-21-583907252-688789844-1177238915-500\Software\Microsoft\Windows\CurrentVersion\Run\lll3-6.exe   
2011-11-13 21:20:38   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\羽翼.bat   
2011-11-13 21:20:38   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   创建进程   C:\WINDOWS\system32\cmd.exe   
2011-11-13 21:20:38   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改注册表项   HKLM\SOFTWARE\Classes\exefile\DefaultIcon\   
2011-11-13 21:20:38   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   创建进程   C:\1.bat   
2011-11-13 21:20:45   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\cc.ico   
2011-11-13 21:20:45   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   创建进程   C:\1.bat   
2011-11-13 21:20:51   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\兵团.bat   
2011-11-13 21:20:51   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   创建进程   C:\WINDOWS\system32\cmd.exe   
2011-11-13 21:20:51   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\蛔虫.bat   
2011-11-13 21:20:51   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   创建进程   C:\WINDOWS\system32\cmd.exe   
2011-11-13 21:20:51   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\vbs.vbs   
2011-11-13 21:20:51   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   创建进程   C:\WINDOWS\system32\taskkill.exe   
2011-11-13 21:20:51   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改注册表项   HKUS\S-1-5-21-583907252-688789844-1177238915-500\Software\Microsoft\Windows\CurrentVersion\Policies\System   
2011-11-13 21:20:51   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\Documents and Settings\Administrator\Application Data\Microsoft\Credentials\S-1-5-21-583907252-688789844-1177238915-500   
2011-11-13 21:20:51   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   拦截文件   C:\Program Files\Windows Media Player\custsat.dll   

2011-11-13 21:21:03   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\Installer\MSIB.tmp   
2011-11-13 21:21:03   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\Web\printers\ipp_0000.inc   
2011-11-13 21:21:03   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改注册表项   HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}\   
2011-11-13 21:21:03   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\system32\drivers\etc\hosts   
2011-11-13 21:21:03   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   创建进程   C:\WINDOWS\system32\taskkill.exe   
2011-11-13 21:21:03   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改注册表项   HKUS\S-1-5-21-583907252-688789844-1177238915-500\Software\Microsoft\Windows\CurrentVersion\Policies\System   
2011-11-13 21:21:03   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\Documents and Settings\Administrator\Application Data\Microsoft\Credentials\S-1-5-21-583907252-688789844-1177238915-500   

2011-11-13 21:21:09   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\system32\appmgmts.dll   
2011-11-13 21:21:09   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改注册表项   HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}\   
2011-11-13 21:21:09   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\system32\drivers\etc\hosts   
2011-11-13 21:21:09   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   创建进程   C:\WINDOWS\system32\taskkill.exe   
2011-11-13 21:21:09   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改注册表项   HKUS\S-1-5-21-583907252-688789844-1177238915-500\Software\Microsoft\Windows\CurrentVersion\Policies\System   
2011-11-13 21:21:09   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\Documents and Settings\Administrator\Application Data\Microsoft\Credentials\S-1-5-21-583907252-688789844-1177238915-500   

2011-11-13 21:21:15   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB956391.cat   
2011-11-13 21:21:15   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改注册表项   HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}\   

2011-11-13 21:21:21   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\system32\1033   
2011-11-13 21:21:21   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改注册表项   HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}\   

2011-11-13 21:21:27   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\srchasst\mui\0804\lclother.xml   
2011-11-13 21:21:40   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\Documents and Settings\Administrator\Local Settings\Temp\{92940335-0AB9-4A2A-91B1-5EB633EBB640}\extracted\lps_2070.rtf   
2011-11-13 21:21:46   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\Network Diagnostic\custsat.dll   
2011-11-13 21:21:46   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\system32\xjis.nls   

2011-11-13 21:21:51   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\Prefetch\KBNUMLOCK.EXE-33F967CB.pf   
2011-11-13 21:21:51   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\Web\printers\ipp_0013.asp   
2011-11-13 21:21:58   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll   

2011-11-13 21:22:04   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\Fonts\webdings.ttf   
2011-11-13 21:22:04   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\system32\DirectX\Dinput\ms26.ini   

2011-11-13 21:22:10   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\inf\qmgr.inf   
2011-11-13 21:22:10   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\system32\wbem\mofd.dll   
2011-11-13 21:22:15   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\system32\adptif.dll   
2011-11-13 21:22:32   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\system32\microsoft.managementconsole.dll   
2011-11-13 21:22:39   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\system32\Com   
2011-11-13 21:22:45   C:\Documents and Settings\Administrator\桌面\TEST\lll3-6\lll3-6.exe   修改文件   C:\WINDOWS\system32\comcat.dll   

mxf147

系统目录生成几个bat文件
1.bat：修改exe文件关联
兵团.bat：创建随机目录（很深）
蛔虫.bat：轰炸硬盘、隐藏文件、自启动、感染文件、监视U盘。。。
羽翼.bat：修改常见文件关联，磁盘映射、修改注册表

footman

bbbxyoiil 发表于 2011-11-13 21:25
我的没有，只是虚拟化，因为我全是*保护，入了沙它就不能运行了，

那就不算是默认规则了

footman

a256886572008 发表于 2011-11-13 21:10
找到了，就這些

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\*

这么找的，学习下

bbbxyoiil

footman 发表于 2011-11-13 21:34
那就不算是默认规则了

实际上默认规则一定要开杀毒的还要开沙盘的，都是全开了