伪造数字签名样本，高质量5 / 43，过卡巴红伞

bbmcnj2

熊猫云kill

zhanghongyuan1

金色微笑 发表于 2012-2-28 12:56
金山卫士提示安全啊，avast还是不报

明明报了，avast我没用不知道

zhanghongyuan1

金色微笑 发表于 2012-2-28 12:56
金山卫士提示安全啊，avast还是不报

明明报了，avast我没用不知道

tingyue-wu

小a表示安全 唉

细细的票根

humanlwj52 发表于 2012-2-27 21:20

"A"+"MP"组合。

Nocria

细细的票根 发表于 2012-2-28 21:45
"A"+"MP"组合。

呵呵，被你发现了

细细的票根

humanlwj52 发表于 2012-2-28 21:50
呵呵，被你发现了

用起来很流畅吧？“A”可能就是主防不好？

hx1997

Zbot

Write to file [C:\Documents and Settings\Administrator\桌面\jtJtkm5.exe   -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\桌面\jtJtkm5.exe   -> C:\Documents and Settings\Administrator\Application Data\Ajge\duqe.exe]

Write to file [C:\Documents and Settings\Administrator\桌面\jtJtkm5.exe   -> \\.\PIPE\lsarpc]

Adjust Privileges [C:\Documents and Settings\Administrator\桌面\jtJtkm5.exe  ]

Write to file [C:\Documents and Settings\Administrator\桌面\jtJtkm5.exe   -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\桌面\jtJtkm5.exe   -> C:\Documents and Settings\Administrator\Application Data\Ibedm\urxo.ybi]

Write to file [C:\Documents and Settings\Administrator\桌面\jtJtkm5.exe   -> C:\Documents and Settings\Administrator\Application Data\Ajge\duqe.exe]

Execute [C:\Documents and Settings\Administrator\桌面\jtJtkm5.exe   (556) ->  (948)]
Command-line: "C:\Documents and Settings\Administrator\Application Data\Ajge\duqe.exe"

Write to file [C:\Documents and Settings\Administrator\Application Data\Ajge\duqe.exe -> \\.\PIPE\lsarpc]

Write process memory [C:\Documents and Settings\Administrator\Application Data\Ajge\duqe.exe (948) -> \Device\HarddiskVolume1\WINDOWS\system32\VBoxTray.exe (1716)]
Code injection into process that is located in system directory. (Suspicious)

Write to file [C:\WINDOWS\system32\VBoxTray.exe -> \\.\PIPE\lsarpc]

Write to file [C:\WINDOWS\system32\VBoxTray.exe -> \\.\PIPE\lsarpc]

Adjust Privileges [C:\WINDOWS\system32\VBoxTray.exe]

Write to file [C:\WINDOWS\system32\VBoxTray.exe -> \\.\PIPE\lsarpc]

Write to file [C:\WINDOWS\system32\VBoxTray.exe -> \\.\PIPE\lsarpc]

Adjust Privileges [C:\WINDOWS\system32\VBoxTray.exe]

Write to file [C:\WINDOWS\system32\VBoxTray.exe -> \\.\PIPE\lsarpc]

Write to file [C:\WINDOWS\system32\VBoxTray.exe -> C:\Documents and Settings\Administrator\Application Data\Ibedm\urxo.ybi]

Write process memory [C:\Documents and Settings\Administrator\Application Data\Ajge\duqe.exe (948) -> \Device\HarddiskVolume1\Program Files\Baidu\BaiduPinyin\1.3.1.3\baidupinyin.exe (1728)]

Write to file [C:\Program Files\Baidu\BaiduPinyin\1.3.1.3\baidupinyin.exe -> \\.\PIPE\lsarpc]

Write to file [C:\Program Files\Baidu\BaiduPinyin\1.3.1.3\baidupinyin.exe -> \\.\PIPE\lsarpc]

Write process memory [C:\Documents and Settings\Administrator\Application Data\Ajge\duqe.exe (948) -> \Device\HarddiskVolume1\WINDOWS\system32\ctfmon.exe (1740)]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> \\.\PIPE\lsarpc]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab]

Write to file [C:\WINDOWS\system32\ctfmon.exe -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab]

Write process memory [C:\Documents and Settings\Administrator\Application Data\Ajge\duqe.exe (948) -> \Device\HarddiskVolume1\WINDOWS\explorer.exe (1000)]
Code injection into process that is located in system directory. (Suspicious)

Write process memory [C:\Documents and Settings\Administrator\Application Data\Ajge\duqe.exe (948) -> \Device\HarddiskVolume1\Documents and Settings\Administrator\桌面\jtJtkm5.exe (556)]

Write to file [C:\Documents and Settings\Administrator\桌面\jtJtkm5.exe   -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\桌面\jtJtkm5.exe   -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp26dace2e.bat]

Write to file [C:\Documents and Settings\Administrator\桌面\jtJtkm5.exe   -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp26dace2e.bat]

Process C:\Documents and Settings\Administrator\Application Data\Ajge\duqe.exe has terminated.

Execute [C:\Documents and Settings\Administrator\桌面\jtJtkm5.exe   (556) ->  (1660)]
Command-line: "C:\WINDOWS\system32\cmd.exe" /c "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp26dace2e.bat" (Suspicious)
The window of the new process is invisible. (Suspicious)

Process C:\Documents and Settings\Administrator\桌面\jtJtkm5.exe   has terminated.

Write to file [C:\WINDOWS\system32\cmd.exe -> \\.\PIPE\lsarpc]

Process C:\WINDOWS\system32\cmd.exe has terminated.

一万个理由

上报瑞星

Nocria

AVG 入库了：