在游民星空下载的游戏私处里的一个文件

hx1997

lxja360 发表于 2012-2-28 20:11
别的我知道 就是“补丁系统文件”是什么意思？

原文是 Patches，其实就是“替换系统文件”的意思。

一个笨鸟

xueqi 发表于 2012-2-28 16:43
游民星空的游戏绝对正规 我下了一年多还从没中过毒

人肉的：
http://bbs.kafan.cn/thread-1118814-1-1.html
http://bbs.gamersky.com/viewthre ... ble&tid=1095254
http://my.opera.com/caoliushequzuixindizhi/blog/2011/09/25/0925
http://db.gamersky.com/Soft/Comm ... =ShowAll&page=2

ujty

应该说这个介于毒和正常文件之间，比较龌龊。

donsky829

下游戏，我还是相信3DM

lxja360

hx1997 发表于 2012-2-28 20:12
原文是 Patches，其实就是“替换系统文件”的意思。

哦  明白了  不过这个到底是不是毒还没弄明白呢
看结果好像病毒的行为

hx1997

lxja360 发表于 2012-2-28 22:03
哦  明白了  不过这个到底是不是毒还没弄明白呢
看结果好像病毒的行为

很可疑，都加载驱动了，暂时不要使用先。

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> kernel32]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> C:\Documents and Settings\Administrator\Lb\Privates\Content\levels\record.znb]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> \\.\NetSafe0]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> \\.\NetSafe0]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> \\.\NetSafe0]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> C:\WINDOWS\system32\alrsvcfoe.dll]
Write to system directory. (Suspicious)

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> C:\WINDOWS\system32\alrsvcfoe.dll]
Write to system directory. (Suspicious)

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> \\.\NetSafe0]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> \\.\websafe]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> \\.\NetSafe0]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> \\.\PIPE\lsarpc]

Adjust Privileges [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe  ]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Cookies\index.dat]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Cookies\index.dat]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\History\History.IE5\index.dat]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\History\History.IE5\index.dat]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\桌面\Privates\Privates.exe   -> \\.\PIPE\lsarpc]

绅博周幸

hx1997 发表于 2012-2-28 23:51
很可疑，都加载驱动了，暂时不要使用先。

Write to file [C:\Documents and Settings\Administrator\桌 ...

File privates_exe declared CLEAN

绅博周幸

ujty 发表于 2012-2-28 20:20
应该说这个介于毒和正常文件之间，比较龌龊。

不是病毒

saga3721

原来是可伶可俐

hx1997

绅博周幸 发表于 2012-2-29 07:14
File privates_exe declared CLEAN

那它为什么要加载驱动和替换系统文件呢？

卡巴入库了。

https://www.virustotal.com/file/ ... nalysis/1330509762/