超级木马

显示全部楼层 · 发表于 2012-3-9 15:32:48

大蜘蛛Clean，文件加了壳：
3-3.exe - packed by UPX

显示全部楼层 · 发表于 2012-3-9 16:12:18

鄙视开挂的。。。

显示全部楼层 · 发表于 2012-3-9 18:36:13

2012-3-9 18:30:34,C:\Documents and Settings\Administrator.CHINA-3D80B4853\桌面\3-3.exe,26,Blocked ;改变关键注册表项目 (HKCU\Software\Microsoft\Internet Explorer\Main,Start Page)
2012-3-9 18:30:44,C:\Documents and Settings\Administrator.CHINA-3D80B4853\桌面\3-3.exe,54,Allowed ;Receiving incoming network packets
2012-3-9 18:30:50,C:\Documents and Settings\Administrator.CHINA-3D80B4853\桌面\3-3.exe,50,Allowed ;Accessing the network via DNSResolver service
2012-3-9 18:31:01,C:\Documents and Settings\Administrator.CHINA-3D80B4853\桌面\3-3.exe,51,Allowed ;Inter-process communication (Svchost.OLE.BackgroundCopyManager)
2012-3-9 18:31:04,C:\Documents and Settings\Administrator.CHINA-3D80B4853\桌面\3-3.exe,48,Allowed ;Outgoing network access
2012-3-9 18:31:10,C:\WINDOWS.0\system32\wbem\wmiprvse.exe,51,Allowed ;Inter-process communication (Svchost.OLE.BackgroundCopyManager)
2012-3-9 18:31:37,C:\Program Files\Internet Explorer\IEXPLORE.EXE,51,Blocked ;Inter-process communication (Explorer.OLE-756)
2012-3-9 18:31:40,C:\Program Files\Internet Explorer\IEXPLORE.EXE,54,Terminated ;Receiving incoming network packets
2012-3-9 18:31:42,C:\Program Files\Internet Explorer\IEXPLORE.EXE,50,Terminated ;Accessing the network via DNSResolver service
2012-3-9 18:32:35,C:\Program Files\Internet Explorer\IEXPLORE.EXE,51,Terminated ;Inter-process communication (Explorer.OLE-756)

显示全部楼层 · 发表于 2012-3-9 19:06:48

双击表示修改explorer内存和用explorer的接口然后修改ie设置，最后一顿联网

显示全部楼层 · 发表于 2012-3-9 19:18:23

[病毒样本] 超级木马