【高质量】4/42

显示全部楼层 · 发表于 2012-6-18 15:22:16

仅有4家报，其中3家是冷门杀软

Antivirus Result Update
AhnLab-V3 - 20120618
AntiVir - 20120618
Antiy-AVL - 20120618
Avast - 20120618
AVG - 20120617
BitDefender - 20120618
ByteHero - 20120618
CAT-QuickHeal - 20120616
ClamAV - 20120617
Commtouch - 20120618
Comodo - 20120618
DrWeb - 20120618
Emsisoft - 20120618
eSafe - 20120617
F-Prot - 20120617
F-Secure - 20120618
Fortinet - 20120617
GData - 20120618
Ikarus - 20120618
Jiangmin - 20120618
K7AntiVirus - 20120615
Kaspersky - 20120618
McAfee - 20120618
McAfee-GW-Edition - 20120618
Microsoft - 20120618
NOD32 Win32/Packed.Autoit.E.Gen 20120617
Norman - 20120617
nProtect - 20120617
Panda - 20120617
PCTools - 20120618
Rising - 20120618
Sophos - 20120618
SUPERAntiSpyware - 20120617
Symantec - 20120618
TheHacker Trojan/Dropper.gen 20120616
TotalDefense - 20120615
TrendMicro - 20120618
TrendMicro-HouseCall - 20120617
VBA32 Trojan.Autoit.F 20120615
VIPRE - 20120618
ViRobot - 20120618
VirusBuster Worm.Autoit.Gen 20120617

下载
http://www.kuaipan.com.cn/file/id_45530892470321168.htm

密码infected

显示全部楼层 · 发表于 2012-6-18 15:22:38

。

显示全部楼层 · 发表于 2012-6-18 15:28:31

哇塞真的高质量啊过毛豆过小A 过红伞过hitmanpro

显示全部楼层 · 发表于 2012-6-18 15:30:56

显示全部楼层 · 发表于 2012-6-18 16:25:37

双击都无法运行

显示全部楼层 · 发表于 2012-6-18 16:57:51

无法运行怎么杀？？

显示全部楼层 · 发表于 2012-6-18 17:00:25

火眼报告
T1：https://fireeye.ijinshan.com/ana ... e9fb9b63174206602bc
T2：https://fireeye.ijinshan.com/ana ... c730a6aae580c03b3ee

显示全部楼层 · 发表于 2012-6-18 17:09:04

<td>C:\Documents and Settings\Administrator\桌面\T1.exe
</td>
<td>修改文件
</td>
<td>\Device\NamedPipe\lsarpc
</td>
</tr>
<tr>
<td>2002-01-01 17:06:04
</td>
<td>C:\Documents and Settings\Administrator\桌面\T1.exe
</td>
<td>修改注册表项
</td>
<td>HKUS\S-1-5-21-842925246-1935655697-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{829cc207-ff59-11d5-a204-806d6172696f}\BaseClass
</td>
</tr>
<tr>
<td>2002-01-01 17:06:04
</td>
<td>C:\Documents and Settings\Administrator\桌面\T1.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\Temp\autD4.tmp
</td>
</tr>
<tr>
<td>2002-01-01 17:06:04
</td>
<td>C:\Documents and Settings\Administrator\桌面\T2.exe
</td>
<td>修改文件
</td>
<td>\Global??\FltMgrMsg
</td>
</tr>
<tr>
<td>2002-01-01 17:06:10
</td>
<td>C:\Documents and Settings\Administrator\桌面\T2.exe
</td>
<td>修改文件
</td>
<td>\Device\NamedPipe\lsarpc
</td>
</tr>
<tr>
<td>2002-01-01 17:06:10
</td>
<td>C:\Documents and Settings\Administrator\桌面\T2.exe
</td>
<td>修改注册表项
</td>
<td>HKUS\S-1-5-21-842925246-1935655697-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{829cc207-ff59-11d5-a204-806d6172696f}\BaseClass
</td>
</tr>
<tr>
<td>2002-01-01 17:06:10
</td>
<td>C:\Documents and Settings\Administrator\桌面\T2.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\Temp\autDB.tmp
</td>
</tr>
</table>
<table width="100%" bgcolor="#CFCFE5" border="0">
<tr>
<td>
<font face="Arial" size="+1">报告结束</font>
COMODO 日志

显示全部楼层 · 发表于 2012-6-18 18:42:28

过hitman，coranti

显示全部楼层 · 发表于 2012-6-19 14:15:17

消停发表于 2012-6-18 16:25
双击都无法运行

09:56:38:236;1308;D:\我的文档\Desktop\【2012.6.18】Desktop\T2.exe;设置注册表键值;键: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{665e4032-b76f-11e1-ba8a-806d6172696f}键值: BaseClass数据: Drive;
09:56:38:252;1308;D:\我的文档\Desktop\【2012.6.18】Desktop\T2.exe;设置注册表键值;键: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{665e4033-b76f-11e1-ba8a-806d6172696f}键值: BaseClass数据: Drive;
09:56:38:283;1308;D:\我的文档\Desktop\【2012.6.18】Desktop\T2.exe;设置注册表键值;键: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{665e4034-b76f-11e1-ba8a-806d6172696f}键值: BaseClass数据: Drive;
09:56:38:283;1308;D:\我的文档\Desktop\【2012.6.18】Desktop\T2.exe;设置注册表键值;键: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{665e4036-b76f-11e1-ba8a-e2325106ed81}键值: BaseClass数据: Drive;

[病毒样本] 【高质量】4/42

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源