毒网

显示全部楼层 · 发表于 2007-10-1 13:30:39

http://bbs.jufv.com/index.php
动谩X帝国挂毒，费尔报

显示全部楼层 · 发表于 2007-10-1 13:49:31

fil报了什么该不会是 encoder吧……

显示全部楼层 · 发表于 2007-10-1 14:21:56

进去后小A未报了！

显示全部楼层 · 发表于 2007-10-1 14:26:38

http://www.nmmmn.com/sms.exe

显示全部楼层 · 发表于 2007-10-1 14:27:55

detected: Trojan program Trojan-Downloader.Win32.Baser.w URL: http://bbs.kafan.cn/attachment.php?aid=134253//sms.exe

显示全部楼层 · 发表于 2007-10-1 14:30:34

唉，今天真没心情解密脚本

显示全部楼层 · 发表于 2007-10-1 14:32:10

D:\Documents and Settings\EKINCHENG\桌面\sms.rar » RAR » sms.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\sms.rar - probably a variant of Win32/Genetik trojan - deleted - quarantined

显示全部楼层 · 发表于 2007-10-1 14:45:56

TrendMicro  TROJ_BASER.Y
VBA32  MalwareScope.Trojan-PSW.Game.14
Avast!  Win32:Delf-FVX
nProtect BehavesLike:Win32.ExplorerHijack
Panda  Suspicious file
Webwasher-Gateway Heuristic.Malware
NOD32  probably a variant of Win32/Genetik
Kaspersky  Trojan-Downloader.Win32.Baser.w
Bitdefender  Trojan.Downloader.Delf.OAG
Ikarus  Trojan-PWS.Win32.QQPass.pb
F-Secure  Trojan-Downloader.Win32.Baser.w
F-Prot  W32/Downloader-WebExe-based!Maximus
Sophos  W32/Versie-Gen
Fortinet  W32/Versie.W!tr.dldr
AhnLab  Win-Trojan/Hupigon.Gen
Dr.WEB  BackDoor.WebDor
Avira  HEUR/Malware
Symentec  W32.Fubalca.E
Authentium  Possibly a new variant of W32/Downloader-WebExe-based!Maximus

sms.exe : INFECTED with W32/Malware
Compressed: NO

[ GNR info ]
* Drops files in %WINSYS% folder.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM32\servver.exe.
* Creates file C:\WINDOWS\SYSTEM32\Alletdel.bat.

[ Changes to registry ]
* Creates key "HKLM\System\CurrentControlSet\Services\Windowsms".
* Sets value "ImagePath"="C:\WINDOWS\SYSTEM32\servver.exe" in key "HKLM\System\CurrentControlSet\Services\Windowsms".
* Sets value "DisplayName"="Telephots google" in key "HKLM\System\CurrentControlSet\Services\Windowsms".

[ Process&window info]
* Attempts to access service "Windowsms".
* Creates service "Windowsms (Telephots google)" as "C:\WINDOWS\SYSTEM32\servver.exe".

显示全部楼层 · 发表于 2007-10-1 15:00:48

这个也是老朋友了

显示全部楼层 · 发表于 2007-10-1 17:51:27

嗯。的确有问题！

[病毒样本] 毒网

本帖子中包含更多资源

本帖子中包含更多资源

回复 4楼 promised 的帖子