强毒(等高人分析)

Nblock

微点主动防御

zhbst

原帖由 爱陌能住 于 2007-10-9 18:37 发表
怎么能看出我重启后系统中是否还有这个病毒的残余呢???(用影子的.但不知是否能完全恢复??)

唉...好晕啊~~...

我将EQ设为自学习.(主要想看看日志.)
所以对系统文件的保护也就为0了...
开着SSM.运行这个毒.(SS ...

我都执行了好几个小时了，到现在一点反应都没有，重启好几扁都没事，难道我下错样本了

xss517

好像很厉害的病毒

a256886572008

上面就是這隻毒最強的行為，"訪問物理內存"





上面的VRT1B1.tmp，應該會作感染的行為，在附件！




上面是樓主說的，透過RD穿OS牆








總結：過不了EQ

[ 本帖最后由 a256886572008 于 2007-10-9 23:30 编辑 ]

kuririn

樓上看 13樓

a256886572008

運行脫完殼的病毒！

















下面的行為，就是樓主說的IRCBOT

a256886572008

下載回來的，也和那隻有一樣的行為！

孤独更可靠

晕,没有出现感染文件?

a256886572008

有啊！

24樓的附件那隻病毒，會感染文件，

還有透過RD穿OS牆！

只有下面這隻比較強
http://ntkrnlpa.info/rc/file.php?id=1

其他都是MSN病毒，很弱

還有，"訪問物理內存"，應該要阻止吧！

不然沒有一家HIPS能攔住！

[ 本帖最后由 a256886572008 于 2007-10-10 08:14 编辑 ]

a256886572008

他會在C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp 下面

生成img17.zip

還有下載hmo[1].exe和smi[1].txt

以下是smi[1].txt的內容

This picture isnt you... right?
newest pics for ya :)
hey did i ever show you this picture of me?
is it ok if I add this pic to my new slideshow?
can i up some of these pics of ya to my myspace profile?
Wow i think i found your pic on myspace!
hah I think I found an old pic of us!
haha lets hope your parents dont see this picture of you :D
you care if i put this pictuer of you in my new album?
OMFG!!!!!!!! :D
wow! look at this old picture i found
sorry about the messup i fixed the pic! Try it one more time pz
is this pic tooo sexy for photobucket??
wow I just dyed my hair... You will never believe the color it is now. lol And dont laugh
my crazy sister wants u to see these pics for some reason... take a look
Can i put this pic of you into my new myspace album?
Take a look at the new pics already! :p
I cant believe they wanted me to upload this picture to facebook lol. Its terrible. Like my outfit tho?
Lmfao hey im sending my new pictures! Check em out!
I've been editing some pics you should def see em lol!
dude i just got these pictures off my digital for you! Gimme a moment to find em and send
Wanna see my pics before i send em to facebook?
do you think this picture is too kinky for Myspace?
Hey accept my pictures, i got a bunch from when i was like a toddler :X
I think this picture is terrible. but my friends on myspace want to see it. please dont show noone.
Hey just finished new myspace album! :) theres a few kinky ones in there!
OMG, i found ur pic on cuteornot.com! Check it out
hey you got a myspace album? anyways heres my new myspace album :) accept k?
do I look dumb in this picture? I want to put it on myspace.
hey man accept my pics. :( i just edited it to look maad funny..
Dude i found your picture on hotornot.com! Take a look!