刚刚同学家抓的．．．（替换ctfmon.exe）

kk12

费尔现威力

kk12

国产病毒吧？kv2008

yclidong

瑞星2008病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.Win32.Agent.ztf   

软件版本：20.14.52

The EQs

新建文件：C:\WINDOWS\system32\ctfmon.exe
C:\msutility.bat
C:\WINDOWS\system32\taimpo.txt
C:\WINDOWS\system32\config\AppEventw.cfg
c:\conime.exe
c:\conime1.exe
c:\conime2.exe
C:\WINDOWS\upxdnd.exe
C:\WINDOWS\system32\upxdnd.dll
C:\WINDOWS\WinForm.exe
C:\WINDOWS\system32\WinForm.dll
C:\DOCUME~1\Sandbox\LOCALS~1\Temp\tmp14.tmp
C:\DOCUME~1\Sandbox\LOCALS~1\Temp\tmp16.tmp
C:\DOCUME~1\Sandbox\LOCALS~1\Temp\tmp18.tmp
C:\DOCUME~1\Sandbox\LOCALS~1\Temp\tmp1B.bat
C:\WINDOWS\system32\zxatl.cfg
C:\DOCUME~1\Sandbox\LOCALS~1\Temp\tmp20.tmp
C:\WINDOWS\system32\zxatl.dll
C:\WINDOWS\system32\sqmapi32.dll
C:\WINDOWS\GenProtect.exe
C:\WINDOWS\system32\GenProtect.dll
C:\WINDOWS\MsIMMs32.exe
C:\WINDOWS\system32\MsIMMs32.dll
删除文件：C:\WINDOWS\system32\ctfmon.exe
C:\file.exe
C:\MSUTIL~1.BAT
C:\WINDOWS\system32\upxdnd.dll
c:\conime1.exe
c:\conime2.exe
C:\WINDOWS\system32\WinForm.dll
C:\DOCUME~1\Sandbox\LOCALS~1\Temp\tmp14.tmp
C:\WINDOWS\system32\sqmapi32.dll
C:\DOCUME~1\Sandbox\LOCALS~1\Temp\tmp16.tmp
C:\DOCUME~1\Sandbox\LOCALS~1\Temp\tmp18.tmp
C:\DOCUME~1\Sandbox\LOCALS~1\Temp\tmp1B.tmp
C:\DOCUME~1\Sandbox\LOCALS~1\Temp\tmp1B.bat
C:\WINDOWS\system32\zxatl.dll
C:\DOCUME~1\Sandbox\LOCALS~1\Temp\tmp20.tmp
C:\DOCUME~1\Sandbox\LOCALS~1\Temp\tmp18.tmp
c:\conime2.exe
C:\WINDOWS\system32\GenProtect.dll
C:\WINDOWS\system32\MsIMMs32.dll
修改注册表：HKEY_LOCAL_MACHINE\SoftWare\Microsoft\Windows\CurrentVersion\RUN "upxdnd" = C:\WINDOWS\upxdnd.exe
HKEY_LOCAL_MACHINE\SoftWare\Microsoft\Windows\CurrentVersion\RUN "WinForm" = C:\WINDOWS\WinForm.exe
HKEY_LOCAL_MACHINE\SoftWare\Microsoft\Windows\CurrentVersion\RUN "GenProtect" = C:\WINDOWS\GenProtect.exe
HKEY_LOCAL_MACHINE\SoftWare\Microsoft\Windows\CurrentVersion\RUN "MsIMMs32" = C:\WINDOWS\MsIMMs32.exe

下载东东：http://60.190.222.235/elf_listo.txt (60.190.222.235)  
http://60.190.222.235/win1.exe (60.190.222.235)  
http://60.190.222.235/win2.exe (60.190.222.235)  
http://60.190.222.235/win3.exe (60.190.222.235)  
http://60.190.222.235/win4.exe (60.190.222.235)  
http://60.190.222.235/win5.exe (60.190.222.235)  
http://60.190.222.235/win6.exe (60.190.222.235)  
http://60.190.222.235/win7.exe (60.190.222.235)

秋叶濛濛

楼主真及时 刚看到阳光写的报告
样本就来了

DW日志：
Attempt to open process C:\WINDOWS\system32\ctfmon.exe
Attempt to delete file C:\WINDOWS\system32\ctfmon.exe
Attempt to overwrite file C:\WINDOWS\system32\ctfmon.exe
Attempt to set value Personal within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\
Attempt to set value Common Documents within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\
Attempt to set value Common Desktop within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\
Attempt to set value Desktop within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\
Attempt to set value Cache within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\
Attempt to set value Cookies within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\
Attempt to set value C:\Download\msutility.bat within the key HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\

[ 本帖最后由 秋叶濛濛 于 2007-10-20 19:17 编辑 ]

qigang

原帖由 EQ2 于 2007-10-20 18:04 发表
新建文件：C:\WINDOWS\system32\ctfmon.exe
C:\msutility.bat
C:\WINDOWS\system32\taimpo.txt
C:\WINDOWS\system32\config\AppEventw.cfg
c:\conime.exe
c:\conime1.exe
c:\conime2.exe
C:\WINDOWS\upxdnd.e ...

RX20.14.52很多未报！

电影结束了

原帖由 EQ2 于 2007-10-20 18:04 发表
新建文件：C:\WINDOWS\system32\ctfmon.exe
C:\msutility.bat
C:\WINDOWS\system32\taimpo.txt
C:\WINDOWS\system32\config\AppEventw.cfg
c:\conime.exe
c:\conime1.exe
c:\conime2.exe
C:\WINDOWS\upxdnd.e ...

果然是个下载者．．．．．．．．．．

chr707

Known viruses: 159880
Engine version: 0.91.2
Scanned directories: 0
Scanned files: 1
Skipped non-executable files: 0
Infected files: 0

Data scanned: 0.02 MB
Time: 14.906 sec (0 m 14 s)
--------------------------------------
Completed


clamwin 没有反应～～～～～～～～

chr707

*** Scanning Programs in Computer Memory ***

Unloading program C:\WINDOWS\system32\drivers\scvhost.exe from memory
Unloading program C:\WINDOWS\system32\ctfmon.exe from memory

*** Scanned 23 processes - 329 modules ***
*** Computer Memory Scan Completed ***


C:\WINDOWS\system32\sqmapi32.dll: Trojan.Spy-13381 FOUND
C:\WINDOWS\system32\drivers\scvhost.exe: Trojan.Delf-811 FOUND
C:\WINDOWS\system32\ctfmon.exe: Trojan.Downloader-14298 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 159880
Engine version: 0.91.2
Scanned directories: 0
Scanned files: 352
Skipped non-executable files: 0
Infected files: 3

第二次搞定  奇怪

namuel

KIS报毒 但是不能清除