1个新的[c767d2]

显示全部楼层 · 发表于 2007-11-9 22:23:32

execmain.exe - 变形的 MFC App
真正的执行入口： 4044F4
会将Homepage改为www.kzxf.net
同时创建驱动服务
修改Internet Explorer快捷方式
隐藏桌面上的IE，以一个伪的代替

显示全部楼层 · 发表于 2007-11-9 23:53:04

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\execmain.rar'
C:\Users\morgan\Documents\
  execmain.rar
[0] Archive type: RAR
--> execmain.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-11-10 08:34:28

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ %s\msvcrt.dll Type Start ErrorControl Group DisplayName ImagePath System Bus Extender SYSTEM\CurrentControlSet\Services\%s system32\drivers\%s.sys w+b www.kzxf.net/?m MSSYS32 %s\%s.sys %s\drivers %c%c%c%c%c%c%c%c Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu {871C5380-42A0-1069-A2EA-08002B30309D} \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ Q u i c k L a u n c h \ /T≧ I n t e r n e t E x p l o r e r Om葔hV. l n k 查找并显示 Internet 上的信息和网站。 www.kzxf.net/?m// %%HOMEDRIVE%%%%HOMEPATH%% \ I n t e r n e t E x p l o r e r . l n k \Internet Explorer\IEXPLORE.EXE c:\tmp.d

显示全部楼层 · 发表于 2007-11-10 08:51:04

刚下的KILL

显示全部楼层 · 发表于 2007-11-11 02:17:28

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 814
Paranoia Database - 48608
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\execmain.exe

C:\Documents and Settings\Uhthn\Desktop\execmain.exe - Suspected TROJAN-DOWNLOADER (HTTP://...)

1 Files scanned
0 Infected files found
1 Suspected files found
0 Files disinfected
0 Files deleted

显示全部楼层 · 发表于 2007-11-13 17:02:52

C盘目录下会生成.bat+.exe各一个。系统登录后在%user profiles%\local settings\temp会自动连上www.kzxf.net下载tempA.exe, tempB.exe, tempC.exe, tempD.exe.....并在后台自动运行。劫持IE主页，生成并加载系统服务，并在系统盘program files下生成CNNIC的相关目录，会易名。。

显示全部楼层 · 发表于 2007-11-13 21:07:17

下不了！F-S提示：
在文件 C:\Documents and Settings\jljqq\Local Settings\Temporary Internet Files\Content.IE5\FRXBZL0W\execmain[1].rar 中发现恶意代码。
感染: Trojan.Win32.StartPage.atv
操作: 无.

显示全部楼层 · 发表于 2007-11-13 21:47:03

Kaspersky Internet Security 7.0The requested URL http://bbs.kafan.cn/attachment.php?aid=151294 is infected with Trojan.Win32.StartPage.atv virus

[病毒样本] 1个新的[c767d2]

本帖子中包含更多资源