MD5: 38E64F CCF600

promised

vb小毒，360Server.exe是母体，添加自身服务
释放的360Safe.exe改了下主页，就这么点

1. 00404B05   MOV EAX,360Safe.0040380C                  UNICODE "http://www.007788.com/tongji/iurl.txt"
   
2. 004050DB   PUSH 360Safe.004041B8                     UNICODE "Start Page"
   
3. 004050E0   PUSH 360Safe.00404160                     UNICODE "Software\Microsoft\Internet Explorer\Main"
   
4. 004050FB   MOV DWORD PTR SS:[EBP-68],360Safe.004041  UNICODE "www.007788.com"
   
5. 00405133   MOV EDX,360Safe.004041D4                  UNICODE "www.007788.com"
   
6. 0040513D   MOV EDX,360Safe.004041B8                  UNICODE "Start Page"
   
7. 00405147   MOV EDX,360Safe.00404160                  UNICODE "Software\Microsoft\Internet Explorer\Main"
   
8. 00405188   MOV EDX,360Safe.004041D4                  UNICODE "www.007788.com"
   
9. 00405192   MOV EDX,360Safe.004041B8                  UNICODE "Start Page"
   
10. 0040519C   MOV EDX,360Safe.004041F8                  UNICODE "SOFTWARE\Microsoft\Internet Explorer\Main"
    
11. 004051D7   MOV EDX,360Safe.004041D4                  UNICODE "www.007788.com"
    
12. 004051E1   MOV EDX,360Safe.00404250                  UNICODE "Default_Page_URL"
    
13. 004051EB   MOV EDX,360Safe.004041F8                  UNICODE "SOFTWARE\Microsoft\Internet Explorer\Main"
    
14. 004053C1   CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrVa  (初始 CPU 选择)
    

复制代码

SONGBOWEN

我这里红伞解压以后一样会喀嚓的！
Begin scan in 'C:\Documents and Settings\Administrator\桌面\360Safe.exe'
Begin scan in 'C:\Documents and Settings\Administrator\桌面\360Server.exe'
C:\Documents and Settings\Administrator\桌面\360Server.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING]   The file was ignored!

cy6266812

AVAST没报

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.VB.ylo   
病毒： Trojan.Win32.VB.yrp      

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.19.62

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 982
Paranoia Database - 49114
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder (2)

C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\360Safe.exe - Suspected MaliciousScope:GENERIC.MALWARE.1
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\360Server.exe - Suspected MaliciousScope:GENERIC.MALWARE.1

2 Files scanned
0 Infected files found
2 Suspected files found
0 Files disinfected
0 Files deleted

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\����.rar'
C:\Users\morgan\Documents\
  ����.rar
    [0] Archive type: RAR
    --> 360Safe.exe
    --> 360Server.exe
        [DETECTION] Is the Trojan horse TR/StartPage.auc
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!