请版主关闭此帖!!!

6956030

声明:  这个帖子不是本人发的  
声明:  这个帖子不是本人发的  
声明:  这个帖子不是本人发的  

(我修改不了附件)

大家不要乱下这帖子的东西

[ 本帖最后由 6956030 于 2007-12-13 18:39 编辑 ]

SONGBOWEN

麻烦提供木马的主程序（EXE）……
不知道是什么加密方式，都是16进制的，但是用16进制转成字符来显示还是不对……

leonfg

你让它运行一下然后看防火墙记录 就知道了

Graybird

Starting the file scan:

Begin scan in 'E:\1.rar'
E:\1.rar
  [0] Archive type: RAR
  --> н¨Îļþ¼Ð (2)\ciqyiqxdk.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> н¨Îļþ¼Ð (2)\75976MM.DLL
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> н¨Îļþ¼Ð (2)\raqjhtl_unpacked.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.23374.1
  --> н¨Îļþ¼Ð (2)\gdqqhxi32_unpacked.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> н¨Îļþ¼Ð (2)\gdrxjhi32.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> н¨Îļþ¼Ð (2)\gdtli32.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> н¨Îļþ¼Ð (2)\gdjzi32.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> н¨Îļþ¼Ð (2)\HookHelp.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> н¨Îļþ¼Ð (2)\LotusHlp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> н¨Îļþ¼Ð (2)\75976WL.DLL
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> н¨Îļþ¼Ð (2)\gdmsi32.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
  --> н¨Îļþ¼Ð (2)\gdmhi32.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [WARNING]   The file was ignored!
Begin scan in 'E:\2.rar'
E:\2.rar
  [0] Archive type: RAR
  --> н¨Îļþ¼Ð\kvdxjma.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.kcy
  --> н¨Îļþ¼Ð\kawdfzy.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.kdg
  --> н¨Îļþ¼Ð\raqjhpi.dll
      [DETECTION] Is the Trojan horse TR/FWDisable.23374.1
  --> н¨Îļþ¼Ð\kapjezy.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGam.htk
  --> н¨Îļþ¼Ð\avzxkmn.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.kdf
  --> н¨Îļþ¼Ð\kvdxjis.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.kcy
  --> н¨Îļþ¼Ð\kawdfaz.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.kdg
  --> н¨Îļþ¼Ð\raqjhtl.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.23374.1
  --> н¨Îļþ¼Ð\75976L.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> н¨Îļþ¼Ð\LotusHlp.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> н¨Îļþ¼Ð\75976M.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> н¨Îļþ¼Ð\mshmdj32.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> н¨Îļþ¼Ð\avzxkst.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.kdf
  --> н¨Îļþ¼Ð\kapjeaz.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGam.htk
  --> н¨Îļþ¼Ð\gdzhtui32.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> н¨Îļþ¼Ð\gdwli32.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> н¨Îļþ¼Ð\gddh3i32.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLiGames.jrs
  --> н¨Îļþ¼Ð\gdmoyi32.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> н¨Îļþ¼Ð\gdgji32.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> н¨Îļþ¼Ð\gdhnxai32.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> н¨Îļþ¼Ð\unpacked.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.23374.1
  --> н¨Îļþ¼Ð\gdqqhxi32.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> н¨Îļþ¼Ð\gdwmi32.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [WARNING]   The file was ignored!


End of the scan: 2007年12月11日  12:29
Used time: 00:34 min

The scan has been done completely.

      0 Scanning directories
     50 Files were scanned
     34 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     16 Files not concerned
      2 Archives were scanned
      2 Warnings
      0 Notes

6956030

回3楼的 我是想知道他用什么加密方式和 怎么去解 我试过好多个方法都是没效果

SONGBOWEN

e.....
毒马包啊？！？！
哪个才是生成这堆文件的？！

6956030

忘了  马一下好沙盘就假死了 所以我自己都不知道那个生出来的

[ 本帖最后由 6956030 于 2007-12-11 12:48 编辑 ]

SONGBOWEN

爆汗
总不能挨个运行看记录吧……

6956030

应该是gd开头后面有32的那几个DLL

EXE是那个我就8清楚咯

SONGBOWEN

那你试试用虚拟机运行吧……
反正我不运行了。。。
太乱