老爸喜欢看直播，喜欢给主播刷刷免费礼物什么的 一般都是抢土豪刷礼物给的箱子里的游戏币，但是奈何网速和手速不行好多时候只能看别人抢 ，然后老爸就不知道从那里搞来了这个“软件”来抢币，中间运行好几次都被360拦截“恶意网络访问”和“线程注入” ！我给老爸说了不要用这些东西，小心电脑GG就开心了！他就是说没毒放心都抢了好多次了 ，360扫描没什么问题，但是我放到“哈勃”看了一下这玩意好像真的不正常 关键行为| 行为描述： | 跨进程写入数据 | | 详情信息： | TargetProcess = C:\Users\Administrator\AppData\Local\%temp%\b70c.exe, WriteAddress = 0x00150000, Size = 0x00000020 TargetPID = 0x00000fb4 TargetProcess = C:\Users\Administrator\AppData\Local\%temp%\b70c.exe, WriteAddress = 0x00150020, Size = 0x00000034 TargetPID = 0x00000fb4 TargetProcess = C:\Users\Administrator\AppData\Local\%temp%\b70c.exe, WriteAddress = 0x7ffde238, Size = 0x00000004 TargetPID = 0x00000fb4 TargetProcess = C:\Users\Administrator\AppData\Local\%temp%\b70c.exe, WriteAddress = 0x00150000, Size = 0x00000020 TargetPID = 0x00000efc TargetProcess = C:\Users\Administrator\AppData\Local\%temp%\b70c.exe, WriteAddress = 0x00150020, Size = 0x00000034 TargetPID = 0x00000efc TargetProcess = C:\Users\Administrator\AppData\Local\%temp%\b70c.exe, WriteAddress = 0x7ffdf238, Size = 0x00000004 TargetPID = 0x00000efc | | 行为描述： | 探测 Virtual PC是否存在 | | 详情信息： | N/A | | 行为描述： | 直接调用系统关键API | | 详情信息： | Index = 0x000000EA, Name: NtQueryInformationProcess, Instruction Address = 0x007FA334 Index = 0x0000014F, Name: NtSetInformationThread, Instruction Address = 0x00808DF1 Index = 0x000000EA, Name: NtQueryInformationProcess, Instruction Address = 0x0080C939 | | 行为描述： | 杀掉进程 | | 详情信息： | C:\Users\Administrator\AppData\Local\%temp%\b70c.exe | | 行为描述： | 尝试打开调试器或监控软件的驱动设备对象 | | 详情信息： | \??\SICE \??\SIWVID \??\NTICE | | 行为描述： | 查询注册表_检测虚拟机相关 | | 详情信息： | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | | 行为描述： | 获取TickCount值 | | 详情信息： | TickCount = 169641, SleepMilliseconds = 2001. TickCount = 174907, SleepMilliseconds = 2001. TickCount = 175016, SleepMilliseconds = 2001. TickCount = 175032, SleepMilliseconds = 2001. TickCount = 175172, SleepMilliseconds = 2001. TickCount = 174346, SleepMilliseconds = 300. TickCount = 176297, SleepMilliseconds = 2001. TickCount = 174612, SleepMilliseconds = 300. TickCount = 174628, SleepMilliseconds = 300. TickCount = 174643, SleepMilliseconds = 300. TickCount = 176563, SleepMilliseconds = 2001. TickCount = 179625, SleepMilliseconds = 5000. TickCount = 177188, SleepMilliseconds = 2001. TickCount = 177235, SleepMilliseconds = 2001. TickCount = 175550, SleepMilliseconds = 300. | | 行为描述： | 直接获取CPU时钟 | | 详情信息： | EAX = 0x3927d1d7, EDX = 0x0000008d EAX = 0x3927d223, EDX = 0x0000008d EAX = 0x3927d26f, EDX = 0x0000008d EAX = 0x3927d2bb, EDX = 0x0000008d EAX = 0x3927d307, EDX = 0x0000008d EAX = 0x3927d353, EDX = 0x0000008d EAX = 0x3927d39f, EDX = 0x0000008d EAX = 0x3927d3eb, EDX = 0x0000008d EAX = 0x3927d437, EDX = 0x0000008d EAX = 0x3927d483, EDX = 0x0000008d EAX = 0xfd7a8aa7, EDX = 0x00000092 EAX = 0x1fe4c097, EDX = 0x00000093 EAX = 0x1fe4c0e3, EDX = 0x00000093 EAX = 0x1fe4c12f, EDX = 0x00000093 EAX = 0x1fe4c17b, EDX = 0x00000093 | | 行为描述： | 查找指定内核模块 | | 详情信息： | lstrcmpiA: ntice.sys <------> ntkrnlpa.exe Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> halmacpi.dll Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> kdcom.dll Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> mcupdate_GenuineIntel.dll Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> PSHED.dll Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> BOOTVID.dll Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> CLFS.SYS Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> CI.dll Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> Wdf01000.sys Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> WDFLDR.SYS Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> ACPI.sys Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> WMILIB.SYS Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> msisadrv.sys Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> pci.sys Des: SoftICE驱动 lstrcmpiA: ntice.sys <------> vdrvroot.sys Des: SoftICE驱动 | | 行为描述： | 查找反病毒常用工具窗口 | | 详情信息： | NtUserFindWindowEx: [Class,Window] = [OLLYDBG,] NtUserFindWindowEx: [Class,Window] = [GBDYLLO,] NtUserFindWindowEx: [Class,Window] = [pediy06,] NtUserFindWindowEx: [Class,Window] = [FilemonClass,] NtUserFindWindowEx: [Class,Window] = [PROCMON_WINDOW_CLASS,] NtUserFindWindowEx: [Class,Window] = [RegmonClass,] | | 行为描述： | VMWare特殊指令检测虚拟机 | | 详情信息： | N/A |
提示“轻度风险” ，说真的真怕是“表面辅助”“合法远控”，就怕老爸笔记本变成了远控肉鸡 老爸很多工作资料都在他电脑上，挺为他担心的....希望大家帮我仔细看看这个软件到底问题多不多，也好让我给老爸做思想工作。谢谢大家了
文件超过上传限制（文件为29M），就用百度网盘分享了：链接：https://pan.baidu.com/s/1kW0ovX1 密码：00tq
|
发表于 2018-2-6 02:25:21
楼主
