疑似热血江湖木马

显示全部楼层 · 发表于 2008-4-11 19:56:40

rising20.39.42未杀！

显示全部楼层 · 发表于 2008-4-11 20:10:52

to kl

显示全部楼层 · 发表于 2008-4-11 20:12:36

nod32报了！！！

显示全部楼层 · 发表于 2008-4-11 20:22:16

江民主防拦截搞定

[ 本帖最后由 garyyan456 于 2008-4-11 20:24 编辑 ]

显示全部楼层 · 发表于 2008-4-11 20:26:49

McAfee New Malware.n

显示全部楼层 · 发表于 2008-4-12 00:06:38

卡巴无视
费尔报了

显示全部楼层 · 发表于 2008-4-12 08:09:55

D:\Documents and Settings\EKINCHENG\桌面\热血特辅\热血特辅.exe a variant of Win32/PSW.OnLineGames.NMN trojan deleted - quarantined Event occurred on a new file created by the application: D:\Program Files\WinRAR\WinRAR.exe.
D:\Documents and Settings\EKINCHENG\桌面\热血特辅\热血特辅.exe » RAR » 1.exe a variant of Win32/PSW.OnLineGames.NMN trojan was a part of the deleted object
D:\Documents and Settings\EKINCHENG\桌面\热血特辅\热血特辅.exe » RAR » rxjh.ico is OK

显示全部楼层 · 发表于 2008-4-12 09:23:40

W32/Suspicious_U.gen.dropper
fscs7.11

显示全部楼层 · 发表于 2008-4-12 09:34:37

LLTk#+#i.exek - Trojan-PSW.Win32.OnLineGames.aagp

显示全部楼层 · 发表于 2008-4-12 12:30:31

文本字符串参考位于 1:.Upack
地址    反汇编                                        文本字符
004015AA cmp eax,-1                                     (初始 CPU 选择)
00401770 mov edx,1.004017B0                            ASCII "hj.dll"
0040183B mov edx,1.00401858                            ASCII "KVXP_Monitor"
0040186B mov edx,1.00401888                            ASCII "Q360SafeMonClass"
0040195C mov edx,1.00401984                            ASCII "AVP.Tray"
004019C5 mov edx,1.00401A80                            ASCII "AVP.Tray"
00401A01 mov edx,1.00401A8C                            ASCII "AVP.TrafficMonConnectionTerm"
00401A26 mov edx,1.00401AAC                            ASCII "AVP.Button"
00401AF1 mov edx,1.00401C68                            ASCII "$kmu87ytg.bat"
00401B7E mov edx,1.00401C78                            ASCII "
"
00401BA0 mov edx,1.00401C7C                            ASCII "if exist "
00401BBA mov edx,1.00401C88                            ASCII "goto try
"
00401BDC mov edx,1.00401C94                            ASCII "del %0"
00401DAF mov edx,1.004040E7                            ASCII 0A,"ccc0318f0f"
00401DC6 mov edx,1.00402048                            ASCII "HJ"
00401DFE mov edx,1.0040204C                            ASCII "VerClsid.exe"
00401EAD mov edx,1.00402060                            ASCII "dllfile"
00401F03 push 1.00402068                               ASCII "jksHook"
00401F18 push 1.00402070                               ASCII "jtzHook"
00401F2D mov edx,1.00402078                            ASCII "LKOL93KFGKM7DX"
是厄，木马应该是的，不过懒得往下跟，要替换一个系统文件，不想折腾了

[可疑文件] 疑似热血江湖木马

6/0

呵呵,如LZ所说,捆的

本帖子中包含更多资源