无耻木马，害我重装电脑（顽固型木马）７层壳

woai_jolin

加7层还是不能过sandbox
Norman 5.80.02 2008.04.12 W32/Malware

saber123

Protection ID扫描出的结果PE Compact v2.20 - v2.79 compressed ! 全是 同一个壳。。而且只是版本不同

woai_jolin

原帖由 saber123 于 2008-4-13 11:41 发表
Protection ID扫描出的结果PE Compact v2.20 - v2.79 compressed ! 全是 同一个壳。。而且只是版本不同

幸运的是没有加死
这种货色一运行就

醉一生爱妍

江民杀毒软件报告文件

        北京江民新科技术有限公司

        扫描引擎 11.00.703
        病毒库日期 2008-04-12
        更新日期 2008-03-29

扫描目标 C:\Documents and Settings\Administrator\桌面\1.rar

开始时间 2008-03-29 03:42:27

正常结束。

扫描结果:
                 文件数 :2                                   病毒体 :0         
                   删除 :0                                     解毒 :0         
    扫描速度(千字节/秒) :62                                扫描时间 :00:00:01
    扫描文件速度(个/秒) :2

    - - - - -   - - - - - - -   - - - - - - -    - - - - - - -    - - - - - - -     - - - - - - -   - - - - -

[ 本帖最后由 garyyan456 于 2008-4-13 11:46 编辑 ]

saber123

原帖由 woai_jolin 于 2008-4-13 11:42 发表

幸运的是没有加死
这种货色一运行就

试试。。。这个木马有没有磁碟机厉害。。还是我用OD试下

woai_jolin

晕 sandboxie不能加载
真不知是死是活
希望是活的
去sandbox一哈

saber123

但PEID等不能脱壳呢

woai_jolin

太畸形了

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

1.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS           怪了
    * Compressed: YES
    * TLS hooks: NO
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * Decompressing PEC2.
    * **Locates window "NULL [class IEFrame]" on desktop.
    * **Locates window "NULL [class PROGMAN]" on desktop.
    * File length:        32768 bytes.
    * MD5 hash: ca82a43e7e19ceb9dea90b43dcb7de47.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\TEMP\gos8199.tmp.
    * Creates file C:\WINDOWS\TEMP\win8089.tmp.
    * Creates file C:\WINDOWS\TEMP\gos8199.bat.
    * Deletes file "C:\WINDOWS\TEMP\gos8199.tmp".
    * Deletes file "C:\WINDOWS\TEMP\gos8199.bat".
    * Creates file C:\sample.bat.
    * Deletes file "c:\sample.exe".
    * Deletes file "c:\sample.bat".

[ Changes to registry ]
    * Accesses Registry key "HKLM\SOFTWARE\Microsoft\MSSMGR\".
    * Accesses Registry key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\".

[ Process/window information ]
    * Creates a mutex 3024.
    * Creates a mutex m3d5rt10.
    * Creates process "C:\CMD.EXE".



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

[ 本帖最后由 woai_jolin 于 2008-4-13 11:54 编辑 ]

wangjay1980

Hello,

1.exe_ - Trojan.Win32.Dialer.auy

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

2.exe_ - not-a-virus:AdWare.Win32.Virtumonde.nol

This file is an Advertizing Tool, It's detection will be included in the next
update of extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

svchost.exe_

No malicious code was found in this file.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: 1.rar
> Attachment: 2.rar
> Attachment: svchost.rar

qigang

rising20.39.60未杀！