PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x10010d4a
timedatestamp.....: 0x47f587c6 (Fri Apr 04 01:43:34 2008)
machinetype.......: 0x14c (I386)
( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x10305 0x10400 6.47 f49ad88f7f31e6b505ea4fb6fa6bdbab
.rdata 0x12000 0x35ee 0x3600 5.30 a20e714d16d9aaa91a088a93473cbe81
.data 0x16000 0x20b8 0x1c00 3.74 be89d6eba4d22110c4ac0ffc834c592d
.shared 0x19000 0x5dc 0x600 0.00 53e979547d8c2ea86560ac45de08ae25
.rsrc 0x1a000 0xbe0 0xc00 3.91 9a05b270b0eee6ffb9bd0ae7fd308a19
.reloc 0x1b000 0x1022 0x1200 5.44 d7f6eb942da033370507124a01f1b2f2
( 17 imports )
> KERNEL32.dll: CreateFileA, ReadFile, SetFilePointer, WriteFile, MoveFileA, SetLastError, GetSystemDirectoryA, GetTempPathA, MoveFileExA, GetTickCount, GetLocalTime, GlobalFree, GlobalUnlock, GlobalLock, GlobalAlloc, GlobalSize, GetStartupInfoA, CreatePipe, DisconnectNamedPipe, TerminateProcess, PeekNamedPipe, DeleteFileA, SizeofResource, GetFileSize, FindResourceA, DeviceIoControl, LoadLibraryExA, GetModuleHandleA, SetFileAttributesA, ReleaseMutex, OpenEventA, LocalReAlloc, CreateMutexA, SetUnhandledExceptionFilter, GetCurrentThreadId, FreeConsole, LocalSize, OpenProcess, Process32Next, Process32First, CreateToolhelp32Snapshot, GetCurrentProcess, lstrcmpiA, FindNextFileA, LocalFree, FindClose, RemoveDirectoryA, LocalAlloc, LoadResource, FindFirstFileA, GetVersionExA, GetPrivateProfileStringA, lstrcmpA, WideCharToMultiByte, MultiByteToWideChar, LoadLibraryA, GetProcAddress, FreeLibrary, GetWindowsDirectoryA, lstrcatA, GetPrivateProfileSectionNamesA, lstrlenA, Sleep, CancelIo, InterlockedExchange, ResetEvent, lstrcpyA, VirtualAlloc, EnterCriticalSection, LeaveCriticalSection, GetLogicalDriveStringsA, GetVolumeInformationA, GetDiskFreeSpaceExA, GetDriveTypeA, CreateProcessA, GetFileAttributesA, CreateDirectoryA, SetErrorMode, GetLastError, VirtualFree, DeleteCriticalSection, InitializeCriticalSection, CreateThread, ResumeThread, SetEvent, WaitForSingleObject, TerminateThread, CloseHandle, WaitForMultipleObjects, CreateEventA
> USER32.dll: GetProcessWindowStation, ExitWindowsEx, GetWindowThreadProcessId, OpenWindowStationA, SetProcessWindowStation, SetThreadDesktop, CloseWindowStation, GetCursorPos, GetCursorInfo, GetThreadDesktop, GetDesktopWindow, GetDC, SetRect, GetSystemMetrics, GetClipboardData, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, mouse_event, SetCursorPos, WindowFromPoint, SetCapture, MapVirtualKeyA, IsWindowVisible, CloseDesktop, EnumWindows, OpenInputDesktop, DispatchMessageA, GetUserObjectInformationA, OpenDesktopA, PostMessageA, CreateWindowExA, CloseWindow, ReleaseDC, TranslateMessage, GetMessageA, wsprintfA, CharNextA, IsWindow, GetWindowTextA, GetActiveWindow, GetKeyNameTextA, GetFocus, CallNextHookEx, SetWindowsHookExA, UnhookWindowsHookEx, LoadCursorA, DestroyCursor, BlockInput, SystemParametersInfoA, SendMessageA, keybd_event
> GDI32.dll: BitBlt, DeleteObject, CreateCompatibleBitmap, CreateCompatibleDC, GetDIBits, DeleteDC, SelectObject, CreateDIBSection
> ADVAPI32.dll: ClearEventLogA, GetTokenInformation, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, SetServiceStatus, RegisterServiceCtrlHandlerA, StartServiceA, OpenEventLogA, IsValidSid, LookupAccountNameA, LsaClose, LsaRetrievePrivateData, LsaOpenPolicy, LsaFreeMemory, RegCloseKey, RegQueryValueA, RegOpenKeyExA, CloseServiceHandle, DeleteService, ControlService, QueryServiceStatus, OpenServiceA, OpenSCManagerA, RegSetValueExA, RegCreateKeyA, RegQueryValueExA, RegOpenKeyA, CloseEventLog, LookupAccountSidA
> SHELL32.dll: SHGetFileInfoA, SHGetSpecialFolderPathA
> SHLWAPI.dll: SHDeleteKeyA
> MSVCRT.dll: _except_handler3, strrchr, strncpy, realloc, atoi, wcstombs, free, calloc, __1type_info@@UAE@XZ, _initterm, _adjust_fdiv, malloc, strchr, _CxxThrowException, strstr, _strcmpi, _ftol, ceil, memmove, __CxxFrameHandler, __3@YAXPAX@Z, _beginthreadex, __2@YAPAXI@Z
> WINMM.dll: waveInUnprepareHeader, waveInReset, waveInStop, waveOutWrite, waveInStart, waveInClose, waveInPrepareHeader, waveInOpen, waveInGetNumDevs, waveOutPrepareHeader, waveOutGetNumDevs, waveOutOpen, waveOutReset, waveOutUnprepareHeader, waveOutClose, waveInAddBuffer
> WS2_32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -
> MSVCP60.dll: _npos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@2IB, __Xran@std@@YAXXZ, __Split@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEXXZ, __Eos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEXI@Z, __Refcnt@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEAAEPBD@Z, __Grow@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAE_NI_N@Z, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBDI@Z, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ, __C@_1___Nullstr@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@CAPBDXZ@4DB, __Tidy@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEX_N@Z
> IMM32.dll: ImmReleaseContext, ImmGetContext, ImmGetCompositionStringA
> WININET.dll: InternetOpenUrlA, InternetReadFile, InternetCloseHandle, InternetOpenA
> urlmon.dll: URLDownloadToFileA
> AVICAP32.dll: capGetDriverDescriptionA, capCreateCaptureWindowA
> MSVFW32.dll: ICSeqCompressFrame, ICSendMessage, ICOpen, ICClose, ICCompressorFree, ICSeqCompressFrameEnd, ICSeqCompressFrameStart
> PSAPI.DLL: GetModuleFileNameExA, EnumProcessModules
> WTSAPI32.dll: WTSFreeMemory, WTSQuerySessionInformationA
( 2 exports )
ResetSSDT, ServiceMain
3.VirSCAN.org 在线检测：
4.Online malware scan 在线检测：
请斑竹或者高手们给予分析检测一下，以确定是否有木马？！急！！！
万分感谢！！！！！！
可疑文件如下：
|
发表于 2008-4-26 14:20:04
发表于 2008-4-26 14:29:35
楼主
