收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › ESET沒發現
12
返回列表 发新帖
楼主: wsc47621
 收起左侧

[病毒样本] ESET沒發現

[复制链接]
电影结束了
发表于 2008-5-21 14:00:15 | 显示全部楼层
TF挂...
回复

举报

电影结束了
发表于 2008-5-21 14:11:33 | 显示全部楼层
The following Registry Keys were created:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C86B82BE-3E84-4F71-8323-F12BB71D9CB2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C86B82BE-3E84-4F71-8323-F12BB71D9CB2}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C86B82BE-3E84-4F71-8323-F12BB71D9CB2}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C86B82BE-3E84-4F71-8323-F12BB71D9CB2}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4645A0E0-7B59-439A-BB73-D4159321E09B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4645A0E0-7B59-439A-BB73-D4159321E09B}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4645A0E0-7B59-439A-BB73-D4159321E09B}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4645A0E0-7B59-439A-BB73-D4159321E09B}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4645A0E0-7B59-439A-BB73-D4159321E09B}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4645A0E0-7B59-439A-BB73-D4159321E09B}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BF50AC63-19DA-487E-AD4A-0B452D823B59}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Iprip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Iprip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IPRIP
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IPRIP\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IPRIP\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Iprip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Iprip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Iprip\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Iprip\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Iprip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Iprip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IPRIP
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IPRIP\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IPRIP\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Iprip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Iprip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Iprip\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Iprip\Enum
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}
The newly created Registry Values are:
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E5CBF21-D15F-11d0-8301-00AA005B4383}\InProcServer32]
QDZQ = 0x000000B0
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF604EFE-8897-11D1-B944-00A0C90312E1}\InProcServer32]
XBZQ = 0x00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\VersionIndependentProgID]
(Default) = "IEHlprObj.IEHlprObj"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ProgID]
(Default) = "IEHlprObj.IEHlprObj.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\InprocServer32]
(Default) = "%System%\fsutk.dll"
ThreadingModel = "Apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}]
(Default) = "BrowserPanel"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C86B82BE-3E84-4F71-8323-F12BB71D9CB2}\TypeLib]
(Default) = "{4645A0E0-7B59-439A-BB73-D4159321E09B}"
Version = "1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C86B82BE-3E84-4F71-8323-F12BB71D9CB2}\ProxyStubClsid32]
(Default) = "{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C86B82BE-3E84-4F71-8323-F12BB71D9CB2}\ProxyStubClsid]
(Default) = "{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C86B82BE-3E84-4F71-8323-F12BB71D9CB2}]
(Default) = "IIEHlprObj"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4645A0E0-7B59-439A-BB73-D4159321E09B}\1.0\0\win32]
(Default) = "%System%\fsutk.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4645A0E0-7B59-439A-BB73-D4159321E09B}\1.0\HELPDIR]
(Default) = "%System%\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4645A0E0-7B59-439A-BB73-D4159321E09B}\1.0\FLAGS]
(Default) = "0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4645A0E0-7B59-439A-BB73-D4159321E09B}\1.0]
(Default) = "QuickFlash 1.0 Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer]
(Default) = "IEHlprObj.IEHlprObj.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj]
(Default) = "BrowserPanel"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID]
(Default) = "{BF50AC63-19DA-487E-AD4A-0B452D823B59}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1]
(Default) = "QuickFlash"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BF50AC63-19DA-487E-AD4A-0B452D823B59}]
(Default) = ""
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Iprip]
(Default) = "Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Iprip]
(Default) = "Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IPRIP\0000\Control]
*NewlyCreated* = 0x00000000
ActiveService = "Iprip"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IPRIP\0000]
Service = "Iprip"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Remote IPRIP Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IPRIP]
NextInstance = 0x00000001
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Iprip\Enum]
0 = "Root\LEGACY_IPRIP\0000"
Count = 0x00000001
NextInstance = 0x00000001
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Iprip\Security]
Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Iprip\Parameters]
ServiceDll = "%System%\liprip.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Iprip]
Start = 0x00000002
Type = 0x00000020
ErrorControl = 0x00000001
ImagePath = "%System%\svchost.exe -k netsvcs"
DisplayName = "Remote IPRIP Service"
ObjectName = "LocalSystem"
Description = "Listener reads Remote Routing Information Protocol (RIP) packets"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Iprip]
(Default) = "Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Iprip]
(Default) = "Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IPRIP\0000\Control]
*NewlyCreated* = 0x00000000
ActiveService = "Iprip"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IPRIP\0000]
Service = "Iprip"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Remote IPRIP Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IPRIP]
NextInstance = 0x00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Iprip\Enum]
0 = "Root\LEGACY_IPRIP\0000"
Count = 0x00000001
NextInstance = 0x00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Iprip\Security]
Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Iprip\Parameters]
ServiceDll = "%System%\liprip.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Iprip]
Start = 0x00000002
Type = 0x00000020
ErrorControl = 0x00000001
ImagePath = "%System%\svchost.exe -k netsvcs"
DisplayName = "Remote IPRIP Service"
ObjectName = "LocalSystem"
Description = "Listener reads Remote Routing Information Protocol (RIP) packets"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}]
Flags = 0x00000000
Version = "*"
(Default) = ""

http://www.threatexpert.com/report.aspx?md5=a0a5c545977a2df53a6dc61d0860aada
TF服务倒是挺快的
回复

举报

palfan
发表于 2008-5-21 14:48:09 | 显示全部楼层
广告文件
回复

举报

star_xing
发表于 2008-5-21 15:03:55 | 显示全部楼层
ACCESS DENIED
The requested URL could not be retrieved

--------------------------------------------------------------------------------

While trying to retrieve the URL: http://bbs.kafan.cn/attachment.p ... d4&t=1211353395

The folowing error was encountered:

The requested object is INFECTED. The following viruses not-a-virus:AdWare.Win32.BHO.ayn were found

Please contact your service provider if you feel this is incorrect.



--------------------------------------------------------------------------------

Generated Wed May 21 15:04:54 2008 by 卡巴斯基反病毒软件 7.0
回复

举报

qigang
发表于 2008-5-21 20:07:40 | 显示全部楼层

2/0

RS20.45.22未杀！
回复

举报

BING126
头像被屏蔽
发表于 2008-5-21 20:14:12 | 显示全部楼层
McAfee  MISS
回复

举报

allinwonderi
发表于 2008-5-21 20:55:02 | 显示全部楼层
ArcaVir , FP miss.
回复

举报

尤金卡巴斯基
发表于 2008-5-21 21:22:10 | 显示全部楼层
已删除：广告程序 not-a-virus:AdWare.Win32.BHO.ayn        文件　: G:\Temp\adware.rar/adware.exe8//WISE0005.BIN
已删除：广告程序 not-a-virus:AdWare.Win32.BHO.ayn        文件　: G:\Temp\adware.rar/adware.exe8//WISE0006.BIN
已删除：广告程序 not-a-virus:AdWare.Win32.BHO.ayn        文件　: G:\Temp\adware.rar/adware.exe8//WISE0007.BIN
回复

举报

12
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-7-16 00:12 , Processed in 0.089177 second(s), 15 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表