一个有木马的网游外挂

hum

今天玩冒险岛
开双倍经验了
就下载来个外挂
由于当时用HIPS，以前用过这个外挂。对这个外挂很信任
就给了这个外挂所有的AD,FD RD权限
玩的时候不是别人告诉我有木马，我的号可能已经[:27:]

[ 本帖最后由 hum 于 2008-5-24 19:56 编辑 ]

allinwonderi

MISS

allinwonderi

MISS

hum

VIRUSTOTAL:16/32
NORMAN沙盘报告:
Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

&#26700 : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS
    * Compressed: NO
    * TLS hooks: NO
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * File length:       813554 bytes.
    * MD5 hash: 20587d5c19a453a367d5017d01878faa.

[ Changes to filesystem ]
    * Creates directory C:.
    * Creates directory C:\WINDOWS.
    * Creates file C:\WINDOWS\__tmp_rar_sfx_access_check_648772.
    * Deletes file __tmp_rar_sfx_access_check_648772.
    * Creates file C:\WINDOWS\spec.fne.
    * Creates file C:\WINDOWS\ExtMenu.fne.
    * Creates file C:\WINDOWS\ipk.cn%14w%14)z%16%02%0B}.htm.
    * Creates file C:\WINDOWS\krnln.fnr.

[ Process/window information ]
    * Creates a dialogbox with caption "WinRAR ê㋇ö".
    * Buttons found in dialogbox: id102[278,173]"OÈ(&W)..." id1[211,223]"‰Å" id2[278,223]"Öˆ" .

[ Signature Scanning ]
    * C:\WINDOWS\spec.fne (81920 bytes) : no signature detection.
    * C:\WINDOWS\ExtMenu.fne (212992 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

挪威的冬天

删了马继续用嘛...

信息        2008-05-24  19:58:57        您此次查毒清除了1个病毒                       
信息        2008-05-24  19:58:57        您此次查毒共查出2个病毒以及危险代码                       
信息        2008-05-24  19:58:57        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件16个                       
信息        2008-05-24  19:58:57        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-05-24  19:58:57        D:\Desktop\mxktz\mxktz\冒险开拓者第二版.exe\BindFile\reg.exe        Win32.Troj.OnlineGameT.am.107664        跳过，未处理       
病毒        2008-05-24  19:58:55        D:\Desktop\mxktz\mxktz\reg.exe        Win32.Troj.OnlineGameT.am.107664        清除成功

hum

F-SECURE 沙盘报
ESET 杀之

Joker

C:\Documents and Settings\Administrator\桌面\mxktz\mxktz.exe>>reg.exe        Heuri.Suspicious.ERNM        启发式扫描        还未处理
C:\Documents and Settings\Administrator\桌面\mxktz\mxktz.exe>>冒险开拓者第二版.exe>>reg.exe        Heuri.Suspicious.ERNM        启发式扫描        还未处理

hum

Symantec杀之!

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GamesOnline.abe
病毒： Trojan.PSW.Win32.GamesOnline.abe

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.45.52

Joker

是外挂肯定就有毒