屏保病毒

wqxcx

收到的垃圾邮件 一看就知道是……但是卡巴7.0和费尔竟然无视……

The EQs

雅虎邮箱的病毒，通过不断加壳过一堆杀软，和KAVO一样比较无聊

Kitman

Begin scan in 'C:\Users\TOSHIBA\Downloads\扂腔苤藤.zip'
C:\Users\TOSHIBA\Downloads\扂腔苤藤.zip
    [0] Archive type: ZIP
      --> ﾧￚﾪﾺﾤpﾾￇﾩf.scr
        [1] Archive type: RAR SFX (self extracting)
        --> 18.exe
          [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      A backup was created as 'cbbc369d.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!

wangjay1980

2008-9-22 JAY23:10:29 System  Modification C:\Documents and Settings\Owner\桌面\и??厩ゝ\18.exe
2008-9-22 JAY23:10:29 UnRAR.exe  Modification C:\Documents and Settings\Owner\桌面\и??厩ゝ\18.exe
2008-9-22 JAY23:10:54 18.exe  Placed in group Low Restricted
2008-9-22 JAY23:10:54 18.exe  Process start C:\Documents and Settings\Owner\桌面\и??厩ゝ\18.exe
2008-9-22 JAY23:10:54 18.exe : KLSystemData/FD-C/ Create C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:10:54 18.exe : KLSystemData/FD-1/ Create C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:10:54 18.exe  Create C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:10:54 18.exe Denied: KLSystemData/FD-1/ Read C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:10:55 18.exe Denied: KLPrivileges/KLPermissionAppAccess/KLPermissionProcManage/KLStartProc Process start c:\documents and settings\owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:11:10 18.exe : KLSystemData/FD-C/ Create C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:11:10 18.exe  Create C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:11:10 18.exe : KLSystemData/FD-1/ Create C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:11:10 18.exe Denied: KLSystemData/FD-1/ Read C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:11:11 18.exe Denied: KLPrivileges/KLPermissionAppAccess/KLPermissionProcManage/KLStartProc Process start c:\documents and settings\owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:11:11 18.exe : KLSystemData/KLSystemFiles/SystemDll Create C:\WINDOWS\HELP\F3C74E3FA248.dll
2008-9-22 JAY23:11:11 18.exe : KLSystemData/FD-C/ Create C:\WINDOWS\HELP\F3C74E3FA248.dll
2008-9-22 JAY23:11:11 18.exe  Create C:\WINDOWS\Help\F3C74E3FA248.dll
2008-9-22 JAY23:11:11 18.exe  Modification C:\WINDOWS\Help\F3C74E3FA248.dll
2008-9-22 JAY23:11:11 18.exe  Create HKEY_CLASSES_ROOT\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}
2008-9-22 JAY23:11:11 18.exe Denied: KLSystemData/KLSystemServicesRegKeys/Classes_CLSID Modification hklm\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}
2008-9-22 JAY23:11:11 18.exe  Create HKEY_CLASSES_ROOT\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\INPROCSERVER32
2008-9-22 JAY23:11:11 18.exe Denied: KLSystemData/KLSystemServicesRegKeys/Classes_CLSID Modification hklm\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32
2008-9-22 JAY23:11:11 18.exe Denied: KLSystemData/KLSystemServicesRegKeys/Classes_CLSID Modification hklm\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32
2008-9-22 JAY23:11:11 18.exe Denied: KLSystemData/KLStartupRegKeys/ShellExecuteHooks Modification hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
2008-9-22 JAY23:11:26 18.exe Denied: KLPrivileges/KLPermissionAppAccess/KLPermissionProcEmbed/KLSetHook Hook installation C:\WINDOWS\HELP\F3C74E3FA248.dll

2008-9-22 JAY23:10:54 18.exe  Create C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:10:55 2.bat  Placed in group Low Restricted
2008-9-22 JAY23:10:55 2.bat  Process start C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:10:55 2.bat  Process exit C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:11:10 18.exe  Create C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:11:11 2.bat  Placed in group Low Restricted
2008-9-22 JAY23:11:11 2.bat  Process start C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat
2008-9-22 JAY23:11:11 2.bat  Process exit C:\Documents and Settings\Owner\桌面\и??厩ゝ\2.bat

那个图片就不发了，少儿不宜



[ 本帖最后由 wangjay1980 于 2008-9-22 23:15 编辑 ]

浪滔天

有敢拿这种图片做屏保的？

wangjay1980

变态敢

浪滔天

只清除这个样本中的18.exe而保留图片的杀软才是好杀软~

wqxcx

0072-0049.jpg？这样的图片到处是吧

欠妳緈諨

The EQs

我用7Z直接解压看了图片了。。。。只感觉很黄。。。。。。。