质量很高的广告软件，已经有EXE（很多都过主流）

显示全部楼层 · 发表于 2008-10-5 21:52:44

kis2009

显示全部楼层 · 发表于 2008-10-5 21:57:23

原帖由 aarwwefdds 于 2008-10-5 21:50 发表
那个错误是因为微点并没有回滚完

在计划任务中有残留...我也是找了好半天才找到的...

哦，谢谢提醒。

显示全部楼层 · 发表于 2008-10-5 22:14:37

Hello,

pryfile.sys - not-a-virus:AdWare.Win32.WSearch.df

This file is an Advertizing Tool, it is detected by
extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

pryrege.sys - Rootkit.Win32.Agent.efg,
WINSL35.DLL - Trojan.Win32.Vapsup.mam

These files are already detected. Please update your antivirus bases.

wokao.exe_ - not-a-virus:RiskTool.Win32.VB.a

New potentially risk software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Kirill Erakhtin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

显示全部楼层 · 发表于 2008-10-5 22:41:54

文件: BO1018.exe
大小: 201875 字节
MD5: 6076D7C7F1BB634C72656A2DA549AE66
SHA1: DFBC98742486A854C23A1CE1F2EE4E03462F37E7
CRC32: EAA7C130
加壳类型：Nullsoft PiMP Stub [Nullsoft PiMP SFX] *

简单行为分析：

释放文件：
%windir%\pryfile.sys
%windir%\pryrege.sys
%windir%\nsg4.tmp
%windir%\winsg4.dll
%windir%\Tasks\MsUpdateTask.job
%windir%\system32\drivers\pryfile.sys
%windir%\system32\drivers\pryrege.sys
%userprofile%\Local Settings\Temp\nsz1.tmp
%userprofile%\Local Settings\Temp\nsu2.tmp
%userprofile%\Local Settings\Temp\nsv3.tmp
%userprofile%\Local Settings\Temp\nsv3.tmp\BackOperHelper.dll;

安装加载驱动服务和驱动程序：
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Reserve
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services，pryfile
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services，pryrege;

注册表变动：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Reserve
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e64c9ff0-8e42-11dd-838c-806d6172696f}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMJPMIG.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TINTSETP.EXE;

%windir%\winsg4.dll安装全局挂勾，插入进程explorer.exe;

显示全部楼层 · 发表于 2008-10-5 23:39:08

wokao.exe_ - not-a-virus:RiskTool.Win32.VB.a
一个新东西[:1:] [:1:]

显示全部楼层 · 发表于 2008-10-5 23:46:48

你回错贴了

显示全部楼层 · 发表于 2008-10-6 00:50:09

目前红伞还是完全没有反应。。。5555555

显示全部楼层 · 发表于 2008-10-6 04:55:39

全部丢给铁壳

显示全部楼层 · 发表于 2008-10-6 07:30:16

kis全报了。

显示全部楼层 · 发表于 2008-10-6 08:17:19

小A 0个

[病毒样本] 质量很高的广告软件，已经有EXE（很多都过主流）

本帖子中包含更多资源

回复 33楼 wangjay1980 的帖子

回复 35楼 kato9096 的帖子