会将qq伪装成病毒的东东，可恶！！！

显示全部楼层 · 发表于 2009-1-1 23:18:05

这种压缩壳都是可以稳稳走到oep的，不用断点就可以脱掉的，你应该是用断点了

显示全部楼层 · 发表于 2009-1-2 01:30:10

下载啊下载
2009/1/2 1:27:36 Real-time file system protection file C:\Sandbox\Jason\DefaultBox\user\current\AppData\Local\Temp\TBSetup(-33554373).exe Win32/Adware.Zhongsou application deleted - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: G:\v\svshost.exe.
2009/1/2 1:27:34 HTTP filter file http://dh.soft-download.com.cn/softdown/TBSetup(-33554373).exe Win32/Adware.Zhongsou application connection terminated - quarantined Jason-PC\Jason Threat was detected upon access to web by the application: G:\v\svshost.exe.
2009/1/2 1:27:31 Real-time file system protection file C:\Sandbox\Jason\DefaultBox\user\current\AppData\Local\Temp\2008.exe a variant of Win32/Kryptik.AE trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: G:\v\svshost.exe.
2009/1/2 1:27:30 HTTP filter file http://dh.soft-download.com.cn/softdown/2008.exe a variant of Win32/PSW.Delf.NMX trojan connection terminated - quarantined Jason-PC\Jason Threat was detected upon access to web by the application: G:\v\svshost.exe.
2009/1/2 1:27:28 HTTP filter file http://dh.soft-download.com.cn/softdown/setup_1027252.exe a variant of Win32/Agent.OCX trojan connection terminated - quarantined Jason-PC\Jason Threat was detected upon access to web by the application: G:\v\svshost.exe.
2009/1/2 1:24:40 HTTP filter file http://yup-list.com/download/DivX.Codec.8.0.beta3006.exe a variant of Win32/Kryptik.DR trojan connection terminated - quarantined Jason-PC\Jason Threat was detected upon access to web by the application: G:\v\SkypeClient.exe.

显示全部楼层 · 发表于 2009-1-2 01:32:42

"svshost.exe" = "127.0.0.1:53025|127.0.0.1:30606|ESTAB" ( 6: Unknown ) ;

"File" = "g:\v\svshost.exe" ( 6: Unknown ) ;
"File Size" = "29696"
"SHA1" = "1443279EB226E5330AB9318B2F6F1F31DB446047"
"Creation Time" = "2009/01/02 01:26"
"Last Write Time" = "2008/12/29 18:57"
"Linked to" = "Running Processes -> svshost.exe"
"Linked to" = "Running Processes -> svshost.exe -> G:\v\svshost.exe"
"Linked to" = "Network Connections -> TCP Connections -> 127.0.0.1:53025|127.0.0.1:30606|ESTAB"
"Linked to" = "Network Connections -> TCP Connections -> 127.0.0.1:53027|127.0.0.1:30606|ESTAB"

显示全部楼层 · 发表于 2009-1-2 02:30:42

有用微点的试试吗

显示全部楼层 · 发表于 2009-1-4 21:13:39

学习下先

显示全部楼层 · 发表于 2009-1-5 15:02:28

卡巴不让下

[病毒样本] 会将qq伪装成病毒的东东，可恶！！！

回复 21楼 aarwwefdds 的帖子