早上来个热热身

jijiasd

1X

TO nod32 http://samples.eset.com.cn/index.php?a=query&lang=0&md5=cd7b697669a524f606e657254b08868e

saga3721

'TR/Crypt.XPACK.Gen' [trojan]

syfwxmh

kaspersky kill

evilrabbit

生成物C\WINDOWS\help\EB6C4499B05F.dll
*\current\Local Settings\Temp\Rar$EX00.547
*\Local Settings\Temp\Rar$EX00.547\uykg.exe

-------------------------
*\machine\software\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}  [1] = SSUUDL
*\machine\software\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32  [1] = C:\WINDOWS\help\EB6C4499B05F.dll
*\machine\software\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32\ThreadingModel [1] = Apartment
*\machine\software\microsoft\ole\EnableDCOM [1] = N
*\machine\software\microsoft\Windows\CurrentVersion\Explorer\BitBucket\NukeOnDelete [4] = 01000000
*\machine\software\microsoft\Windows\CurrentVersion\Explorer\BitBucket\UseGlobalSettings [4] = 01000000
*\machine\software\microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Documents [1] = C:\Documents and Settings\All Users\Documents
*\machine\software\microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop [1] = C:\Documents and Settings\All Users\Lhb?
*\machine\software\microsoft\windows nt\currentversion\winlogon\Shell [1] = x
*\user\current\software\classes\SymbolicLinkValue [6] = 5C00520045004700490053005400520059005C0055005300450052005C00530061006E00640062006F0078005F00410064006D0069006E006900730074007200610074006F0072005F00440065006600610075006C00740042006F0078005C0075007300650072005C00630075007200720065006E0074005F0063006C0061007300730065007300
*\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess\BrowseNewProcess [1] = yes
*\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9f23f4ca-767d-11dd-a315-806d6172696f}\BaseClass [1] = Drive
*\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal [1] = C:\Documents and Settings\Administrator\My Documents
*\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop [1] = C:\Documents and Settings\Administrator\Lhb?
*\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData [1] = C:\Documents and Settings\Administrator\Application Data
*\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache [1] = C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
*\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies [1] = C:\Documents and Settings\Administrator\Cookies
*\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass [4] = 01000000
*\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName [4] = 01000000
*\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet [4] = 01000000
*\user\current\software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.547\uykg.exe [1] = uykg
*\user\current\software\SandboxieAutoExec  [3] = 31
*\user\current\software\WinRAR\ArcHistory\0 [1] = C:\Documents and Settings\Administrator\Lhb梊uykg.zip
*\user\current\software\WinRAR\FileList\ArcColumnWidths\name [4] = 78000000
*\user\current\software\WinRAR\FileList\ArcColumnWidths\size [4] = 50000000
*\user\current\software\WinRAR\FileList\ArcColumnWidths\psize [4] = 50000000
*\user\current\software\WinRAR\FileList\ArcColumnWidths\type [4] = 78000000
*\user\current\software\WinRAR\FileList\ArcColumnWidths\mtime [4] = 64000000
*\user\current\software\WinRAR\FileList\ArcColumnWidths\crc [4] = 46000000
*\user\current\software\WinRAR\FileList\FileColumnWidths\name [4] = 78000000
*\user\current\software\WinRAR\FileList\FileColumnWidths\size [4] = 50000000
*\user\current\software\WinRAR\FileList\FileColumnWidths\type [4] = 78000000
*\user\current\software\WinRAR\FileList\FileColumnWidths\mtime [4] = 64000000
*\user\current\software\WinRAR\General\LastFolder [1] = C:\Documents and Settings\Administrator\Lhb?
*\user\current\software\WinRAR\General\Toolbar\Layout\Band0 [3] = 38000000730100000402000000000000FFFFFFF4FFFFFFF4FFFFFFF400000000000000000000000000FFFFFFDA000500000000003A000000FFFFFFB40200000000000001000000
*\user\current\software\WinRAR\General\Toolbar\Layout\Band1 [3] = 38000000730100000500000000000000FFFFFFF4FFFFFFF4FFFFFFF400000000000000000000000000FFFFFFD20006000000000017000000280000000000000002000000
*\user\current\software\WinRAR\General\Toolbar\Layout\Band2 [3] = 38000000730100000400000000000000FFFFFFF4FFFFFFF4FFFFFFF400000000000000000000000000FFFFFFDC0009000000000017000000640000000000000003000000
*\user\current\software\WinRAR\General\Toolbar\Layout\Band3 [3] = 3800000073010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
*\user\current\software\WinRAR\Interface\MainWin\Placement [3] = 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF600000006C00000072030000FFFFFFFF010000

[ 本帖最后由 wolfwalk888 于 2009-1-24 09:55 编辑 ]

Palkia

rs 0

Sherry.ai

To KL