来一个

llydmissile

To McAfee

黑衣~魂

原帖由 sam.to 于 2009-2-14 16:12 发表
估计是來自TW的產品

TO-DW
沒錯,常常有那些不堪的字眼



trojan.exe : INFECTED with W32/Malware (Signature: Malware)


[ DetectionInfo ]
    * Filename: C:\analyzer\scan\trojan.exe.
    * Sandbox name: W32/Malware.
    * Signature name: Malware.EZQH.
    * Compressed: NO.
    * TLS hooks: NO.
    * Executable type: Application.
    * Executable file structure: OK.
    * Filetype: PE_I386.

[ General information ]
    * Drops files in %WINSYS% folder.
    * File length:       244062 bytes.
    * MD5 hash: d50f2b6ffa0595da4c0c42ed47ca03c3.

[ Changes to filesystem ]
    * Creates directory C:.
    * Creates directory C:\WINDOWS.
    * Creates directory C:\WINDOWS\.
    * Creates directory C:\WINDOWS\\system32.
    * Creates directory C:\WINDOWS\\system32\.
    * Creates file C:\WINDOWS\system32\systemdll.reg.
    * Creates file C:\WINDOWS\system32\tencent.exe.
    * Creates file C:\WINDOWS\system32\esploer.htm.
    * Creates file C:\WINDOWS\system32\dllhost.bat.
    * Creates file C:\WINDOWS\system32\d3d9.vbs.
    * Creates file C:\WINDOWS\system32\taskrav.bat.
    * Creates file C:\WINDOWS\system32\killersys.bat.

[ Changes to registry ]
    * Accesses Registry key "HKCU\Software\WinRAR SFX".
    * Creates key "HKCU\Software\WinRAR SFX".
    * Sets value "C%%WINDOWS%%system32%%"="C:\WINDOWS\\system32\\" in key "HKCU\Software\WinRAR SFX".

[ Process/window information ]
    * Creates a dialogbox with caption "WinRAR \xea\xe3\x8b\x87\xf6".
    * Buttons found in dialogbox: id102[278,173]"O\xc8(&W)..." id1[211,223]"\x89\xc5" id2[278,223]"\xd6\x88" .
    * Pressing button with id 1 "".
    * Attemps to NULL C:\WINDOWS\\system32\\dllhost.bat NULL.
    * Creates process "CMD.EXE".
    * Attemps to NULL C:\WINDOWS\\system32\\killersys.bat NULL.

[ Signature Scanning ]
    * C:\WINDOWS\system32\systemdll.reg (2083 bytes) : no signature detection.
    * C:\WINDOWS\system32\tencent.exe (101175 bytes) : no signature detection.
    * C:\WINDOWS\system32\esploer.htm (94 bytes) : no signature detection.
    * C:\WINDOWS\system32\dllhost.bat (119 bytes) : no signature detection.
    * C:\WINDOWS\system32\d3d9.vbs (127 bytes) : no signature detection.
    * C:\WINDOWS\system32\taskrav.bat (300 bytes) : no signature detection.
    * C:\WINDOWS\system32\killersys.bat (32 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

[ 本帖最后由 黑衣~魂 于 2009-2-14 17:52 编辑 ]

Love=卡巴+费尔

比较低级的东西 。