qqhxwg.exe(35楼有更新)

ledled

to VB

leonfg

to eset

Palkia

to rs

sam.to

a449aa21f21bcab6725b76b0c0b7b85f   qqhxwg.exe
to kl

Trojan-Dropper.Win32.Agent.aiyb

[ 本帖最后由 sam.to 于 2009-3-10 23:41 编辑 ]

Palkia

to rs

ledled

to VB

恶意代码

MD5: 0xA449AA21F21BCAB6725B76B0C0B7B85F 
文件长度: 2,944,071 bytes 

Trojan.TDSServ

下列文件是在系统中创建：

1 %Temp%\adv_api.dll                          616,960 bytes
2 %Temp%\b.bat                                  57 bytes
3 %System%\0B42FC2A.dat                  7,168 bytes


创建目录：
%Temp%\RarSFX0 


新增进程：
6725.exe           %Temp%\RarSFX0\6725.exe
qqhxwg.exe         %Temp%\RarSFX0\qqhxwg.exe



创建注册表：

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InjectCd]
0x7CE838DA = 06 00 00 00 50 11 00 00 BB 1B 00 00 BC 00 DD 66 EE 77 FC 1B 18 7B C2 02 B8 DF FF 33 CF 88 80 25 F3 A0 4E 7F FD C8 18 C8 80 54 64 D4 6C 66 6E F8 45 74 65 61 05 0F F4 DC 4C CC 7C B4 DE 13 9C A3 2B 01 C0 8B 8D 8F 98 00 9A 66 CF E7 FA 51 B1 95 00 C0 EC A 
0x7249ADB0 = 01 00 00 00 FF 0A 00 00 06 10 00 00 BC 00 DD 66 EE 77 FC 1B 18 7B C2 02 B8 DF FF 33 CF 88 80 25 F3 A0 5E 7F FD C8 18 9A 80 54 64 D4 6C 66 6E F8 45 74 65 6F 05 0F EE 7B 14 01 B0 8B 8D 8F 00 98 9A 66 CF E7 FA 51 B1 00 95 C0 EC AA 0F 1A EE 97 3A C5 83 0 
0x5899CC7B = 03 00 00 00 09 0C 00 00 6E 11 00 00 BC 00 DD 66 EE 77 FC 1B 18 7B C2 02 B8 DF FF 33 CF 88 80 25 F3 A0 7E 7F FD C8 18 D9 80 54 64 D4 6C 66 6E F8 45 74 65 6F 05 0F EE 7B 14 01 B0 8B 8D 8F 00 98 9A 66 CF E7 FA 51 B1 00 95 C0 EC AA 0F 1A EE 97 3A C5 83 0 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SAFEMON1\0000\Control]
*NewlyCreated* = 0x00000000 
ActiveService = "SafeMon1" 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SAFEMON1\0000]
Service = "SafeMon1" 
Legacy = 0x00000001 
ConfigFlags = 0x00000000 
Class = "LegacyDriver" 
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}" 
DeviceDesc = "SafeMa0" 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SAFEMON1]
NextInstance = 0x00000001 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SafeMon1\Enum]
0 = "Root\LEGACY_SAFEMON1\0000" 
Count = 0x00000001 
NextInstance = 0x00000001 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SafeMon1\Security]
Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SafeMon1]
Type = 0x00000001 
Start = 0x00000001 
ErrorControl = 0x00000000 
ImagePath = "%System%\0B42FC2A.dat" 
DisplayName = "SafeMa0" 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SAFEMON1\0000\Control]
*NewlyCreated* = 0x00000000 
ActiveService = "SafeMon1" 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SAFEMON1\0000]
Service = "SafeMon1" 
Legacy = 0x00000001 
ConfigFlags = 0x00000000 
Class = "LegacyDriver" 
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}" 
DeviceDesc = "SafeMa0" 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SAFEMON1]
NextInstance = 0x00000001 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SafeMon1\Enum]
0 = "Root\LEGACY_SAFEMON1\0000" 
Count = 0x00000001 
NextInstance = 0x00000001 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SafeMon1\Security]
Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SafeMon1]
Type = 0x00000001 
Start = 0x00000001 
ErrorControl = 0x00000000 
ImagePath = "%System%\0B42FC2A.dat" 
DisplayName = "SafeMa0" 
 

sam.to

50d9ac7a846e44476af6bd0761bba7cb   qqzyhxwg.exe0
to kl

ledled

to VB

328397663

28楼

qqzyhxwg.exe_ - Trojan-Dropper.Win32.Instaler.gt

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.