两个危险的病毒样本，具有很强的扩散性！！！

显示全部楼层 · 发表于 2009-2-28 18:53:16

两个危险的病毒样本，具有很强的扩散性！！！
类似于“熊猫烧香”，图标和名称具有很强的迷惑性！！！
认为好的还望顶一下！！！

显示全部楼层 · 发表于 2009-2-28 18:55:02

ka8
Kill Autorun'

显示全部楼层 · 发表于 2009-2-28 18:55:30

那个生成物不是病毒

显示全部楼层 · 发表于 2009-2-28 18:58:51

'TR/Autorun.HJ' [trojan]
生成物上报

显示全部楼层 · 发表于 2009-2-28 19:00:01

File ID  Filename Size (Byte) Result
25275524  scw.rar 18.54 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename Size (Byte) Result
25275525  VERCLSID.EXE-11B4EDAB.pf  20.06 KB  UNDER ANALYSIS
4220321  verclsid.exe  28 KB  KNOWN CLEAN

显示全部楼层 · 发表于 2009-2-28 19:00:23

to rs

显示全部楼层 · 发表于 2009-2-28 19:03:24

to VB

显示全部楼层 · 发表于 2009-2-28 19:07:18

Ultra String Reference
Address Disassembly                            Text String
004014D8 push 004024E0                         (initial cpu selection)
004036EF push 00402C14                         c:\vbvirus\ownerprotect.ptt
004037DD push 00402C80                         c:\905c0769f9a06c95a24ddf945\
004039CB push 00402D18                         c:\905c0769f9a06c95a24ddf945\patcher.exe
004039D4 push 00402D00                         \
00403A01 push 00402D08                         .exe
00403A59 push 00402D70                         wscript.shell
00403A7D mov    dword ptr [ebp-A0], 00402DD4    hkey_local_machine\software\microsoft\windows\currentversion\run\winfirewall
00403A91 mov    dword ptr [ebp-C0], 00402D18    c:\905c0769f9a06c95a24ddf945\patcher.exe
00403B05 push 00402E70                         regwrite
00403B35 mov    edx, 00402E88                   cdefghijklmnopqrstuvwxyz
00403D89 push 00402D00                         \
00403DB6 push 00402D08                         .exe
00403E36 push 00402EC0                         c:\
00403E71 push 00402EC0                         c:\
004040AB push 00402D00                         \
00404121 push 00402EDC                         $
00404320 push 00402EE4                         *.exe
004044DB mov    dword ptr [ebp-7C], 00402EF4    :\autorun.inf
0040453D push 00402F14                         [autorun]
0040454F push 00402F34                         shell=ntdetect.exe
00404590 mov    dword ptr [ebp-7C], 00402F60    :\ntdetect.exe
00404613 mov    dword ptr [ebp-7C], 00402EF4    :\autorun.inf
00404691 mov    dword ptr [ebp-7C], 00402F60    :\ntdetect.exe
00404D63 push 00402D00                         \
00404D90 push 00402D08                         .exe
00404EEA push 00402D00                         \
00404F60 push 00402EDC                         $
004051BE mov    edx, 00402E88                   cdefghijklmnopqrstuvwxyz
004052A0 push 00402C08                         :\
004052E3 push 00402C08                         :\
0040542B push 00402D00                         \
00405487 push 00402EDC                         $

显示全部楼层 · 发表于 2009-2-28 19:12:22

微点杀

居然发不了图片

显示全部楼层 · 发表于 2009-2-28 19:31:51

TR/Autorun.HJ Trojan

[病毒样本] 两个危险的病毒样本，具有很强的扩散性！！！

本帖子中包含更多资源

回复 1楼 605550642 的帖子