疑似冲击波新变种

显示全部楼层 · 发表于 2009-4-10 15:02:04

ModifyRegValue       \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001\PackedCatalogItem

ModifyRegValue \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\DrcomPacketCapture\1001

CreateFile       C:\WINDOWS\system32\TcpIpDog0.dll
CreateFile       C:\WINDOWS\system32\TcpIpDogR0.dll

键： HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
键值： PackedCatalogItem
Old data(自由形式二进制):
25 53 79 73 74 65 6d 52 6f 6f 74 25 5c 73 79 73 74 65 6d 33 32 5c 6d 73 77 73 6f 63 6b 2e 64 6c 6c 00 6c 73 5c 56 53 6f 63 6b 20 53 44 4b 5c 62 69 6e 5c 77 69 6e 33 32 5c 76 73 6f 63 6b 6c 69 62 2e 64 6c 6c 00 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 23 30 21 06 03 55 04 03 13 1a 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 73 74 61 6d 70 69 6e 67 20 50 43 41 30 1e 17 0d 30 36 30 39 31 36 30 31 35 33 30 30 5a 17 0d 31 31 30 39 31 36 30 32 30 33 30 30 5a 30 81 a6 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 66 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 a0 1a 0f e7 8b ab cf 11 8c a3 00 80 5f 48 a1 92 e9 03 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 10 00 00 00 10 00 00 00 01 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d 00 53 00 41 00 46 00 44 00 20 00 54 00 63 00 70 00 69 00 70 00 20 00 5b 00 54 00 43 00 50 00 2f 00 49 00 50 00 5d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
新数据(自由形式二进制)：
43 3a 5c 57 49 4e 44 4f 57 53 5c 73 79 73 74 65 6d 33 32 5c 54 63 70 49 70 44 6f 67 30 2e 64 6c 6c 00 6c 73 5c 56 53 6f 63 6b 20 53 44 4b 5c 62 69 6e 5c 77 69 6e 33 32 5c 76 73 6f 63 6b 6c 69 62 2e 64 6c 6c 00 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 23 30 21 06 03 55 04 03 13 1a 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 73 74 61 6d 70 69 6e 67 20 50 43 41 30 1e 17 0d 30 36 30 39 31 36 30 31 35 33 30 30 5a 17 0d 31 31 30 39 31 36 30 32 30 33 30 30 5a 30 81 a6 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 66 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 a0 1a 0f e7 8b ab cf 11 8c a3 00 80 5f 48 a1 92 e9 03 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 10 00 00 00 10 00 00 00 01 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d 00 53 00 41 00 46 00 44 00 20 00 54 00 63 00 70 00 69 00 70 00 20 00 5b 00 54 00 43 00 50 00 2f 00 49 00 50 00 5d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[ 本帖最后由 saga3721 于 2009-4-10 15:15 编辑 ]

显示全部楼层 · 发表于 2009-4-10 15:04:23

楼上的，

是不是把这两个文件删除了就好了？

显示全部楼层 · 发表于 2009-4-10 15:19:24

Sorry

显示全部楼层 · 发表于 2009-4-10 15:19:58

最好是重做系统，感觉好多系统东西被破坏的感觉。
看下进程，除了少了微点的外，貌似还少了几个。

我也是实机试的，系统挂掉了。恢复了系统。
在别的盘下有个隐藏文件夹，每个下面都有。同名。
恢复系统后手动删除掉即可。

[ 本帖最后由 wcj20236 于 2009-4-10 15:22 编辑 ]

显示全部楼层 · 发表于 2009-4-10 15:24:12

沙盘里运行TF不报.

显示全部楼层 · 发表于 2009-4-10 15:26:48

点饭P已联系微点官方。

我转达官方回复：尊敬的点饭会员，感谢您的上报。我们将立刻进行测试。谢谢！

显示全部楼层 · 发表于 2009-4-10 15:32:41

应该给楼主多加几分，我没权限

显示全部楼层 · 发表于 2009-4-10 15:35:01

原帖由 wcj20236 于 2009-4-10 15:19 发表
最好是重做系统，感觉好多系统东西被破坏的感觉。
看下进程，除了少了微点的外，貌似还少了几个。

我也是实机试的，系统挂掉了。恢复了系统。
在别的盘下有个隐藏文件夹，每个下面都有。同名。
恢复系统后手动 ...

请问那些隐藏文件夹叫什么名字啊？我重装后好对照着删啊。是仅仅在每个盘的根目录下吗？还是每个文件夹都有？？

[ 本帖最后由 bryan8888 于 2009-4-10 15:37 编辑 ]

显示全部楼层 · 发表于 2009-4-10 15:37:56

.hehhe

[ 本帖最后由 wcj20236 于 2009-4-10 17:03 编辑 ]

显示全部楼层 · 发表于 2009-4-10 15:40:22

我这没反应，怪

[病毒样本] 疑似冲击波新变种

回复 23楼 bryan8888 的帖子