这个病毒又何止是牛逼!

zag0699

dstart.exe

我不懂病毒测试的 我不能确定他是病毒,今天装虚拟机无意间逮到的 看有的网站说是下载木马的 http://www.virscan.org网  32个杀毒软件都检测没问题

它要真是病毒 那这个病毒又何止是牛逼!

它有个特征很像病毒 运行后自身消除  这是他建的注册表 0615是我导出文件名 我是看不懂的 大大们给看看 也许它还不止做了这些 .


indows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU]
"a"=hex:54,00,75,00,2e,00,65,00,78,00,65,00,00,00,43,00,3a,00,5c,00,44,00,6f,\
  00,63,00,75,00,6d,00,65,00,6e,00,74,00,73,00,20,00,61,00,6e,00,64,00,20,00,\
  53,00,65,00,74,00,74,00,69,00,6e,00,67,00,73,00,5c,00,41,00,64,00,6d,00,69,\
  00,6e,00,69,00,73,00,74,00,72,00,61,00,74,00,6f,00,72,00,5c,00,4c,68,62,97,\
  00,00
"MRUList"="ba"
"b"=hex:72,00,65,00,67,00,65,00,64,00,69,00,74,00,2e,00,65,00,78,00,65,00,00,\
  00,43,00,3a,00,5c,00,44,00,6f,00,63,00,75,00,6d,00,65,00,6e,00,74,00,73,00,\
  20,00,61,00,6e,00,64,00,20,00,53,00,65,00,74,00,74,00,69,00,6e,00,67,00,73,\
  00,5c,00,41,00,64,00,6d,00,69,00,6e,00,69,00,73,00,74,00,72,00,61,00,74,00,\
  6f,00,72,00,5c,00,4c,68,62,97,00,00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"a"="C:\\Documents and Settings\\Administrator\\桌面\\dstart.exe"
"MRUList"="ba"
"b"="C:\\Documents and Settings\\Administrator\\桌面\\0615.reg"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe]
"a"="C:\\Documents and Settings\\Administrator\\桌面\\dstart.exe"
"MRUList"="a"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\reg]
"a"="C:\\Documents and Settings\\Administrator\\桌面\\0615.reg"
"MRUList"="a"

[ 本帖最后由 zag0699 于 2009-6-15 22:15 编辑 ]

kingmuro

过蜘蛛和卡巴

302536811

什么意思？

knight`

360 nod32  没反应

520xu

SEP12也没反应

BING126

to McAfee

kingsheet

卡巴不报

xxl

BitDefender 2009

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.

眼镜王蛇

妈的 我运行了 结果他消失 江民没反应 咋办?

meishizhao

实在不明白
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU 、、   =   = 建他干什么