过大部分杀软

显示全部楼层 · 发表于 2009-11-25 15:00:50

双击之后会在桌面产生几个快捷方式. 右键那些快捷方式只有打开和创建快捷方式的选项

显示全部楼层 · 发表于 2009-11-25 15:09:53

过a2 双击运行后阻止

显示全部楼层 · 发表于 2009-11-25 16:06:40

在沙盘运行，卡巴kill

显示全部楼层 · 发表于 2009-11-25 16:15:37

过了红伞（右键扫描压缩包）

显示全部楼层 · 发表于 2009-11-25 16:51:14

to kl,avira

?????.exe - Trojan-Clicker.Win32.Agent.jjl

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

[ 本帖最后由 fatezero 于 2009-11-25 19:57 编辑 ]

显示全部楼层 · 发表于 2009-11-25 16:54:30

kv主防

该程序创建的文件列表
E:\zq.ico
E:\yx.ico
E:\tp.ico
E:\dy.ico

E:\Documents and Settings\Administrator\Favorites\美女图片.url
E:\Documents and Settings\Administrator\Favorites\在线电影.url
E:\Documents and Settings\Administrator\Favorites\小游戏.url
E:\Documents and Settings\Administrator\Favorites\日赚五百.url
E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\最好的绿色网址导航站.lnk

创注册键修改注册

[ 本帖最后由 adad2008 于 2009-11-25 17:06 编辑 ]

显示全部楼层 · 发表于 2009-11-25 18:46:14

不断的创建注册表项和修改权限,贴上一部分图

2009-11-25 18:31:58 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49AC29B5-B404-45FA-BC66-C02348C340BB}\DefaultIcon
值: C:\WINDOWS\resources\dy.ico

2009-11-25 18:32:14 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49AC29B5-B404-45FA-BC66-C02348C340BB}\shell
值: Open

2009-11-25 18:32:17 创建注册表项
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49AC29B5-B404-45FA-BC66-C02348C340BB}\shell\Open

2009-11-25 18:32:19 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49AC29B5-B404-45FA-BC66-C02348C340BB}\shell\Open
值: 打开(&H)

2009-11-25 18:32:24 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49AC29B5-B404-45FA-BC66-C02348C340BB}\shell\Open\MUIVerb
值: @ieframe.dll,-10241

2009-11-25 18:32:25 创建注册表项
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49AC29B5-B404-45FA-BC66-C02348C340BB}\shell\Open\Command

2009-11-25 18:32:28 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49AC29B5-B404-45FA-BC66-C02348C340BB}\shell\Open\Command
值: iexplore.exe http://www.606600.com

2009-11-25 18:32:38 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90091B91-901D-4C30-8382-1E682D61EF5C}\DefaultIcon
值: C:\WINDOWS\resources\tp.ico

2009-11-25 18:32:41 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90091B91-901D-4C30-8382-1E682D61EF5C}\shell
值: Open

2009-11-25 18:32:42 创建注册表项
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90091B91-901D-4C30-8382-1E682D61EF5C}\shell\Open

2009-11-25 18:32:44 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90091B91-901D-4C30-8382-1E682D61EF5C}\shell\Open
值: 打开(&H)

2009-11-25 18:32:46 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90091B91-901D-4C30-8382-1E682D61EF5C}\shell\Open\MUIVerb
值: @ieframe.dll,-10241

2009-11-25 18:32:47 创建注册表项
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90091B91-901D-4C30-8382-1E682D61EF5C}\shell\Open\Command

2009-11-25 18:32:49 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90091B91-901D-4C30-8382-1E682D61EF5C}\shell\Open\Command
值: iexplore.exe http://www.uu881.com

2009-11-25 18:32:52 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A3151FB-A0E0-4371-992D-3D7C4C9347BA}\DefaultIcon
值: C:\WINDOWS\resources\yx.ico

2009-11-25 18:32:53 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A3151FB-A0E0-4371-992D-3D7C4C9347BA}\shell
值: Open

2009-11-25 18:32:54 创建注册表项
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A3151FB-A0E0-4371-992D-3D7C4C9347BA}\shell\Open

2009-11-25 18:32:55 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A3151FB-A0E0-4371-992D-3D7C4C9347BA}\shell\Open
值: 打开(&H)

2009-11-25 18:32:57 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A3151FB-A0E0-4371-992D-3D7C4C9347BA}\shell\Open\MUIVerb
值: @ieframe.dll,-10241

2009-11-25 18:32:59 创建注册表项
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A3151FB-A0E0-4371-992D-3D7C4C9347BA}\shell\Open\Command

2009-11-25 18:33:00 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A3151FB-A0E0-4371-992D-3D7C4C9347BA}\shell\Open\Command
值: iexplore.exe http://www.6264.cn

2009-11-25 18:33:04 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE279D05-F50D-435A-B4EB-62E63338DEBA}\DefaultIcon

2009-11-25 18:33:07 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE279D05-F50D-435A-B4EB-62E63338DEBA}\shell
值: Open

2009-11-25 18:33:08 创建注册表项
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE279D05-F50D-435A-B4EB-62E63338DEBA}\shell\Open

2009-11-25 18:33:09 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE279D05-F50D-435A-B4EB-62E63338DEBA}\shell\Open
值: 打开(&H)

2009-11-25 18:33:11 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE279D05-F50D-435A-B4EB-62E63338DEBA}\shell\Open\MUIVerb
值: @ieframe.dll,-10241

2009-11-25 18:33:12 创建注册表项
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE279D05-F50D-435A-B4EB-62E63338DEBA}\shell\Open\Command

2009-11-25 18:33:14 修改注册表值
进程: c:\documents and settings\administrator\桌面\情色播放器\情色播放器.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE279D05-F50D-435A-B4EB-62E63338DEBA}\shell\Open\Command
值: iexplore.exe http://www.7832.com/zhuan

显示全部楼层 · 发表于 2009-11-25 19:46:05

过了红伞，已经上报红伞官方网站。

显示全部楼层 · 发表于 2009-11-25 19:50:26

我的微点杀毒，江民，EAV，A2，Nis都过了！

[病毒样本] 过大部分杀软

本帖子中包含更多资源

评分

本帖子中包含更多资源