分析下这个木马

显示全部楼层 · 发表于 2009-12-6 13:34:40

分析下

显示全部楼层 · 发表于 2009-12-6 13:35:26

joker.cmdshell

显示全部楼层 · 发表于 2009-12-6 14:35:57

Detailed report of suspicious malware actions:
Defined file type copied to Windows folder: C:\WINDOWS\system32\drivers\ifjkzf.sys（木马驱
动）
Defined file type copied to Windows folder: C:\WINDOWS\system32\ifjkzf.dll
Defined file type copied to Windows folder: C:\WINDOWS\xzvxcv.exe
Defined registry AutoStart location added or modified: machine\software\microsoft\windows
nt\currentversion\winlogon\Shell = x(不能显示桌面）
Defined registry AutoStart location added or modified: （改服务）
machine\SYSTEM\CurrentControlSet\Services\iadkpi\Type = 10010000
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\iadkpi\Start = 02000000
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\iadkpi\ErrorControl = 01000000
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\iadkpi\DisplayName = iadkpi
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\iadkpi\ImagePath = C:\WINDOWS\system32
\svchost.exe -k iadkpi
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\iadkpi\Description = Microsoft .NET Framework
TPM
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\iadkpi\SbieProcessId = A40C0000
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\iadkpi\SbieCurrentState = 04000000
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\iadkpi\SbieControlsAccepted = 04000000
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\iadkpi\Parameters\ServiceDll =
2500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0069
0066006A006B007A0066002E0064006C006C000000
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\SbieSvc\SandboxedServices = iadkpiyadkpilu
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\yadkpilu\Type = 01000000
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\yadkpilu\Start = 02000000
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\yadkpilu\ErrorControl = 01000000
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\yadkpilu\DisplayName = yadkpilu
Defined registry AutoStart location added or modified:
machine\SYSTEM\CurrentControlSet\Services\yadkpilu\ImagePath = C:\WINDOWS\system32
\drivers\ifjkzf.sys
Risk evaluation result: High（高风险）
启动服务：错误之处请指正

显示全部楼层 · 发表于 2009-12-6 14:43:40

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'E:\价格图片.rar'
E:\价格图片.rar
[0] Archivtyp: RAR
--> ﾼￛﾸ￱ￍﾼￆﾬ.scr
[FUND] Ist das Trojanische Pferd TR/Drop.Delf.jz.A
[HINWEIS] Die Datei wurde gelöscht.

显示全部楼层 · 发表于 2009-12-6 14:44:58

http://bbs.kafan.cn/thread-605342-1-1.html 说 machine\software\microsoft\windows nt\currentversion\winlogon\Shell = x被修改正常

显示全部楼层 · 发表于 2009-12-6 14:45:02

发生以下错误：

对象感染以下病毒： Trojan-Dropper.Win32.Delf.jz

若您认为不正确，请联系服务供应商。

显示全部楼层 · 发表于 2009-12-6 14:46:59

回复 5# hekygogo

确实正常。

显示全部楼层 · 发表于 2009-12-6 17:17:03

瑞星2010
Binder.Gpigeon.b

显示全部楼层 · 发表于 2009-12-6 17:30:59

MPAV

显示全部楼层 · 发表于 2009-12-6 17:36:47

"C:\Users\ekincheng\Desktop\价格图片.rar:\价格图片.scr";"Trojan horse Dropper.Small.19.Z";"Infected"

[病毒样本] 分析下这个木马

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源