just a joke(by ximo)

显示全部楼层 · 发表于 2009-12-7 21:24:43

恶搞一下，没恶意，请见谅。

显示全部楼层 · 发表于 2009-12-7 21:26:12

Virus: Gen:Malware.Heur.syW@bSH42id (Engine A)

Virus found while downloading Web content.

显示全部楼层 · 发表于 2009-12-7 21:26:41

作者授权我发帖。。。大牛们分析下吧

显示全部楼层 · 发表于 2009-12-7 21:34:54

McAfee 报了可疑月神。。

显示全部楼层 · 发表于 2009-12-7 21:49:15

HIPS党和多引擎党呢

显示全部楼层 · 发表于 2009-12-7 21:49:46

瑞星报启发

显示全部楼层 · 发表于 2009-12-7 21:54:42

既然反沙盘我就等看行为了

显示全部楼层 · 发表于 2009-12-7 22:16:29

2009-12-7 22:15:30 c:\windows\explorer.exe 创建新进程 d:\桌面\joke\joke.exe 允许 [应用程序]* 命令行: "D:\桌面\joke\joke.exe"
2009-12-7 22:15:30 d:\桌面\joke\joke.exe 修改注册表值 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\属性(&R)\Command 阻止 [注册表组]文件关联设置 -> [注册表]*\Classes\*\shell\*\command* 值: rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0
2009-12-7 22:15:30 d:\桌面\joke\joke.exe 修改注册表值 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\打开(&H)\Command 阻止 [注册表组]文件关联设置 -> [注册表]*\Classes\*\shell\*\command* 值: C:\Program Files\Internet Explorer\IEXPLORE.EXE h%1t%2t%3p%4:%5/%6/%7b%8b%9s%0.%1j%2a%3n%4m%5e%6n%7g%8.%9c%0o%1m%2
2009-12-7 22:15:30 d:\桌面\joke\joke.exe 修改注册表值 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon 阻止 [注册表组]恶意设置项 -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\*\DefaultIcon 值: C:\Program Files\Internet Explorer\IEXPLORE.EXE
2009-12-7 22:15:30 d:\桌面\joke\joke.exe 修改注册表值 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty 阻止 [注册表组]恶意设置项 -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\*\DefaultIcon 值: C:\Program Files\Internet Explorer\IEXPLORE.EXE
2009-12-7 22:15:30 d:\桌面\joke\joke.exe 修改注册表值 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full 阻止 [注册表组]恶意设置项 -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\*\DefaultIcon 值: C:\Program Files\Internet Explorer\IEXPLORE.EXE

显示全部楼层 · 发表于 2009-12-7 22:16:48

修改文件关联吧

显示全部楼层 · 发表于 2009-12-7 22:25:46

2009/12/7 22:25:09 已隔离病毒 HEUR:Trojan.Win32.Generic G:\Temp\Virus\joke.rar/joke.exe

[可疑文件] just a joke(by ximo)

本帖子中包含更多资源