样本一个

显示全部楼层 · 发表于 2009-12-23 09:56:21

[:27:] 过金山网络版

显示全部楼层 · 发表于 2009-12-23 10:15:50

to eset和ik

显示全部楼层 · 发表于 2009-12-23 10:21:07

avira

檔案'C:\Users\ms\AppData\Local\Temp\Rar$DR00.460\CRTV1\CRTV1.exe'
偵測到惡意程式'TR/Dropper.Gen [trojan]'。
處理動作：拒絕存取

显示全部楼层 · 发表于 2009-12-23 10:23:51

KIS2010
检测到威胁: Trojan-Downloader.Win32.VB.tnj E:\download\aaa.rar/CRTV1\CRTV1.exe

显示全部楼层 · 发表于 2009-12-23 10:30:51

红伞拒绝的飘过

显示全部楼层 · 发表于 2009-12-23 10:59:13

[ Changes to filesystem ]
* Creates file C:\WINDOWS\520.Ico
* Creates file C:\WINDOWS\Game.Ico
* Creates file C:\WINDOWS\home.Ico
* Creates file C:\WINDOWS\movie.Ico
* Creates file C:\WINDOWS\sys.dll
* Creates file D:\My Documents\Favorites\全国最大的图片门户站.url
* Creates file D:\My Documents\Favorites\女生网-小女生最喜欢的网站.url
* Creates file D:\My Documents\Favorites\最新高清电影免费在线观看.url
* Creates file D:\My Documents\Favorites\空姐美女玩彩票中200万.url
* Creates file D:\My Documents\Favorites\粉丝最多的明星娱乐网站.url
* Creates file D:\My Documents\Favorites\绿色上网主页.url
* Creates file D:\My Documents\Favorites\艳美性感美女写真网.url
* Creates file D:\My Documents\Favorites\超级好玩的小游戏.url
* Modifies file C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
* Creates file C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.url
* Creates file C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\绿色上网主页.url
* Deletes file C:\Documents and Settings\Administrator\「开始」菜单\程序\Internet Explorer.lnk
* Creates file C:\Documents and Settings\Administrator\「开始」菜单\程序\启动 Internet Explorer 浏览器 .url
* Creates file C:\Documents and Settings\Administrator\桌面\创业项目.url
* Creates file C:\Documents and Settings\Administrator\桌面\女生电影.url
* Creates file C:\Documents and Settings\Administrator\桌面\小游戏.url

[ Changes to registry ]
* Creates value "{696EB45E-BB94-3745-B254-17076595EB03} =Internet Explorer" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID
* Creates value "DefaultIcon =C:\Program Files\Internet Explorer\iexplore.exe" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{696EB45E-BB94-3745-B254-17076595EB03}
* Creates value "Command =C:\Program Files\Internet Explorer\iexplore.exe %1 http://www.40907.com" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{696EB45E-BB94-3745-B254-17076595EB03}\Shell\Open(&O)
* Creates value "OpenMain =Sb_;Nu?&H)" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{696EB45E-BB94-3745-B254-17076595EB03}\Shell
* Creates value "Z = Rd?&D)" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{696EB45E-BB94-3745-B254-17076595EB03}\Shell
* Creates value "Command =Rundll32.exe" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{696EB45E-BB94-3745-B254-17076595EB03}\Shell\Z
* Creates value "'`(=Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{696EB45E-BB94-3745-B254-17076595EB03}\Shell\^
* Creates value "Attributes=0A000000" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{696EB45E-BB94-3745-B254-17076595EB03}\ShellFolder
* Creates value "{B514A59A-5FD9-1743-B543-DD25CE93C7A5} =~r?" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID
* Creates value "DefaultIcon =C:\WINDOWS\520.Ico" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B514A59A-5FD9-1743-B543-DD25CE93C7A5}
* Creates value "Command =C:\Program Files\Internet Explorer\iexplore.exe %1 h%tt%p%:%/%/%ww%w.91%11%g%.cn" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B514A59A-5FD9-1743-B543-DD25CE93C7A5}\Shell\Open(&O)
* Creates value "OpenMain =Sb_;Nu?&H)" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B514A59A-5FD9-1743-B543-DD25CE93C7A5}\Shell
* Creates value "Z = Rd?&D)" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B514A59A-5FD9-1743-B543-DD25CE93C7A5}\Shell
* Creates value "Command =Rundll32.exe" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B514A59A-5FD9-1743-B543-DD25CE93C7A5}\Shell\Z
* Creates value "'`(=Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B514A59A-5FD9-1743-B543-DD25CE93C7A5}\Shell\^
* Creates value "Attributes=0A000000" in key HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B514A59A-5FD9-1743-B543-DD25CE93C7A5}\ShellFolder
* Creates value "{696EB45E-BB94-3745-B254-17076595EB03} =Internet Explorer" in key HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
* Creates value "{B514A59A-5FD9-1743-B543-DD25CE93C7A5} =Internet Explorer" in key HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
* Modifies value "{871C5380-42A0-1069-A2EA-08002B30309D}=1" in key HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu
old value empty
* Modifies value "{871C5380-42A0-1069-A2EA-08002B30309D}=1" in key HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
old value empty

流氓一个…

显示全部楼层 · 发表于 2009-12-23 14:26:59

试过，kis可以删除

显示全部楼层 · 发表于 2009-12-23 16:23:12

毒霸miss

显示全部楼层 · 发表于 2009-12-23 18:51:35

微点

Files added: 20
--------------------
C:\Documents and Settings\Owner\Local Settings\Temp\~DF640.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\Rar$EX01.828\CRTV1\CRTV1.exe
C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\绿色上网主页.url
C:\Documents and Settings\Owner\「开始」菜单\程序\启动 Internet Explorer 浏览器 .url
C:\Documents and Settings\Owner\Favorites\全国最大的图片门户站.url
C:\Documents and Settings\Owner\Favorites\最新高清电影免费在线观看.url
C:\Documents and Settings\Owner\Favorites\超级好玩的小游戏.url
C:\Documents and Settings\Owner\Favorites\艳美性感美女写真网.url
C:\Documents and Settings\Owner\Favorites\绿色上网主页.url
C:\Documents and Settings\Owner\Favorites\女生网-小女生最喜欢的网站.url
C:\Documents and Settings\Owner\Favorites\粉丝最多的明星娱乐网站.url
C:\Documents and Settings\Owner\Favorites\空姐美女玩彩票中200万.url
C:\Documents and Settings\Owner\桌面\创业项目.url
C:\Documents and Settings\Owner\桌面\小游戏.url
C:\Documents and Settings\Owner\桌面\女生电影.url
C:\WINDOWS\sys.dll
C:\WINDOWS\movie.Ico
C:\WINDOWS\Game.Ico
C:\WINDOWS\home.Ico
C:\WINDOWS\520.Ico

Files modified: 9
--------------------
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.url
C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\显示桌面.SCF
C:\Documents and Settings\Owner\「开始」菜单\程序\Internet Explorer.lnk
C:\Documents and Settings\Owner\Cookies\index.dat
C:\Documents and Settings\All Users\桌面\Mozilla Firefox.lnk

显示全部楼层 · 发表于 2009-12-23 20:25:42

检测到: Trojan-Downloader.Win32.VB.tnj
启发式分析计算的威胁级别值较高 Internet Explorer 是

[病毒样本] 样本一个

本帖子中包含更多资源

本帖子中包含更多资源