瞧一瞧看一看啦~~~

BING126

to McAfee

username

2009-12-31 22:55:55    创建新进程    阻止
进程: d:\emule\午夜播放器_27_cy\午夜播放器_27_cy.exe
目标: c:\program files\internet explorer\iexplore.exe
命令行: "C:\Program Files\Internet Explorer\iexplore.exe" http://www.43737.com/?HHHHHHHHHHHHHHHHHHHHH
规则: [应用程序]*

2009-12-31 22:55:56    创建新进程    阻止
进程: d:\emule\午夜播放器_27_cy\午夜播放器_27_cy.exe
目标: c:\program files\internet explorer\iexplore.exe
命令行: "C:\Program Files\Internet Explorer\iexplore.exe" http://tc.m32.cn/
规则: [应用程序]*

2009-12-31 22:55:56    修改文件权限    阻止并结束进程
进程: d:\emule\午夜播放器_27_cy\午夜播放器_27_cy.exe
目标: C:\Documents and Settings\User\Start Menu\Programs\Internet Explorer.lnk
规则: [文件组][S]系统文件_自订 -> [文件]*; *internet explore*.lnk

bye-

samtogo

to 卡巴微点诺顿

sharkking

有联网~ESET没报，播放器有点流氓了~
      

samtogo

Hello,


?????_27_cy.exe - Trojan-PSW.Win32.Agent.ouw

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

--------------------
Regards, Vitaly Yakutenko
Virus analyst, Kaspersky Lab.

fengtaks

to PA / VB / MMPC / Fortinet

ROUND5

修改文件
C:\Users\Public\Desktop\Internet Explorer.lnk
C:\Users\Public\Desktop\创业投资好项目.url
C:\Users\Public\Desktop\高清影视.url
C:\Users\Public\Desktop\淘宝.url
C:\Windows\system32\diricon.ico
C:\Windows\system32\mensdyicon.ico
C:\Windows\system32\viebu4icon.ico
C:\Users\Round5\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk
C:\Users\Round5\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
C:\Users\Round5\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
C:\Users\Round5\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
C:\Users\round5\AppData\Roaming\Mozilla\Firefox\Profiles\qb7oe0gy.default\prefs.js
C:\Users\round5\AppData\Roaming\Microsoft\Windows\Start Menu\Internet Explorer.lnk
C:\Users\round5\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
C:\Users\round5\Desktop\波波虎.lnk
C:\Users\round5\Favorites\高清影视.url
C:\Users\round5\Favorites\精彩小游戏.url
C:\Users\round5\Favorites\网址大全.url
篡改注册表
[HKEY_LOCAL_MACHINE\SOFTWARE\classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}]
@="Network"
"LocalizedString"=hex(2):49,00,6e,00,74,00,65,00,72,00,6e,00,65,00,74,00,20,00,\
  45,00,78,00,70,00,6c,00,6f,00,72,00,65,00,72,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\DefaultIcon]
@=hex(2):69,00,65,00,66,00,72,00,61,00,6d,00,65,00,2e,00,64,00,6c,00,6c,00,2c,\
  00,2d,00,31,00,39,00,30,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\InProcServer32]
@="%SystemRoot%\\system32\\ieframe.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell]
@="Open"

[HKEY_LOCAL_MACHINE\SOFTWARE\classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\Open]
@="打开主页(&H)"
"MUIVerb"="@ieframe.dll,-10241"

[HKEY_LOCAL_MACHINE\SOFTWARE\classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\Open\Command]
@="C:\\Program Files\\Internet Explorer\\iexplore.exe h%t%t%p%:%/%/%2w%1w%6w%.%24%13%27%73%17%.%2c%1o%7m%/%?%3c%3y"

[HKEY_LOCAL_MACHINE\SOFTWARE\classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\属性(&R)]

[HKEY_LOCAL_MACHINE\SOFTWARE\classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\属性(&R)\Command]
@="rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0"

[HKEY_LOCAL_MACHINE\SOFTWARE\DaemonLites9]
"uid"="27"
"uname"="cy"

[HKEY_CURRENT_USER\software\Microsoft\Internet Explorer\Main]
"Window_Placement"=hex:2c,00,00,00,00,00,00,00,01,00,00,00,ff,ff,ff,ff,ff,ff,\
  ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,00,00,00,00,00,20,03,00,00,58,02,00,\
  00

黑色火星人

这个好强

64845

你们不怕我就不怕