疑似龙之谷盗号木马[MD5: 3187AB]

忧郁的迷糊酱

密码：virus

已To ESET http://samples.eset.com.cn/index.php?a=query&lang=0&md5=3187ab66e252b558e4eadf9090e66c99

langzi2009

绅博周幸

MSE可以识别

忧郁的迷糊酱

回复 2楼 langzi2009  的帖子

这是一个文件，论坛附件大小限制，不能一次性发上来。
   

z2665

Category: Tool

Description: This program is used to create viruses, worms or other malware.

Recommendation: Remove this software immediately.

Forefront Endpoint Protection detected programs that may compromise your privacy or damage your computer. You can still access the files that these programs use without removing them (not recommended). To access these files, select the 'Allow' action and click 'Apply actions'. If this option is not available, log on as administrator or ask the local administrator for help.

Items:
file:C:\Users\z2665\AppData\Local\Temp\Rar$DR00.999\lzg.exe

绅博周幸

类别: 工具

说明: 这个程序用于创建病毒、蠕虫或其他恶意软件。

建议: 立即删除这个软件。

Microsoft Security Essentials 检测到可能会侵害您的隐私或损坏计算机的程序。即使不删除这些程序，仍然可以访问它们所使用的文件(不推荐)。若要访问这些文件，请选择“允许”操作，并单击“应用操作”。如果此选项不可用，请以管理员身份登录或请求本地管理员提供帮助。

项目:
file:C:\Users\zhouxing\Downloads\lzg.exe

联机获取有关此项目的详细信息。

ssama

Avira Is the TR/Obfuscated.XZ.1734 Trojan
avast! MISS

Executing: e:\testvirus\sample.part1\lzg.exe
SetWindowsHookEx()
DeleteFile(C:\Users\Shamrock\AppData\Local\Temp\lzgxm.update)
InternetConnect(61.160.212.13)
OpenService(TAPISRV)
OpenService(Sens)
RegSetValueEx(HKLM\System\Setup\ProxyEnable, REG_DWORD: 0)
RegDeleteValue(HKLM\System\Setup\ProxyServer) [e:\testvirus\sample.part1\lzg.exe]
RegDeleteValue(HKLM\System\Setup\ProxyOverride) [e:\testvirus\sample.part1\lzg.exe]
RegDeleteValue(HKLM\System\Setup\AutoConfigURL)
RegSetValueEx(HKLM\System\Setup\SavedLegacySettings, REG_BINARY)
bind(port=0)
connect( 61.160.212.13:21 )
CreateToolhelp32Snapshot()
CreateProcess((null),C:\Users\Shamrock\AppData\Local\Temp\lzgxm.update,C:\Users\Shamrock\AppData\Local\Temp\)
RegSetValueEx(HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1441131b-985d-11df-a501-806e6f6e6963}\\BaseClass, REG_SZ: Drive)
RegSetValueEx(HKCR\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\BaseClass, REG_SZ: Drive)
RegCreateKeyEx(HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{14411321-985d-11df-a501-806e6f6e6963}\,(null))
RegSetValueEx(HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{14411321-985d-11df-a501-806e6f6e6963}\\BaseClass, REG_SZ: Drive)
RegSetValueEx(HKCR\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\BaseClass, REG_SZ: Drive)

jayavira

已经有人上报

http://samples.nod32.com.hk/inde ... 558e4eadf9090e66c99

jason_jiang

to xandora(panda)

rasis

ks

病毒        2010-07-30  08:45:05        病毒在文件D:\DOWNLOAD\LZG.EXE中        Win32.Malware.Heur_Generic.B.(kcloud)         处理成功（操作：删除）