hxxp://www.qpbay.com/DictData/img.js

a256886572008

Log generated by anonymous use mdecoder 0.63
[root]http://www.qpbay.com/DictData/img.js
    [iframe]http://www.qpbay.com/DictData/kol.htm
    [iframe]http://www.qpbay.com/DictData/sky.html
    [iframe]http://www.qpbay.com/DictData/count.html



該網頁會下載
hxxp://www.platinumchina.com/images/s.exe

該病毒又會下載：
hxxp://98.126.64.186:61688/img/AdvythsLVfgmf1.exe

2010-11-10 18:08:29   C:\Documents and Settings\Roger\桌面\virus\S\s.exe   Sandboxed As   Partially Limited   

2010-11-10 18:08:31   C:\Documents and Settings\Roger\Microsoft\smx4pnp.dll   Sandboxed As   Partially Limited   

2010-11-10 18:08:46   C:\WINDOWS\system32\calc.exe   Sandboxed As   Partially Limited   
2010-11-10 18:08:54   C:\Documents and Settings\Roger\桌面\virus\S\s.exe   Modify Key   HKUS\S-1-5-21-2000478354-583907252-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\smx4pnp  

2010-11-10 18:08:54   C:\WINDOWS\system32\calc.exe   Modify File   C:\Documents and Settings\Roger\桌面\virus\S\s.exe   

2010-11-10 18:08:54   C:\Documents and Settings\Roger\Microsoft\smx4pnp.dll   Modify Key   HKUS\S-1-5-21-2000478354-583907252-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable   

2010-11-10 18:08:59   C:\WINDOWS\system32\regsvr32.exe   Sandboxed As   Partially Limited   
2010-11-10 18:08:59   C:\WINDOWS\system32\dwwin.exe   Sandboxed As   Partially Limited   
2010-11-10 18:09:11   C:\Documents and Settings\Roger\Local Settings\Temporary Internet Files\Content.IE5\T82CGCOG\AdvythsLVfgmf1[1].exe   Modify File   C:\WINDOWS\system32\anhzxc.exe   

2010-11-10 18:09:11   C:\Documents and Settings\Roger\Local Settings\Temporary Internet Files\Content.IE5\T82CGCOG\AdvythsLVfgmf1[1].exe   Modify Key   HKUS\S-1-5-21-2000478354-583907252-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\anhxox   

2010-11-10 18:09:11   C:\Documents and Settings\Roger\Local Settings\Temporary Internet Files\Content.IE5\T82CGCOG\AdvythsLVfgmf1[1].exe   Access Memory   C:\WINDOWS\explorer.exe

2010-11-10 18:10:01   C:\Documents and Settings\Roger\桌面\virus\S\s.exe   Scanned Online and Found Malicious     

-----------------------------------------
2010-11-10 18:10:01   C:\Documents and Settings\Roger\桌面\virus\S\s.exe   CloudBehavior.Suspicious@1   Quarantine   Success   

-----------------------------
s.exe  Suspicious Actions Detected
Creates autorun records
Deletes self

CIMA:
http://camas.comodo.com/cgi-bin/submit?file=2382d611910b0a2d544adaab2141b9297fc81694c96362b78fb458240ac7a8a6

--------------------------------
AdvythsLVfgmf1[1].exe Suspicious Actions Detected
Copies self to other locations
Creates autorun records
Creates files in windows system directory
Deletes self
Injects code into other processes
Registers dynamic link libraries

CIMA:
http://camas.comodo.com/cgi-bin/ ... 3961caa4d90ade8e363

521HDL

Opera下费尔没报！

luoni96121

小A拦截

猪头大队

360网盾报告拦截了一个病毒或者恶意广告界面

oneappleliu

卡巴下载后拦截

promised

1. Log Generated By SploitZilla
   
2. [root]
   
3. http://www.qpbay.com/DictData/img.js
   
4.   http://www.qpbay.com/DictData/kol.htm
   
5.     http://www.platinumchina.com/images/s.exe
   
6.   http://www.qpbay.com/DictData/sky.html
   
7.     http://www.platinumchina.com/images/s.exe
   
8.   http://www.qpbay.com/DictData/count.html
   

复制代码

penghao08a1

小A果断拦截