hxxp://www.platinumchina.com/images/s.exe

a256886572008

Log generated by anonymous use mdecoder 0.63
[root]http://www.qpbay.com/DictData/img.js
    [iframe]http://www.qpbay.com/DictData/kol.htm
    [iframe]http://www.qpbay.com/DictData/sky.html
    [iframe]http://www.qpbay.com/DictData/count.html



該網頁會下載
hxxp://www.platinumchina.com/images/s.exe

該病毒又會下載：
hxxp://98.126.64.186:61688/img/AdvythsLVfgmf1.exe

2010-11-10 18:08:29   C:\Documents and Settings\Roger\桌面\virus\S\s.exe   Sandboxed As   Partially Limited   

2010-11-10 18:08:31   C:\Documents and Settings\Roger\Microsoft\smx4pnp.dll   Sandboxed As   Partially Limited   

2010-11-10 18:08:46   C:\WINDOWS\system32\calc.exe   Sandboxed As   Partially Limited   
2010-11-10 18:08:54   C:\Documents and Settings\Roger\桌面\virus\S\s.exe   Modify Key   HKUS\S-1-5-21-2000478354-583907252-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\smx4pnp  

2010-11-10 18:08:54   C:\WINDOWS\system32\calc.exe   Modify File   C:\Documents and Settings\Roger\桌面\virus\S\s.exe   

2010-11-10 18:08:54   C:\Documents and Settings\Roger\Microsoft\smx4pnp.dll   Modify Key   HKUS\S-1-5-21-2000478354-583907252-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable   

2010-11-10 18:08:59   C:\WINDOWS\system32\regsvr32.exe   Sandboxed As   Partially Limited   
2010-11-10 18:08:59   C:\WINDOWS\system32\dwwin.exe   Sandboxed As   Partially Limited   
2010-11-10 18:09:11   C:\Documents and Settings\Roger\Local Settings\Temporary Internet Files\Content.IE5\T82CGCOG\AdvythsLVfgmf1[1].exe   Modify File   C:\WINDOWS\system32\anhzxc.exe   

2010-11-10 18:09:11   C:\Documents and Settings\Roger\Local Settings\Temporary Internet Files\Content.IE5\T82CGCOG\AdvythsLVfgmf1[1].exe   Modify Key   HKUS\S-1-5-21-2000478354-583907252-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\anhxox   

2010-11-10 18:09:11   C:\Documents and Settings\Roger\Local Settings\Temporary Internet Files\Content.IE5\T82CGCOG\AdvythsLVfgmf1[1].exe   Access Memory   C:\WINDOWS\explorer.exe

2010-11-10 18:10:01   C:\Documents and Settings\Roger\桌面\virus\S\s.exe   Scanned Online and Found Malicious     

-----------------------------------------
2010-11-10 18:10:01   C:\Documents and Settings\Roger\桌面\virus\S\s.exe   CloudBehavior.Suspicious@1   Quarantine   Success   

-----------------------------
s.exe  Suspicious Actions Detected
Creates autorun records
Deletes self

CIMA:
http://camas.comodo.com/cgi-bin/submit?file=2382d611910b0a2d544adaab2141b9297fc81694c96362b78fb458240ac7a8a6

--------------------------------
AdvythsLVfgmf1[1].exe Suspicious Actions Detected
Copies self to other locations
Creates autorun records
Creates files in windows system directory
Deletes self
Injects code into other processes
Registers dynamic link libraries

CIMA:
http://camas.comodo.com/cgi-bin/ ... 3961caa4d90ade8e363

hadg

C:\Documents and Settings\Administrator\桌面\截图1289387379.jpg

留侯

大蜘蛛kill。

s.exe infected with Trojan.PWS.Gamania.28606
AdvythsLVfgmf1[1].exe infected with Trojan.PWS.Gamania.28606
smx4pnp.dll infected with Trojan.PWS.Gamania.28606

KOI9009

瑞星 2011 清空

瓜皮猫

eset kill 2
2010/11/10 19:18:31        文件系统实时防护        文件        C:\Users\微亿毫\Desktop\s\AdvythsLVfgmf1[1].exe        Win32/Kryptik.IAQ 特洛伊木马 的变种        已删除 - 已隔离        微亿毫-PC\微亿毫        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
2010/11/10 19:18:30        文件系统实时防护        文件        C:\Users\微亿毫\Desktop\s\s.exe        Win32/Kryptik.IAQ 特洛伊木马 的变种        已删除 - 已隔离        微亿毫-PC\微亿毫        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.
邮件上报  1X

闪电战

过了金山毒霸

闪电战

现在报了s.exe

现在AdvythsLVfgmf1.exe

终于全报了

冰封心事

金山卫士和MSE均可查杀

hansyu

panda miss 1x
2x to xandora(panda)

星晨

BitDefender2011