setup_T8kdQDje.exe

显示全部楼层 · 发表于 2010-11-30 13:26:48

本帖最后由 fatezero 于 2010-11-30 14:42 编辑

Hello,

setup_T8kdQDje.exe_ - Trojan.Win32.StartPage.ahgp

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

Regards, Vitaly Vorobiov
Virus Analyst

显示全部楼层 · 发表于 2010-11-30 13:29:05

大蜘蛛clean，加了个壳：
setup_T8kdQDje.exe - archive BINARYRES
>>setup_T8kdQDje.exe/data002 packed by UPX
已上报

显示全部楼层 · 发表于 2010-11-30 13:30:43

AVG啊

显示全部楼层 · 发表于 2010-11-30 13:38:44

2010-11-30 13:36:55 创建文件    操作:阻止
进程路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
文件路径:C:\Program Files\Common Files\t.ico
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\Common Files\*

2010-11-30 13:36:55 创建文件    操作:阻止
进程路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
文件路径:C:\Program Files\Common Files\t.ico
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\Common Files\*

2010-11-30 13:36:55 创建文件    操作:阻止
进程路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
文件路径:C:\Program Files\Common Files\t.ico
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\Common Files\*

2010-11-30 13:36:55 创建文件    操作:阻止
进程路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
文件路径:C:\Program Files\Common Files\d.ico
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\Common Files\*

2010-11-30 13:36:55 创建文件    操作:阻止
进程路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
文件路径:C:\Program Files\Common Files\d.ico
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\Common Files\*

2010-11-30 13:36:55 创建文件    操作:阻止
进程路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
文件路径:C:\Program Files\Common Files\d.ico
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\Common Files\*

2010-11-30 13:37:02 创建文件    操作:阻止
进程路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\Internet Expleror.hdh
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\*

2010-11-30 13:37:10 创建文件    操作:允许
进程路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
文件路径:F:\virus\setup_T8kdQDje\网聚.exe
触发规则:应用程序规则->其它文件设置->F:\*->F:\*.exe

2010-11-30 13:37:11 创建文件    操作:允许
进程路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
文件路径:C:\VB349I.exe
触发规则:所有程序规则->全局设置->?:\*.exe

2010-11-30 13:37:11 修改文件    操作:阻止
进程路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
文件路径:(隐藏文件)C:\VB349I.exe
触发规则:所有程序规则->全局设置->?:\*.exe

2010-11-30 13:37:26 创建注册表值    操作:使用任务隔离区操作
进程路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu
注册表名称:[Key]
触发规则:所有程序规则->其他重要项->*\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons*

2010-11-30 13:37:26 修改注册表内容    操作:使用任务隔离区操作
进程路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
注册表名称:{871C5380-42A0-1069-A2EA-08002B30309D}
触发规则:所有程序规则->其他重要项->*\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons*

2010-11-30 13:37:26 运行应用程序    操作:允许
进程路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
文件路径:C:\WINDOWS\system32\wscript.exe
命令行:jies.bak.vbs
触发规则:所有程序规则->系统程序设置->%windir%\system32\*script.exe

2010-11-30 13:37:31 删除文件    操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:F:\virus\setup_T8kdQDje\setup_T8kdQDje.exe
触发规则:所有程序规则->全局设置->?:\*.exe

显示全部楼层 · 发表于 2010-11-30 13:43:51

红伞提示检测到三个有害程序，so,直接删除了

希望有能力的童鞋贴个日志看看

显示全部楼层 · 发表于 2010-11-30 14:09:00

2010-11-30 14:07:14 运行应用程序    操作:允许
进程路径:F:\virus\setup_T8kdQDje\VB349I.exe
文件路径:C:\Program Files\Internet Explorer\iexplore.exe
命令行:http://dl.kanlink.cn:1287/CPAdown/vplay.php
触发规则:所有程序规则->非系统进程操作 ->%ProgramFiles%\Internet Explorer\iexplore.exe

2010-11-30 14:08:00 创建文件    操作:允许
进程路径:F:\virus\setup_T8kdQDje\VB349I.exe
文件路径:C:\vplay.exe
触发规则:所有程序规则->全局设置->?:\*.exe

2010-11-30 14:08:01 修改文件    操作:阻止
进程路径:F:\virus\setup_T8kdQDje\VB349I.exe
文件路径:C:\vplay.exe
触发规则:所有程序规则->全局设置->?:\*.exe

2010-11-30 14:08:10 运行应用程序    操作:允许
进程路径:C:\vplay.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
命令行:/SL5="$1B062A,2347705,75776,c:\vplay.exe" /VERYSILENT /SP-
触发规则:所有程序规则->其它程序设置->*\Temp\*

2010-11-30 14:08:17 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*

2010-11-30 14:08:18 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\QvodUpdate.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-11-30 14:08:20 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\unins000.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-11-30 14:08:21 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\unins000.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-11-30 14:08:23 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\play810.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-11-30 14:08:25 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\play810.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-11-30 14:08:26 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\NetAgent.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:26 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\NetAgent.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:27 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\play810.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-11-30 14:08:28 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\play810.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-11-30 14:08:29 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\pncrt.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:29 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\pncrt.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:29 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\QvodBand.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:29 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\QvodBand.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:30 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\QvodInit.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-11-30 14:08:32 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\QvodInit.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-11-30 14:08:32 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\QvodInsert.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:32 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\QvodInsert.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:34 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\QvodPlayer.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-11-30 14:08:36 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\QvodPlayer.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-11-30 14:08:37 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\QvodTerminal.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-11-30 14:08:39 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\QvodTerminal.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-11-30 14:08:39 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\ShareModule.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:39 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\ShareModule.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:39 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\AddIn\VisLrc.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:39 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\AddIn\VisLrc.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:39 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\Codecs\atrc.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:39 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\Codecs\atrc.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:39 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\Codecs\cook.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:40 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\Codecs\cook.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:40 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\Codecs\drvc.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:40 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\Codecs\drvc.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:40 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\Codecs\raac.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:40 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\Codecs\raac.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:40 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\Lang\en_US.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:40 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\Lang\en_US.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:41 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\Lang\zh_TW.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:41 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\Lang\zh_TW.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:43 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\QvodInsert.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:43 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Program Files\风影影视\QvodInsert.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 14:08:45 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\风影影视
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\*

2010-11-30 14:08:47 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\风影影视\风影影视.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk

2010-11-30 14:08:48 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\风影影视\风影影视网站.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\*

2010-11-30 14:08:50 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Documents and Settings\All Users\桌面\风影影视.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\桌面\*.lnk

2010-11-30 14:08:50 创建文件    操作:使用任务隔离区操作
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\风影影视.lnk
触发规则:所有程序规则->Documents and Settings设置（一）->?:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\Quick Launch\*.lnk

2010-11-30 14:08:50 修改注册表内容    操作:使用任务隔离区操作
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-KJ7VH.tmp\vplay.tmp
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
注册表名称:Start Page
更改后:http://www.henbucuo.com/?vb
更改前:http://www.qu123.com/?92
触发规则:所有程序规则->IE浏览器设置->*\Software\Microsoft\Internet explorer\Main

显示全部楼层 · 发表于 2010-11-30 14:12:28

红伞日志
Starting the file scan:

Begin scan in 'C:\Documents and Settings\li\桌面\setup_T8kdQDje.rar'
C:\Documents and Settings\li\桌面\setup_T8kdQDje.rar
[0] Archive type: RAR
  [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
  --> setup_T8kdQDje.exe
[1] Archive type: RSRC
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    A backup was created as '4eb534a3.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

显示全部楼层 · 发表于 2010-11-30 14:12:44

双击网聚.exe打开网页，没穿衣的美女让你大饱艳福，不要干坏事啊。

显示全部楼层 · 发表于 2010-11-30 14:12:53

avira

Detected a virus or malware 'TR/Crypt.XPACK.Gen' [trojan]
in file 'E:\TEMP\RrGysWVR.htm.part'.
Action taken: Delete file

显示全部楼层 · 发表于 2010-11-30 14:12:56

to eset

http://samples.nod32.com.hk/inde ... 53ac1ae0b91bdaadcbd

[可疑文件] setup_T8kdQDje.exe

本帖子中包含更多资源

评分

本帖子中包含更多资源