卡7又飘了~~~

tonger2003

solcroft

foxhound

确实飘了~~~~

jlennon

Processes:
PID        ParentPID        User        Path       
--------------------------------------------------

Ports:
Port        PID        Type        Path       
--------------------------------------------------

Explorer Dlls:
DLL Path        Company Name        File Description       
--------------------------------------------------
No changes Found                       

IE Dlls:
DLL Path        Company Name        File Description       
--------------------------------------------------
No changes Found                       

Loaded Drivers:
Driver File        Company Name        Description       
--------------------------------------------------

Monitored RegKeys
Registry Key        Value       
--------------------------------------------------

Kernel31 Api Log
       
--------------------------------------------------
***** Installing Hooks *****       
71a270df     RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\WinSock2\Parameters)       
71a27cc4     RegOpenKeyExA (Protocol_Catalog9)       
71a2737e     RegOpenKeyExA (000000F3)       
71a2724d     RegOpenKeyExA (Catalog_Entries)       
71a278ea     RegOpenKeyExA (000000000001)       
71a278ea     RegOpenKeyExA (000000000002)       
71a278ea     RegOpenKeyExA (000000000003)       
71a278ea     RegOpenKeyExA (000000000004)       
71a278ea     RegOpenKeyExA (000000000005)       
71a278ea     RegOpenKeyExA (000000000006)       
71a278ea     RegOpenKeyExA (000000000007)       
71a278ea     RegOpenKeyExA (000000000008)       
71a278ea     RegOpenKeyExA (000000000009)       
71a278ea     RegOpenKeyExA (000000000010)       
71a278ea     RegOpenKeyExA (000000000011)       
71a278ea     RegOpenKeyExA (000000000012)       
71a278ea     RegOpenKeyExA (000000000013)       
71a22623     WaitForSingleObject(7a4,0)       
71a283c6     RegOpenKeyExA (NameSpace_Catalog5)       
71a2737e     RegOpenKeyExA (00000004)       
71a27f5b     RegOpenKeyExA (Catalog_Entries)       
71a280ef     RegOpenKeyExA (000000000001)       
71a280ef     RegOpenKeyExA (000000000002)       
71a280ef     RegOpenKeyExA (000000000003)       
71a22623     WaitForSingleObject(798,0)       
71a11afa     RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\Winsock2\Parameters)       
71a11996     GlobalAlloc()       
7c80b689     ExitThread()       
40e358     LoadLibraryA(KERNEL32.DLL)=7c800000       
40e358     LoadLibraryA(advapi32.dll)=77da0000       
40e358     LoadLibraryA(gdi32.dll)=77ef0000       
40e358     LoadLibraryA(shlwapi.dll)=77f40000       
40e358     LoadLibraryA(user32.dll)=77d10000       
402078     RegOpenKeyExA (HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE)       
4025e4     RegOpenKeyExA (HKLM\SOFTWARE\KasperskyLab\AVP6\environment\)       
4021a4     CreateFileA(C:\Documents and Settings\Administrator\桌面\~Temp2308\~Temp2308.exe)       
4021cb     ReadFile()       
402217     ReadFile()       
402ae9     Copy(C:\Documents and Settings\Administrator\桌面\~Temp2308\~Temp2308.exe->C:\Program Files\Internet Explorer\romdrivers.bak)       
7c8283f4     WriteFile(h=7a8)       
401fce     CreateFileA(C:\Program Files\Internet Explorer\romdrivers.bkk)       
401ff4     WriteFile(h=7a8)       
402014     WriteFile(h=7a8)       
402433     GetVersionExA()       
402259     RegCreateKeyExA (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks,(null))       
402270     RegSetValueExA ({0CB68AD9-FF66-3E63-636B-B693E62F6236})       
402259     RegCreateKeyExA (HKCR\CLSID\{0CB68AD9-FF66-3E63-636B-B693E62F6236},(null))       
402270     RegSetValueExA ()       
402259     RegCreateKeyExA (HKCR\CLSID\{0CB68AD9-FF66-3E63-636B-B693E62F6236}\InProcServer32,(null))       
402270     RegSetValueExA (ThreadingModel)       
4015a7     ExitProcess()       
***** Injected Process Terminated *****       

DirwatchData
       
--------------------------------------------------
WatchDir Initilized OK       
Watching C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp       
Watching C:\windows       
Watching C:\Program Files       
Deteled: C:\Program Files\Internet Explorer\romdrivers.bak       
Created: C:\Program Files\Internet Explorer\romdrivers.bak       
Modifed: C:\Program Files\Internet Explorer\romdrivers.bak       
Modifed: C:\Program Files\Internet Explorer\romdrivers.bkk       
Modifed: C:\windows\system32\config\system.LOG       
Modifed: C:\Program Files\Internet Explorer       
Created: C:\windows\Prefetch\~TEMP2308.EXE-093A0C6A.pf       
Modifed: C:\windows\Prefetch\~TEMP2308.EXE-093A0C6A.pf       
Modifed: C:\windows\system32\wbem\Repository\FS\INDEX.MAP       
Modifed: C:\windows\system32\wbem\Repository\FS\OBJECTS.MAP       
Modifed: C:\windows\system32\wbem\Repository\FS\MAPPING1.MAP       
Modifed: C:\windows\system32\wbem\Repository\FS\MAPPING.VER       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET4F7D.tmp       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET6E.tmp       
Modifed: C:\windows\Prefetch\SNIFF_HIT.EXE-1AB02EA8.pf       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFEF31.tmp       
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFEF31.tmp       
Modifed: C:\windows\Prefetch\PROC_ANALYZER.EXE-3974E660.pf       
Deteled: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFEF31.tmp

伯夷叔齐

D:\病毒木马样本\~Temp2308.rar
  [0] Archive type: RAR
  --> ~Temp2308.tmp
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen

aoyang

[:27:] 费尔扫描米有反应鸟

wangjay1980

多多提供卡巴飘过的

欠妳緈諨

又是这个毒

david_sg

原帖由 solcroft 于 2007-5-27 23:47 发表
76961

恕我直言，只用杀软查来查去你根本学不到什么，还是学学自己脱壳吧。下面给你的工具你可以试用一下，它可以脱70多种壳。积累到一定程度就可以学着手动脱壳了。

sxingbai

这位靓女很眼生