成功突破金山云安全的远控马

左手

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Programs
值: C:\Documents and Settings\Administrator\「开始」菜单\程序
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal
值: C:\Documents and Settings\Administrator\My Documents
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Favorites
值: C:\Documents and Settings\Administrator\Favorites
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup
值: C:\Documents and Settings\Administrator\「开始」菜单\程序\启动
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Recent
值: C:\Documents and Settings\Administrator\Recent
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\SendTo
值: C:\Documents and Settings\Administrator\SendTo
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Start Menu
值: C:\Documents and Settings\Administrator\「开始」菜单
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\My Music
值: C:\Documents and Settings\Administrator\My Documents\My Music
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\My Video
值:
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop
值: C:\Documents and Settings\Administrator\桌面
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\NetHood
值: C:\Documents and Settings\Administrator\NetHood
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Fonts
值: C:\WINDOWS\Fonts
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Templates
值: C:\Documents and Settings\Administrator\Templates
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Start Menu
值: C:\Documents and Settings\All Users\「开始」菜单
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Programs
值: C:\Documents and Settings\All Users\「开始」菜单\程序
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Startup
值: C:\Documents and Settings\All Users\「开始」菜单\程序\启动
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop
值: C:\Documents and Settings\All Users\桌面
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\PrintHood
值: C:\Documents and Settings\Administrator\PrintHood
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Local AppData
值: C:\Documents and Settings\Administrator\Local Settings\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Favorites
值: C:\Documents and Settings\All Users\Favorites
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: H:\Local Settings\Temporary Internet Files
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData
值: C:\Documents and Settings\All Users\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\My Pictures
值: C:\Documents and Settings\Administrator\My Documents\My Pictures
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Templates
值: C:\Documents and Settings\All Users\Templates
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Documents
值: C:\Documents and Settings\All Users\Documents
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Administrative Tools
值: C:\Documents and Settings\All Users\「开始」菜单\程序\管理工具
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Administrative Tools
值: C:\Documents and Settings\Administrator\「开始」菜单\程序\管理工具
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonMusic
值: C:\Documents and Settings\All Users\Documents\My Music
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonPictures
值: C:\Documents and Settings\All Users\Documents\My Pictures
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonVideo
值: C:\Documents and Settings\All Users\Documents\My Videos
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-02-10 23:46:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\测试.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CD Burning
值: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\CD Burning
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

ouwen31

北京时间 2011年2月10号 星期四 23点53分  还是扫不到

ouwen31

以下是多引擎查毒结果,大部份杀软都没有报

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.

File name: 测试.rar
Submission date: 2011-02-10 15:58:32 (UTC)
Current status: queued queued analysing finished


Result: 4/ 43 (9.3%)
VT Community

not reviewed
Safety score: -  

Compact Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.02.06.00 2011.02.06 -
AntiVir 7.11.3.39 2011.02.10 -
Antiy-AVL 2.0.3.7 2011.02.10 -
Avast 4.8.1351.0 2011.02.10 -
Avast5 5.0.677.0 2011.02.10 -
AVG 10.0.0.1190 2011.02.10 -
BitDefender 7.2 2011.02.10 -
CAT-QuickHeal 11.00 2011.02.10 -
ClamAV 0.96.4.0 2011.02.10 Suspect.Trojan.Generic.FD-4
Commtouch 5.2.11.5 2011.02.10 -
Comodo 7642 2011.02.10 -
DrWeb 5.0.2.03300 2011.02.10 -
Emsisoft 5.1.0.2 2011.02.10 Backdoor.Win32.Zegost!IK
eSafe 7.0.17.0 2011.02.09 -
eTrust-Vet 36.1.8151 2011.02.10 -
F-Prot 4.6.2.117 2011.02.04 -
F-Secure 9.0.16160.0 2011.02.10 -
Fortinet 4.2.254.0 2011.02.10 -
GData 21 2011.02.10 -
Ikarus T3.1.1.97.0 2011.02.10 Backdoor.Win32.Zegost
Jiangmin 13.0.900 2011.02.10 Trojan/PSW.OnLineGames.boqd
K7AntiVirus 9.83.3813 2011.02.10 -
Kaspersky 7.0.0.125 2011.02.10 -
McAfee 5.400.0.1158 2011.02.10 -
McAfee-GW-Edition 2010.1C 2011.02.08 -
Microsoft 1.6502 2011.02.10 -
NOD32 5862 2011.02.10 -
Norman 6.07.03 2011.02.10 -
nProtect 2011-01-27.01 2011.02.02 -
Panda 10.0.3.5 2011.02.10 -
PCTools 7.0.3.5 2011.02.10 -
Prevx 3.0 2011.02.10 -
Rising 23.44.03.05 2011.02.10 -
Sophos 4.61.0 2011.02.10 -
SUPERAntiSpyware 4.40.0.1006 2011.02.10 -
Symantec 20101.3.0.103 2011.02.10 -
TheHacker 6.7.0.1.126 2011.02.08 -
TrendMicro 9.200.0.1012 2011.02.10 -
TrendMicro-HouseCall 9.200.0.1012 2011.02.10 -
VBA32 3.12.14.3 2011.02.10 -
VIPRE 8370 2011.02.10 -
ViRobot 2011.2.10.4303 2011.02.10 -
VirusBuster 13.6.193.0 2011.02.10 -

Additional informationShow all  
MD5   : 18d5094f7662a0e161de8aa122412734
SHA1  : 826da1560464d60a75a7ae7b6b9e1010dda5548f
SHA256: 4a9926ebefe256011bede802ab7408ccc1e0a4258390c62b25ea9918fa1fbd29

1073328164

HITMAN KILL

小淘气

IK杀了、、

linshuo

回复 23楼 ouwen31 的帖子

VirSCAN.org Scanned Report :
Scanned time   : 2011/02/11 08:24:29 (CST)
Scanner results: 5%的杀软(2/37)报告发现病毒
File Name      : 测试.rar
File Size      : 112385 byte
File Type      : RAR archive data, v1d, os
MD5            : 18d5094f7662a0e161de8aa122412734
SHA1           : 826da1560464d60a75a7ae7b6b9e1010dda5548f
Online report  : http://virscan.org/report/368756061dce510744e8bf9110bf3798.html

Scanner        Engine Ver      Sig Ver           Sig Date    Time   Scan result
a-squared      5.1.0.2         20110209020254    2011-02-09  0.29   -
安博士V3       2011.02.11.00   2011.02.11        2011-02-11  1.45   -
AntiVir        8.2.4.166       7.11.3.40         2011-02-10  0.30   -
安天           2.0.18          2.0.18.           0002-18-00  0.02   -
Arcavir        2010            201102110633      2011-02-11  2.48   -
Authentium     5.1.1           201102101038      2011-02-10  1.83   -
AVAST!         4.7.4           110210-0          2011-02-10  0.00   -
AVG            8.5.850         271.1.1/3435      2011-02-11  0.30   -
BitDefender    7.90123.6680836 7.36173           2011-02-11  6.34   -
ClamAV         0.96.5          12660             2011-02-11  0.04   Suspect.Trojan.Generic.FD-4
Comodo         4.0             7645              2011-02-10  1.05   -
CP Secure      1.3.0.5         2011.02.11        2011-02-11  0.08   -
Dr.Web         5.0.2.3300      2011.02.11        2011-02-11  11.04  -
F-Prot         4.4.4.56        20110210          2011-02-10  1.75   -
F-Secure       7.02.73807      2011.02.10.05     2011-02-10  0.22   -
飞塔           4.2.254         12.881            2011-02-10  0.56   -
GData          21.1766/21.678  20110210          2011-02-10  10.39  -
ViRobot        20110210        2011.02.10        2011-02-10  0.38   -
Ikarus         T3.1.32.15.0    2011.02.10.77709  2011-02-10  4.78   Backdoor.Win32.Zegost
江民杀毒       13.0.900        2011.02.10        2011-02-10  1.91   -
卡巴斯基       5.5.10          2011.02.10        2011-02-10  0.17   -
金山毒霸       2009.2.5.15     2011.2.10.16      2011-02-10  1.66   -
迈克菲         5400.1158       6252              2011-02-09  7.27   -
Microsoft      1.6502          2011.02.10        2011-02-10  5.79   -
NOD32          3.0.21          5863              2011-02-10  0.02   -
Norman         6.06.12         6.06.00           2011-01-18  14.02  -
熊猫卫士       9.05.01         2011.02.10        2011-02-10  2.83   -
趋势科技       9.200-1012      7.828.17          2011-02-10  0.04   -
Quick Heal     11.00           2011.02.10        2011-02-10  0.99   -
瑞星           20.0            23.44.03.05       2011-02-10  0.30   -
Sophos         3.16.1          4.62              2011-02-11  3.09   -
Sunbelt        3.9.2474.2      8376              2011-02-10  0.60   -
赛门铁克       1.3.0.24        20110210.003      2011-02-10  0.06   -
nProtect       20110209.01     3138159           2011-02-09  5.69   -
The Hacker     6.7.0.1         v00126            2011-02-10  0.51   -
VBA32          3.12.14.3       20110210.1317     2011-02-10  4.02   -
VirusBuster    5.2.0.28        13.6.193.0/44700612011-02-10  0.00   -

顺便问一下啊，你的多核心杀毒的测试网址是哪一个，我这里用virscan.org的

xiaogujian

回复 1楼 695580825 的帖子

楼主，你这是针对金山做的病毒吧，这样有何意义？一个病毒杀不了有何奇怪？没人保证会有100的查杀率啊？！

蒙宝宝

360杀之，已上报毒霸。

cfans

附件是 自解压包，包内文件 1.exe 是大文件，100M，
毒霸对大文件的处理不太给力。。。

对压缩包提死特征 可查杀
但是最好的办法是查杀包里面的大文件。

634765216

我的NOD没报