装机必备--一键清理.exe

显示全部楼层 · 发表于 2011-3-29 22:21:31

本帖最后由 52kafan 于 2011-3-30 20:34 编辑

由于经常帮朋友装机，但是网上下载的ghost版xp系统常常有修改，所以经常有清理系统。

在此做个小结：

第一步、装机后扫描：金山在线杀毒

第二步、扫描后补丁：金山卫士 / 瑞星卡卡

第三步、系统垃圾清理：见附件

重新上传

显示全部楼层 · 发表于 2011-3-30 03:57:47

沙发,坐得舒服

显示全部楼层 · 发表于 2011-3-30 11:24:15

本帖最后由小v可于 2011-3-30 11:29 编辑

卡巴斯基报橘色诱惑病毒~~ Trojan win32 Chifrax.a
会在C盘生成 sample.exe sample疑似病毒
? File Info
Name       Value
Size       919554
MD5       6d4dd7b89c580c0517dd7555952b9a8c
SHA1       cd9b4f2797c29225987fb9dd344f0d5e9be5533c
SHA256       399405072199e46cb508d5f57e9ceb20a0353760a24b55d28ea86cf2d91c9ca0
Process       Exited
? Keys Created
? Keys Changed
? Keys Deleted
? Values Created
? Values Changed
? Values Deleted
? Directories Created
Name       Last Write Time       Creation Time       Last Access Time       Attr
C:\Documents and Settings\Administrator       2009.01.09 10:54:24.484       2009.01.09 10:54:24.468       2009.01.09 10:54:24.484       0x10
C:\Documents and Settings\Administrator\Application Data       2009.01.09 10:54:24.484       2009.01.09 10:54:24.484       2009.01.09 10:54:24.484       0x10
C:\Documents and Settings\Administrator\Application Data\~       2009.01.09 10:54:24.812       2009.01.09 10:54:24.484       2009.01.09 10:54:24.812       0x10
? Directories Changed
? Directories Deleted
? Files Created
Name       Size       Last Write Time       Creation Time       Last Access Time       Attr
C:\Documents and Settings\Administrator\Application Data\~\CCleaner.exe       2187064       2011.01.25 22:32:28.000       2009.01.09 10:54:24.515       2009.01.09 10:54:24.515       0x20
C:\Documents and Settings\Administrator\Application Data\~\清除系统垃圾.bat       3881       2011.03.29 19:21:47.859       2009.01.09 10:54:24.796       2009.01.09 10:54:24.796       0x20
? Files Changed
? Files Deleted
? Directories Hidden
? Files Hidden
? Drivers Loaded
? Drivers Unloaded
? Processes Created
? Processes Terminated
? Threads Created
PId       Process Name       TId       Start       Start Mem       Win32 Start       Win32 Start Mem
0x348       svchost.exe       0x784       0x7c810856       MEM_IMAGE       0x7c910760       MEM_IMAGE
0x3e8       svchost.exe       0xdc       0x7c810856       MEM_IMAGE       0x77e76bf0       MEM_IMAGE
? Modules Loaded
? Windows Api Calls
? DNS Queries
? HTTP Queries
? Verdict
Auto Analysis Verdict
Undetected
? Mutexes Created or Opened
PId       Image Name       Address       Mutex Name
0xd8       C:\TEST\sample.exe       0x7c81a838       ShimCacheMutex
? Events Created or Opened
PId       Image Name       Address       Event Name
0xd8       C:\TEST\sample.exe       0x77a89422       Global\crypt32LogoffEvent

以上是毛豆沙盘分析记录未发现可疑但是其生成物sample.exe疑似病毒

显示全部楼层 · 发表于 2011-3-30 13:05:54

晕属于误报

显示全部楼层 · 发表于 2011-3-30 13:07:49

谢谢楼主分享

显示全部楼层 · 发表于 2011-3-30 13:14:31

红伞有报,小A无报

显示全部楼层 · 发表于 2011-3-30 16:20:45

360报

显示全部楼层 · 发表于 2011-3-30 16:56:50

本帖最后由 52kafan 于 2011-3-30 20:43 编辑

回复 7楼梦想起航的帖子

VirSCAN.org Scanned Report :
Scanned time : 2011/03/30 16:52:02 (CST)
Scanner results: 51%的杀软(19/37)报告发现病毒
File Name    : 一键清理.exe
File Size    : 919554 byte
File Type    : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5          : 6d4dd7b89c580c0517dd7555952b9a8c
SHA1          : cd9b4f2797c29225987fb9dd344f0d5e9be5533c
Online report  : http://virscan.org/report/38914b1b543e396084db963e2a918665.html

Scanner       Engine Ver    Sig Ver          Sig Date Time Scan result
a-squared    5.1.0.2       20110330143031 2011-03-30  5.72 Trojan.Win32.Chifrax!IK
安博士V3    2011.03.30.04 2011.03.30       2011-03-30  2.38 -
AntiVir       8.2.4.192    7.11.5.119       2011-03-30  0.30 TR/Dropper.Gen
安天          2.0.18       20110205.7694535  2011-02-05  0.02 -
Arcavir       2010          201103240801    2011-03-24  0.01 -
Authentium    5.1.1          201103300405    2011-03-30  1.58 W32/Trojan2.HFLA (Exact)
AVAST!       4.7.4          110329-1       2011-03-29  0.24 -
AVG          8.5.850       271.1.1/3516    2011-03-19  0.32 Generic15.BOOD
BitDefender 7.90123.7027546 7.36862          2011-03-30  7.18 -
ClamAV       0.96.5       12922          2011-03-29  0.12 Trojan.Agent-130721
Comodo       4.0          8149             2011-03-29  1.24 TrojWare.Win32.Chifrax.~E
CP Secure    1.3.0.5       2011.03.29       2011-03-29  0.11 -
Dr.Web       5.0.2.3300    2011.03.30       2011-03-30  12.89  -
F-Prot       4.4.4.56       20110329       2011-03-29  1.48 W32/Trojan2.HFLA (exact)
F-Secure    7.02.73807    2011.03.30.03    2011-03-30  0.23 Trojan.Win32.Chifrax.a [AVP]
飞塔          4.2.254       13.60          2011-03-29  0.44 W32/PatchedRarSfx
GData       21.2170/21.777  20110330       2011-03-30  9.87 Trojan.Win32.Chifrax.a [Engine:A]
ViRobot    20110329       2011.03.29       2011-03-29  0.44 -
Ikarus       T3.1.32.20.0 2011.03.30.78054  2011-03-30  5.63 Trojan.Win32.Chifrax
江民杀毒    13.0.900       2011.03.29       2011-03-29  1.46 -
卡巴斯基    5.5.10       2011.03.30       2011-03-30  0.09 Trojan.Win32.Chifrax.a
金山毒霸    2009.2.5.15    2011.3.30.14    2011-03-30  0.87 Win32.Troj.TrsRarSfxT.c.183296
迈克菲       5400.1158    6300             2011-03-29  8.28 Patched-RarSFX
Microsoft    1.6702       2011.03.30       2011-03-30  4.76 -
NOD32       3.0.21       5994             2011-03-28  1.37 -
Norman       6.07.03       6.07.00          2011-03-28  28.07  -
熊猫卫士    9.05.01       2011.03.29       2011-03-29  3.22   Trj/Chifrax.A
趋势科技    9.200-1012    7.940.03       2011-03-29  0.04 Mal_Chifrx1
Quick Heal    11.00          2011.03.30       2011-03-30  1.55 -
瑞星          20.0          23.51.02.03    2011-03-30  2.41 -
Sophos       3.17.1       4.63             2011-03-30  3.57 Mal/Dropper-AE
Sunbelt       3.9.2486.2    8864             2011-03-29  3.02 Trojan.Win32.Chifrax.a (v)
赛门铁克    1.3.0.24       20110329.005    2011-03-29  1.30 -
nProtect    20110330.01    3287087          2011-03-30  15.99  -
The Hacker    6.7.0.1       v00161          2011-03-29  1.88 -
VBA32       3.12.14.3    20110329.2000    2011-03-29  3.57   Trojan.Win32.Chifrax.a
VirusBuster 5.2.0.28       13.6.276.0/48638432011-03-29  0.00 -

显示全部楼层 · 发表于 2011-3-30 17:15:25

本帖最后由 52kafan 于 2011-3-30 17:16 编辑

COMODO 在线分析结果
http://camas.comodo.com/cgi-bin/submit?file=399405072199e46cb508d5f57e9ceb20a0353760a24b55d28ea86cf2d91c9ca0

• File Info
Name Value
Size 919554
MD5 6d4dd7b89c580c0517dd7555952b9a8c
SHA1 cd9b4f2797c29225987fb9dd344f0d5e9be5533c
SHA256 399405072199e46cb508d5f57e9ceb20a0353760a24b55d28ea86cf2d91c9ca0
Process Exited

• Keys Created
• Keys Changed
• Keys Deleted
• Values Created
• Values Changed
• Values Deleted
• Directories Created
Name Last Write Time Creation Time Last Access Time Attr
C:\Documents and Settings\Administrator 2009.01.09 10:54:24.484 2009.01.09 10:54:24.468 2009.01.09 10:54:24.484 0x10
C:\Documents and Settings\Administrator\Application Data 2009.01.09 10:54:24.484 2009.01.09 10:54:24.484 2009.01.09 10:54:24.484 0x10
C:\Documents and Settings\Administrator\Application Data\~ 2009.01.09 10:54:24.812 2009.01.09 10:54:24.484 2009.01.09 10:54:24.812 0x10

• Directories Changed
• Directories Deleted
• Files Created
Name Size Last Write Time Creation Time Last Access Time Attr
C:\Documents and Settings\Administrator\Application Data\~\CCleaner.exe 2187064 2011.01.25 22:32:28.000 2009.01.09 10:54:24.515 2009.01.09 10:54:24.515 0x20
C:\Documents and Settings\Administrator\Application Data\~\清除系统垃圾.bat 3881 2011.03.29 19:21:47.859 2009.01.09 10:54:24.796 2009.01.09 10:54:24.796 0x20

• Files Changed
• Files Deleted
• Directories Hidden
• Files Hidden
• Drivers Loaded
• Drivers Unloaded
• Processes Created
• Processes Terminated
• Threads Created
PId Process Name TId Start Start Mem Win32 Start Win32 Start Mem
0x348 svchost.exe 0x784 0x7c810856 MEM_IMAGE 0x7c910760 MEM_IMAGE
0x3e8 svchost.exe 0xdc 0x7c810856 MEM_IMAGE 0x77e76bf0 MEM_IMAGE

• Modules Loaded
• Windows Api Calls
• DNS Queries
• HTTP Queries
• Verdict
Auto Analysis Verdict
Undetected

• Mutexes Created or Opened
PId Image Name Address Mutex Name
0xd8 C:\TEST\sample.exe 0x7c81a838 ShimCacheMutex

• Events Created or Opened
PId Image Name Address Event Name
0xd8 C:\TEST\sample.exe 0x77a89422 Global\crypt32LogoffEvent

显示全部楼层 · 发表于 2011-4-4 22:00:03

360网盾第一个安全性未知，第二个安全

[软件分享] 装机必备--一键清理.exe