X_CLEANER

显示全部楼层 · 发表于 2011-4-24 23:02:18

麻烦看看行为

谢谢

显示全部楼层 · 发表于 2011-4-24 23:07:22

坐等高人分析

显示全部楼层 · 发表于 2011-4-24 23:10:26

扫描开始时间: 2011年4月24日  23:07

正在启动文件扫描:

开始在“C:\Documents and Settings\Administrator\桌面\xclean_micro.rar”中扫描
C:\Documents and Settings\Administrator\桌面\xclean_micro.rar
  [0] 存档类型: RAR
--> xclean_micro.exe
   [检测]       是 TR/Lineage.649232 特洛伊木马
[注意]       文件已删除!

显示全部楼层 · 发表于 2011-4-24 23:11:07

2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\WINDOWS\system32\IMM32.DLL C:\WINDOWS\system32\IMM32.DLL
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\WINDOWS\system32\LPK.DLL C:\WINDOWS\system32\LPK.DLL
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\WINDOWS\system32\USP10.dll C:\WINDOWS\system32\USP10.dll
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe创建注册表键值HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\WINDOWS\system32\wsock32.dll C:\WINDOWS\system32\wsock32.dll
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\WINDOWS\system32\WS2_32.dll C:\WINDOWS\system32\WS2_32.dll
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\WINDOWS\system32\WS2HELP.dll C:\WINDOWS\system32\WS2HELP.dll
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\WINDOWS\system32\uxtheme.dll C:\WINDOWS\system32\uxtheme.dll
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe创建注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\0EF647F7\HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\0EF647F7\HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\kwsui.dll C:\Program Files\Common Files\Kingsoft\kiscommon\kwsui.dll
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\WINDOWS\system32\PSAPI.DLL C:\WINDOWS\system32\PSAPI.DLL
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\WINDOWS\system32\WINMM.dll C:\WINDOWS\system32\WINMM.dll
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\kswebshield.dll C:\Program Files\Common Files\Kingsoft\kiscommon\kswebshield.dll
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\WINDOWS\system32\MSCTF.dll C:\WINDOWS\system32\MSCTF.dll
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe加载库文件C:\WINDOWS\system32\msctfime.ime C:\WINDOWS\system32\msctfime.ime
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe创建注册表键值HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\0EF647F7\HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\0EF647F7\HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue
2011-04-24 23:08:11 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe发送消息C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe
2011-04-24 23:08:21 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe发送消息C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\EXPLORER.EXE
2011-04-24 23:08:21 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe发送消息C:\WINDOWS\System32\CTFMON.EXE C:\WINDOWS\System32\CTFMON.EXE
2011-04-24 23:08:37 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe发送消息C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe
2011-04-24 23:08:42 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe创建注册表键值HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue
2011-04-24 23:08:42 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\0EF647F7\HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\0EF647F7\HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue
2011-04-24 23:08:42 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\0EF647F7\HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\0EF647F7\HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue
2011-04-24 23:08:42 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe创建注册表键值HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue
2011-04-24 23:08:42 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\0EF647F7\HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\0EF647F7\HKEY_USERS\S-1-5-21-1645522239-1844237615-1177238915-500\Software\SpyRescue
2011-04-24 23:08:42 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe发送消息C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\EXPLORER.EXE
2011-04-24 23:08:42 C:\Documents and Settings\Administrator\桌面\xclean_micro.exe发送消息C:\WINDOWS\System32\CTFMON.EXE C:\WINDOWS\System32\CTFMON.EXE
2011-04-24 23:08:42 结束进程C:\Documents and Settings\Administrator\桌面\xclean_micro.exe C:\Documents and Settings\Administrator\桌面\xclean_micro.exe

显示全部楼层 · 发表于 2011-4-24 23:14:35

回复 4楼 tao791028154 的帖子

这是沙箱吧？？

显示全部楼层 · 发表于 2011-4-24 23:18:16

FVS: Malware
http://valkyrie.comodo.com/Resul ... me=xclean_micro.exe
To ESET.
http://samples.nod32.com.hk/inde ... 4796520ae485c61f52b

显示全部楼层 · 发表于 2011-4-24 23:23:45

已上报趋势～
未侦测到威胁～

显示全部楼层 · 发表于 2011-4-24 23:25:32

显示全部楼层 · 发表于 2011-4-24 23:29:35

瑞星KILL

显示全部楼层 · 发表于 2011-4-24 23:29:48

回复 8楼 fatezero 的帖子

看来又是一个FAKE AV??

是JAPAN的

[病毒样本] X_CLEANER

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块