[病毒样本] CMD

显示全部楼层 · 发表于 2011-5-3 20:44:12

CMD

http://camas.comodo.com/cgi-bin/submit?file=7618c19c6d9dd25dffbc2f41a6f64acfe7c8180af9edb5e5672954cf40bbe1a8

显示全部楼层 · 发表于 2011-5-3 20:52:24

IK杀红伞杀

显示全部楼层 · 发表于 2011-5-3 20:52:55

本帖最后由 594157544 于 2011-5-3 21:16 编辑

毒霸云鉴定为病毒

显示全部楼层 · 发表于 2011-5-3 20:53:37

病毒。

显示全部楼层 · 发表于 2011-5-3 20:54:16

回复 3楼 594157544 的帖子

完啦？

显示全部楼层 · 发表于 2011-5-3 20:57:06

本帖最后由 594157544 于 2011-5-3 20:57 编辑

回复 5楼 kurakimai 的帖子

没完咧。先占位

显示全部楼层 · 发表于 2011-5-3 20:57:52

回复 3楼 594157544 的帖子

哎

被鉴定出来了

显示全部楼层 · 发表于 2011-5-3 20:57:52

本帖最后由 594157544 于 2011-5-3 21:18 编辑

2011-05-03 20:55:15 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe加载库文件C:\WINDOWS\system32\imm32.dll C:\WINDOWS\system32\imm32.dll

2011-05-03 20:55:15 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe加载库文件C:\WINDOWS\system32\imm32.dll C:\WINDOWS\system32\imm32.dll

2011-05-03 20:55:15 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll

2011-05-03 20:55:15 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe加载库文件C:\WINDOWS\system32\sxs.dll C:\WINDOWS\system32\sxs.dll

2011-05-03 20:55:15 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\Plugins\arc\Rar.exe C:\Documents and Settings\CSIOSI\Local Settings\Temp\Plugins\arc\Rar.exe

2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\wcmzip32.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\wcmzip32.dll

2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe写文件C:\KSafeBox\A54A2EDA\Documents and Settings\CSIOSI\Local Settings\Temp\wcmzip32.dll C:\KSafeBox\A54A2EDA\Documents and Settings\CSIOSI\Local Settings\Temp\wcmzip32.dll

2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\Plugins\arc\RarReg.key C:\Documents and Settings\CSIOSI\Local Settings\Temp\Plugins\arc\RarReg.key

2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe加载库文件C:\WINDOWS\system32\apphelp.dll C:\WINDOWS\system32\apphelp.dll

2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe加载库文件C:\WINDOWS\system32\uxtheme.dll C:\WINDOWS\system32\uxtheme.dll

2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\kwsui.dll C:\Program Files\Common Files\Kingsoft\kiscommon\kwsui.dll

2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\kswebshield.dll C:\Program Files\Common Files\Kingsoft\kiscommon\kswebshield.dll

2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe加载库文件C:\WINDOWS\system32\MSCTF.dll C:\WINDOWS\system32\MSCTF.dll

2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe加载库文件C:\WINDOWS\system32\MSCTFIME.IME C:\WINDOWS\system32\MSCTFIME.IME

2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe发送消息C:\WINDOWS\explorer.exe C:\WINDOWS\explorer.exe

2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe发送消息C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\ctfmon.exe

2011-05-03 20:55:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe发送消息C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe

2011-05-03 20:55:17 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe发送消息C:\WINDOWS\explorer.exe C:\WINDOWS\explorer.exe

2011-05-03 20:55:17 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\ptcmd\ptcmd.exe发送消息C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\ctfmon.exe

显示全部楼层 · 发表于 2011-5-3 21:00:12

回复 8楼 kurakimai 的帖子

难道不想鉴定出来啊。还是我比你早

显示全部楼层 · 发表于 2011-5-3 21:00:53

回复 9楼 594157544 的帖子

我想的是这个结果

NOD32上报吧

[病毒样本] CMD

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块