CMD

中国网络警察

回复 8楼 594157544 的帖子

这乱的。我晕.排版。

3801187

BD miss,过金山卫士

594157544

回复 11楼 中国网络警察 的帖子

这个  好像再排都只那样啊

594157544

回复 10楼 kurakimai 的帖子

(⊙o⊙)嗯
http://samples.eset.com.cn/index ... 210ebf9413d6124067c

久远寺有珠

上报ESET

瓜皮猫

[/quote]
[quote]Dear 微亿毫,

Thank you for your submission.
The file(s) you submitted is/are clean and therefore not subject to detection.

Regards,

Dalibor Drzik
Malware Researcher
ESET spol. s r.o.

lf968

Created:      2011/5/3 21:41:46
Summary:      Program Guard: ptcmd.exe -> wcmzip32.dll
Description:  C:\Users\xxx\Desktop\ptcmd\ptcmd.exe wants to create executable file C:\Users\xxx\AppData\Local\Temp\wcmzip32.dll
Event type:   Suspicious file(13)
Event action: Blocked(3)

Created:      2011/5/3 21:41:56
Summary:      Program Guard: ptcmd.exe -> tcpsvcs.exe
Description:  C:\Users\xxx\Desktop\ptcmd\ptcmd.exe(6556) wants to start C:\Windows\system32\tcpsvcs.exe
Event type:   Program Guard(9)
Event action: Blocked(3)

还有很多

留侯

文件加了壳，大蜘蛛clean：
ptcmd.exe 已打包，方式： UPX
ptcmd.exe - 压缩文件 BINARYRES
ptcmd.exe/data003 - 压缩文件 BINARYRES
已上报！

lf968

补
Program Guard:  ptcmd.exe -> BoxedAppSDK.dll  ########  Blocked  C:\Users\xxx\Desktop\ptcmd\ptcmd.exe(6140)  wants to load  
:\{9019ACD6-BC11-4308-8C49-92E0601DF38D}\temp\6140\BoxedAppSDK.dll    Program Guard: ptcmd.exe  ########  Allowed  C:\Users\xxxx\Desktop\ptcmd\ptcmd.exe  -> C:\Users\xxxx\Desktop\ptcmd\ptcmd.exe              Program Guard: ptcmd.exe ->  tcpsvcs.exe  ########  Blocked  C:\Users\xxxx\Desktop\ptcmd\ptcmd.exe(1488)  wants to start C:\Windows\system32\tcpsvcs.exe            Program Guard: ptcmd.exe ->  wcmzip32.dll  ########  Blocked  C:\Users\xxxx\Desktop\ptcmd\ptcmd.exe  wants to create executable file C:\Users\xxxx\AppData\Local\Temp\wcmzip32.dll      Program Guard: ptcmd.exe  ########  Allowed  C:\Windows\explorer.exe ->  C:\Users\lf\Desktop\ptcmd\ptcmd.exe                       

沉默游侠

360压缩报木马