UPDATE VIRUS 31楼更新

显示全部楼层 · 发表于 2011-5-8 17:55:49

2011-05-08 17:52:58 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\WINDOWS\system32\msvbvm60.dll C:\WINDOWS\system32\msvbvm60.dll
2011-05-08 17:52:58 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\WINDOWS\system32\msvbvm60.dll C:\WINDOWS\system32\msvbvm60.dll
2011-05-08 17:52:58 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\WINDOWS\system32\imm32.dll C:\WINDOWS\system32\imm32.dll
2011-05-08 17:52:58 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll
2011-05-08 17:52:58 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\WINDOWS\system32\uxtheme.dll C:\WINDOWS\system32\uxtheme.dll
2011-05-08 17:52:58 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\Program Files\KSafe\ksfmon.dll C:\Program Files\KSafe\ksfmon.dll
2011-05-08 17:52:58 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\kwsui.dll C:\Program Files\Common Files\Kingsoft\kiscommon\kwsui.dll
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\kswebshield.dll C:\Program Files\Common Files\Kingsoft\kiscommon\kswebshield.dll
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe创建注册表键值HKEY_USERS\S-1-5-21-1935655697-1326574676-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-1935655697-1326574676-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\WINDOWS\system32\MSCTF.dll C:\WINDOWS\system32\MSCTF.dll
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\WINDOWS\system32\sxs.dll C:\WINDOWS\system32\sxs.dll
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\WINDOWS\system32\MSCTFIME.IME C:\WINDOWS\system32\MSCTFIME.IME
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe发送消息C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe发送消息C:\WINDOWS\explorer.exe C:\WINDOWS\explorer.exe
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe发送消息C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\ctfmon.exe
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\WINDOWS\system32\rsaenh.dll C:\WINDOWS\system32\rsaenh.dll
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\WINDOWS\system32\netapi32.dll C:\WINDOWS\system32\netapi32.dll
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe写文件C:\KSafeBox\18BD7448\WINDOWS\Debug\UserMode\userenv.log C:\KSafeBox\18BD7448\WINDOWS\Debug\UserMode\userenv.log
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe创建注册表键值HKEY_USERS\S-1-5-21-1935655697-1326574676-1801674531-1003\Software\Microsoft\Windows NT\CurrentVersion\Winlogon HKEY_USERS\S-1-5-21-1935655697-1326574676-1801674531-1003\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\WINDOWS\system32\crypt32.dll C:\WINDOWS\system32\crypt32.dll
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe加载库文件C:\WINDOWS\system32\msasn1.dll C:\WINDOWS\system32\msasn1.dll
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe写文件C:\KSafeBox\18BD7448\WINDOWS\Debug\UserMode\userenv.log C:\KSafeBox\18BD7448\WINDOWS\Debug\UserMode\userenv.log
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe创建注册表键值HKEY_USERS\S-1-5-21-1935655697-1326574676-1801674531-1003\Software\Microsoft\Windows NT\CurrentVersion\Winlogon HKEY_USERS\S-1-5-21-1935655697-1326574676-1801674531-1003\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe创建文件C:\Documents and Settings\xcffl\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1935655697-1326574676-1801674531-1003\88603cb2913a7df3fbd16b5f958e6447_314d3eb0-d5a5-468f-b385-aff47fa023cc C:\Documents and Settings\xcffl\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1935655697-1326574676-1801674531-1003\88603cb2913a7df3fbd16b5f958e6447_314d3eb0-d5a5-468f-b385-aff47fa023cc
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe写文件C:\KSafeBox\18BD7448\Documents and Settings\xcffl\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1935655697-1326574676-1801674531-1003\88603cb2913a7df3fbd16b5f958e6447_314d3eb0-d5a5-468f-b385-aff47fa023cc C:\KSafeBox\18BD7448\Documents and Settings\xcffl\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1935655697-1326574676-1801674531-1003\88603cb2913a7df3fbd16b5f958e6447_314d3eb0-d5a5-468f-b385-aff47fa023cc
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe写文件C:\KSafeBox\18BD7448\WINDOWS\Debug\UserMode\userenv.log C:\KSafeBox\18BD7448\WINDOWS\Debug\UserMode\userenv.log
2011-05-08 17:52:59 C:\Documents and Settings\xcffl\桌面\update.exe创建注册表键值HKEY_USERS\S-1-5-21-1935655697-1326574676-1801674531-1003\Software\Microsoft\Windows NT\CurrentVersion\Winlogon HKEY_USERS\S-1-5-21-1935655697-1326574676-1801674531-1003\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
2011-05-08 17:53:00 C:\Documents and Settings\xcffl\桌面\update.exe发送消息C:\WINDOWS\explorer.exe C:\WINDOWS\explorer.exe
2011-05-08 17:53:00 C:\Documents and Settings\xcffl\桌面\update.exe发送消息C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\ctfmon.exe
貌似没事

显示全部楼层 · 发表于 2011-5-8 18:09:31

回复 11楼 xcffl 的帖子

不是吧

显示全部楼层 · 发表于 2011-5-8 18:20:10

过大蜘蛛，已上报！

显示全部楼层 · 发表于 2011-5-8 21:09:38

360

update.rar=>update.exe 木马(Win32/Trojan.Generic.921) 已删除

显示全部楼层 · 发表于 2011-5-8 21:30:11

360网盾直接提示病毒
360SD KILL ，KILL的好轻松~~~

显示全部楼层 · 发表于 2011-5-8 21:53:33

UPDATE

显示全部楼层 · 发表于 2011-5-8 22:34:41

16L，大蜘蛛：
update.exe - infected with Trojan.Inject.38179

显示全部楼层 · 发表于 2011-5-8 22:45:22

16L
360 SD Kill

显示全部楼层 · 发表于 2011-5-8 23:21:27

本帖最后由 594157544 于 2011-5-8 23:22 编辑

过 NOD32 毒霸

C:\Documents and Settings\CSIOSI\桌面\试验文件夹\update\update.exe - 正常

显示全部楼层 · 发表于 2011-5-8 23:23:35

回复 19楼 594157544 的帖子

看看DUBA的结果

[病毒样本] UPDATE VIRUS 31楼更新

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块