灰鸽子变种一个（修改特征码，看能坚持几天） 请大家双击而不仅只是下载！

arsh

解压运行被F-secure清除

wmcxdb

2011-5-15 09:53:08    创建文件    阻止
进程: f:\program files\空城计新编\空城计新编.exe
目标: C:\WINDOWS\Hacker.com.cn.exe
规则: [应用程序组]cx★(禁) -> [文件组]文件保护 -> [文件]c:\windows

2011-5-15 09:53:09    安装驱动程序或服务    阻止
进程: f:\program files\空城计新编\空城计新编.exe
目标: GrayPigeon_Hacker.com.cn
文件路径: C:\WINDOWS\Hacker.com.cn.exe
规则: [应用程序]*

sfsren

fatezero

jason_jiang 发表于 2011-5-15 09:06
PCA miss

这不给力啊

hddu

2011-05-15 10:42:03    创建文件      操作:允许
进程路径:F:\virus\空城计新编\空城计新编.exe
文件路径:C:\WINDOWS\Hacker.com.cn.exe
触发规则:所有程序规则->WINDOWS文件设置->%windir%\*.exe

2011-05-15 10:42:03    修改文件      操作:阻止
进程路径:F:\virus\空城计新编\空城计新编.exe
文件路径:(隐藏文件)C:\WINDOWS\Hacker.com.cn.exe
触发规则:所有程序规则->WINDOWS文件设置->%windir%\*.exe

2011-05-15 10:42:04    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\services.exe
文件路径:C:\WINDOWS\Hacker.com.cn.exe
触发规则:应用程序规则->系统程序->%windir%\system32\services.exe->%windir%\*.exe

2011-05-15 10:42:05    创建文件      操作:允许
进程路径:F:\virus\空城计新编\空城计新编.exe
文件路径:C:\WINDOWS\uninstal.bat
触发规则:所有程序规则->WINDOWS文件设置->%windir%\*.bat

2011-05-15 10:42:06    运行应用程序      操作:允许
进程路径:F:\virus\空城计新编\空城计新编.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c C:\WINDOWS\uninstal.bat
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe

2011-05-15 10:42:07    访问物理内存      操作:阻止
进程路径:C:\WINDOWS\Hacker.com.cn.exe
物理内存:\Device\PhysicalMemory
触发规则:所有程序规则->*

2011-05-15 10:42:07    访问物理内存      操作:阻止
进程路径:C:\WINDOWS\Hacker.com.cn.exe
物理内存:\Device\PhysicalMemory
触发规则:所有程序规则->*

2011-05-15 10:42:07    访问物理内存      操作:阻止
进程路径:C:\WINDOWS\Hacker.com.cn.exe
物理内存:\Device\PhysicalMemory
触发规则:所有程序规则->*

2011-05-15 10:42:07    删除文件      操作:允许
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\WINDOWS\uninstal.bat
触发规则:应用程序规则->CMD设置->%windir%\system32\cmd.exe->*\*.bat

hddu

2011-05-15 10:51:07    创建文件      操作:允许
进程路径:F:\virus\空城计新编\空城计新编.exe
文件路径:C:\WINDOWS\Hacker.com.cn.exe
触发规则:所有程序规则->WINDOWS文件设置->%windir%\*.exe


2011-05-15 10:51:07    修改文件      操作:阻止
进程路径:F:\virus\空城计新编\空城计新编.exe
文件路径:(隐藏文件)C:\WINDOWS\Hacker.com.cn.exe
触发规则:所有程序规则->WINDOWS文件设置->%windir%\*.exe


2011-05-15 10:51:12    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\services.exe
文件路径:C:\WINDOWS\Hacker.com.cn.exe
触发规则:应用程序规则->系统程序->%windir%\system32\services.exe->*\*.exe


2011-05-15 10:51:12    创建文件      操作:允许
进程路径:F:\virus\空城计新编\空城计新编.exe
文件路径:C:\WINDOWS\uninstal.bat
触发规则:所有程序规则->WINDOWS文件设置->%windir%\*.bat


2011-05-15 10:51:12    运行应用程序      操作:允许
进程路径:F:\virus\空城计新编\空城计新编.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c C:\WINDOWS\uninstal.bat
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2011-05-15 10:51:13    删除文件      操作:允许
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\WINDOWS\uninstal.bat
触发规则:应用程序规则->CMD设置->%windir%\system32\cmd.exe->*\*.bat

3801187

BitDefender 2011

此网页已被BitDefender反病毒实时防护拦截！

被BitDefender拦截的网页包含（可能）已被病毒感染的对象。您的系统未被 感染

liulangzhecgr

--------------------------------
Installation Report: 空城计新编
Generated by InCtrl5, version 1.0.0.0
Install program: E:\Downloads\空城计新编\空城计新编.exe
5-15-2011 11:09 AM
------------------------------------------------------------
Keys added: 15
--------------
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\PCIIDE\IDEChannel\4&7169472&0&0\Capabilities
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\PCIIDE\IDEChannel\4&7169472&0&1\Capabilities
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Hardware Profiles\0001\System\CurrentControlSet\Enum\PCI\
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn\Security
Values added: 65
----------------
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache "E:\Downloads\空城计新编\空城计新编.exe"
  Type: REG_SZ
  Data: 空城计新编
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN "NextInstance"
  Type: REG_DWORD
  Data: 01, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000 "Class"
  Type: REG_SZ
  Data: LegacyDriver
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000 "ClassGUID"
  Type: REG_SZ
  Data: {8ECC055D-047F-11D1-A537-0000F8753ED1}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000 "ConfigFlags"
  Type: REG_DWORD
  Data: 00, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000 "DeviceDesc"
  Type: REG_SZ
  Data: GrayPigeon_Hacker.com.cn
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000 "Legacy"
  Type: REG_DWORD
  Data: 01, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000 "Service"
  Type: REG_SZ
  Data: GrayPigeon_Hacker.com.cn
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000\Control "*NewlyCreated*"
  Type: REG_DWORD
  Data: 00, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000\Control "ActiveService"
  Type: REG_SZ
  Data: GrayPigeon_Hacker.com.cn
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn "Description"
  Type: REG_SZ
  Data: 灰鸽子服务端程序。远程监控管理.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn "DisplayName"
  Type: REG_SZ
  Data: GrayPigeon_Hacker.com.cn
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn "ErrorControl"
  Type: REG_DWORD
  Data: 00, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn "ImagePath"
  Type: REG_EXPAND_SZ
  Data: C:\WINDOWS\Hacker.com.cn.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn "ObjectName"
  Type: REG_SZ
  Data: LocalSystem
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn "Start"
  Type: REG_DWORD
  Data: 02, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn "Type"
  Type: REG_DWORD
  Data: 10, 01, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn\Enum "0"
  Type: REG_SZ
  Data: Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn\Enum "Count"
  Type: REG_DWORD
  Data: 01, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn\Enum "NextInstance"
  Type: REG_DWORD
  Data: 01, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn\Security "Security"
  Type: REG_BINARY
  Data: 01, 00, 14, 80, 90, 00, 00, 00, 9C, 00, 00, 00, 14, 00, 00, 00, 30, 00, 00, 00, 02, 00, 1C, 00, 01, 00, 00, 00, 02, 80, 14, 00, FF, 01, 0F, 00, 01, 01, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 02, 00, 60, 00, 04, 00, 00, 00, 00, 00, 14, 00, FD, 01, 02, 00, 01, 01, 00, 00, 00, 00, 00, 05, 12, 00, 00, 00, 00, 00, 18, 00, FF, 01, 0F, 00, 01, 02, 00, 00, 00, 00, 00, 05, 20, 00, 00, 00, 20, 02, 00, 00, 00, 00, 14, 00, 8D, 01, 02, 00, 01, 01, 00, 00, 00, 00, 00, 05, 0B, 00, 00, 00, 00, 00, 18, 00, FD, 01, 02, 00, 01, 02, 00, 00, 00, 00, 00, 05, 20, 00, 00, 00, 23, 02, 00, 00, 01, 01, 00, 00, 00, 00, 00, 05, 12, 00, 00, 00, 01, 01, 00, 00, 00, 00, 00, 05, 12, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN "NextInstance"
  Type: REG_DWORD
  Data: 01, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000 "Class"
  Type: REG_SZ
  Data: LegacyDriver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000 "ClassGUID"
  Type: REG_SZ
  Data: {8ECC055D-047F-11D1-A537-0000F8753ED1}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000 "ConfigFlags"
  Type: REG_DWORD
  Data: 00, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000 "DeviceDesc"
  Type: REG_SZ
  Data: GrayPigeon_Hacker.com.cn
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000 "Legacy"
  Type: REG_DWORD
  Data: 01, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000 "Service"
  Type: REG_SZ
  Data: GrayPigeon_Hacker.com.cn
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000\Control "*NewlyCreated*"
  Type: REG_DWORD
  Data: 00, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000\Control "ActiveService"
  Type: REG_SZ
  Data: GrayPigeon_Hacker.com.cn
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn "Description"
  Type: REG_SZ
  Data: 灰鸽子服务端程序。远程监控管理.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn "DisplayName"
  Type: REG_SZ
  Data: GrayPigeon_Hacker.com.cn
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn "ErrorControl"
  Type: REG_DWORD
  Data: 00, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn "ImagePath"
  Type: REG_EXPAND_SZ
  Data: C:\WINDOWS\Hacker.com.cn.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn "ObjectName"
  Type: REG_SZ
  Data: LocalSystem
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn "Start"
  Type: REG_DWORD
  Data: 02, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn "Type"
  Type: REG_DWORD
  Data: 10, 01, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn\Enum "0"
  Type: REG_SZ
  Data: Root\LEGACY_GRAYPIGEON_HACKER.COM.CN\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn\Enum "Count"
  Type: REG_DWORD
  Data: 01, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn\Enum "NextInstance"
  Type: REG_DWORD
  Data: 01, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeon_Hacker.com.cn\Security "Security"
  Type: REG_BINARY
  Data: 01, 00, 14, 80, 90, 00, 00, 00, 9C, 00, 00, 00, 14, 00, 00, 00, 30, 00, 00, 00, 02, 00, 1C, 00, 01, 00, 00, 00, 02, 80, 14, 00, FF, 01, 0F, 00, 01, 01, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 02, 00, 60, 00, 04, 00, 00, 00, 00, 00, 14, 00, FD, 01, 02, 00, 01, 01, 00, 00, 00, 00, 00, 05, 12, 00, 00, 00, 00, 00, 18, 00, FF, 01, 0F, 00, 01, 02, 00, 00, 00, 00, 00, 05, 20, 00, 00, 00, 20, 02, 00, 00, 00, 00, 14, 00, 8D, 01, 02, 00, 01, 01, 00, 00, 00, 00, 00, 05, 0B, 00, 00, 00, 00, 00, 18, 00, FD, 01, 02, 00, 01, 02, 00, 00, 00, 00, 00, 05, 20, 00, 00, 00, 23, 02, 00, 00, 01, 01, 00, 00, 00, 00, 00, 05, 12, 00, 00, 00, 01, 01, 00, 00, 00, 00, 00, 05, 12, 00, 00, 00
------------------------------------------------------------
Files added: 1
--------------
c:\WINDOWS\Hacker.com.cn.exe
  Date: 5-15-2011 8:15 AM
  Size: 302,592 bytes
Files deleted: 1
----------------
e:\Downloads\空城计新编\空城计新编.exe
  Date: 5-15-2011 8:15 AM
  Size: 302,592 bytes

hj5abc

jason_jiang 发表于 2011-5-15 09:06
PCA miss

miss

Panda 10.0.3.5 2011.05.14 Bck/Hupigon.LHH

yusup

斗牛犬oK。