绝对高品质病毒，你们自己查杀试试吧，另外欢迎hips党

02223289680

卡巴杀掉

a256886572008

只是单纯搞破坏而已，没有木马的行为

saga3721

a256886572008 发表于 2011-5-15 12:26
只是单纯搞破坏而已，没有木马的行为

没搞什么破坏吧？修改内存和出站是标准的木马行为啊

a256886572008

回复 13楼 saga3721 的帖子

把 %programfiles% 下面的档案感染了，不过有备份正常文件，去掉 exe 後缀名称

saga3721

a256886572008 发表于 2011-5-15 12:31
回复 13楼 saga3721 的帖子

把 %programfiles% 下面的档案感染了，不过有备份正常文件，去掉 exe 後缀名称 ...

也许不让它注入就没法感染了

liulangzhecgr

回复 1楼 Aar0N 的帖子

打击正在运行中的第3方exe文件！



Installation Report: 3
Generated by InCtrl5, version 1.0.0.0
Install program: E:\Downloads\3\3.exe
5-15-2011 12:11 PM
------------------------------------------------------------
Keys added: 3
-------------
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\PCIIDE\IDEChannel\4&7169472&0&0\DeviceDesc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\PCIIDE\IDEChannel\4&7169472&0&1\DeviceDesc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Hardware Profiles\0001\System\CurrentControlSet\Enum\PCI\
Keys deleted: 2
---------------
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\PCIIDE\IDEChannel\4&7169472&0&0\ConfigFl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\PCIIDE\IDEChannel\4&7169472&0&1\ConfigFl
Values added: 31
----------------

Files added: 6
--------------
c:\Program Files\Funshion Online\Funshion\Funshion
  Date: 11-1-2010 4:19 PM
  Size: 2,454,256 bytes
c:\Program Files\Funshion Online\Funshion\FunshionService
  Date: 11-1-2010 4:14 PM
  Size: 1,209,072 bytes
c:\Program Files\IObit\Advanced SystemCare 4\ASCTray
  Date: 4-21-2011 4:54 PM
  Size: 402,832 bytes
c:\Program Files\IObit\Advanced SystemCare 4\PMonitor
  Date: 4-21-2011 4:54 PM
  Size: 801,680 bytes
Files changed: 11
-----------------
c:\Documents and Settings\Administrator\funshion.ini
  Old date: 5-15-2011 12:05 PM
  New date: 5-15-2011 12:07 PM
  Old size: 3,262 bytes
  New size: 3,262 bytes
c:\Program Files\Funshion Online\Funshion\Funshion.exe
  Old date: 11-1-2010 4:19 PM
  New date: 5-15-2011 12:07 PM
  Old size: 2,454,256 bytes
  New size: 8,711,715 bytes
c:\Program Files\Funshion Online\Funshion\funshion.ini
  Old date: 5-15-2011 12:05 PM
  New date: 5-15-2011 12:10 PM
  Old size: 1,795 bytes
  New size: 1,794 bytes
c:\Program Files\Funshion Online\Funshion\FunshionService.exe
  Old date: 11-1-2010 4:14 PM
  New date: 5-15-2011 12:07 PM
  Old size: 1,209,072 bytes
  New size: 8,916,042 bytes
c:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe
  Old date: 4-21-2011 4:54 PM
  New date: 5-15-2011 12:07 PM
  Old size: 402,832 bytes
  New size: 4,426,144 bytes
c:\Program Files\IObit\Advanced SystemCare 4\PMonitor.exe
  Old date: 4-21-2011 4:54 PM
  New date: 5-15-2011 12:07 PM
  Old size: 801,680 bytes
  New size: 7,160,468 bytes
------------------------------------------------------------

xcffl

http://camas.comodo.com/cgi-bin/ ... ecc29c5a411b2d91d24

• File Info
Name        Value
Size        225280
MD5        69ba9f7a75272bf0b69c72e8142a53c7
SHA1        1f235cb8061f948f291a29cf79b9694471b2035c
SHA256        64622beb23dd410f02a4e562f94f7bb1cdcf7e6dfead1ecc29c5a411b2d91d24
Process        Active
• Keys Created
• Keys Changed
• Keys Deleted
• Values Created
• Values Changed
• Values Deleted
• Directories Created
• Directories Changed
• Directories Deleted
• Files Created
• Files Changed
• Files Deleted
• Directories Hidden
• Files Hidden
• Drivers Loaded
• Drivers Unloaded
• Processes Created
• Processes Terminated
• Threads Created
PId        Process Name        TId        Start        Start Mem        Win32 Start        Win32 Start Mem
0x348        svchost.exe        0x784        0x7c810856        MEM_IMAGE        0x7c910760        MEM_IMAGE
0x420        svchost.exe        0xfc        0x7c810856        MEM_IMAGE        0x77df9981        MEM_IMAGE
• Modules Loaded
• Windows Api Calls
• DNS Queries
DNS Query Text
ns.dns3-domain.com IN A +
• HTTP Queries
• Verdict
Auto Analysis Verdict
Undetected
• Events Created or Opened
PId        Image Name        Address        Event Name
0xd8        C:\TEST\sample.exe        0x40c43e        {AB8D393B-9177-440d-B3F8-1C1FE0CF9692}
0xd8        C:\TEST\sample.exe        0x40d81c        {A37340FD-F043-41e3-9C16-2F2632387199}
0xd8        C:\TEST\sample.exe        0x40da48        {83D33F3A-9482-446f-ABFF-7B69D58C1634}

mxf147

TO 金山

XMonster

Aar0N 发表于 2011-5-15 11:52
绝对高品质病毒，不信试试
如下，password:kafan

arsh

FS 清除