中华网络安全联盟    作者：mopery    来源：卡卡社区    时间：2006-9-20

终于测完了...不过大家别吓倒了..超级BT下载器..

我测了一半 测到最后一包就没办法了..直接死机 tiny 的记录没了..只能根据SSM 的报告得出一些病毒文件..

update.exe 访问:218.91.157.150:80
update~.exe
释放
C:\WINDOWS\cnt.exe
C:\Documents and Settings\mopery\Local Settings\Temporary Internet Files\Content.IE5

\S5EF8DUV\19790205[1].exe
C:\WINDOWS\ef26ev.dll
C:\WINDOWS\system32\downews.ini
C:\WINDOWS\system32\iScreensaver.dll
注册表
HKCR\CLSID\{1F80EA54-211C-4A3A-9C4E-C3F19D589079}
HKCR\iScreensaver.ComBho

C:\WINDOWS\Setup2.exe
释放
C:\WINDOWS\inf\cpap.ini
C:\WINDOWS\system32\HttpReq.dll
C:\WINDOWS\system32\WEBDLL.DLL
C:\WINDOWS\system32\rundll32.dll
注册表
HKCR\CLSID\{77962960-536E-47EC-9DDB-52651519705F}
HKCR\Cpap.CpapView
HKCR\Cpap.CpapView.1
HKCR\Cpap.CpapView.1\CLSID
HKCR\Cpap.CpapView\CurVer
HKCR\Interface\{11955EDD-967E-41B8-B668-45FD97A7FD91}
HKCR\TypeLib\{57504324-CC47-4B92-BA22-87A523E4559F}\1.0
HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher

C:\WINDOWS\bind_40094.exe
访问:
222.185.252.148:80 58.211.7.36:80 58.211.7.59:80 222.185.243.61:80
222.185.252.148:80 58.211.7.36:80 58.211.7.59:80 222.185.243.61:80
图:

注册表
HKLM\SOFTWARE\Lamp

C:\WINDOWS\101371.exe 访问:61.183.15.136:80
C:\WINDOWS\Temp\mssoak.exe 访问:61.135.170.164:80 61.135.170.146:80
释放
C:\Documents and Settings\All Users\「开始」菜单\程序\启动\IE-Bar.lnk
C:\Documents and Settings\All Users\Application Data\clubmember
C:\Documents and Settings\mopery\Local Settings\Temp\fsprot.sys
C:\Documents and Settings\mopery\Local Settings\Temp\moprot.sys
C:\Documents and Settings\mopery\Local Settings\Temp\nsj7.tmp
C:\Documents and Settings\mopery\Templates\93d0cab
C:\Program Files\Common Files\IE-Bar
C:\WINDOWS\system32\4822a73a
C:\WINDOWS\system32\91dd2fa0.dll
C:\WINDOWS\system32\91di2fa.exe
C:\WINDOWS\system32\91do2fa0.dll
C:\WINDOWS\system32\drivers\fsprot.sys
C:\WINDOWS\system32\drivers\moprot.sys
注册表
HKCR\AppID\{65EF7AD4-1340-4A36-A097-95FF17E243E1}
HKCR\AppID\{84D34084-4E38-4683-A4DB-CA00646FEE8B}
HKCR\AppID\BHORun.DLL
HKCR\AppID\DelayLoad.DLL
HKCR\BHORun.BHelper
HKCR\BHORun.BHelper.1
HKCR\CLSID\{1FCA37BA-7259-4BF1-878B-A39FA83BFBBB}
HKCR\CLSID\{5A6F2F95-3191-433B-8533-EB0B596A7BAC}
HKCR\CLSID\{F2E37336-BFDB-409B-8D0E-6F013C438B20}
HKCR\DelayLoad.LoadRun
HKCR\DelayLoad.LoadRun.1
HKCR\Interface\{265379DB-90F0-45DB-9B10-640DCB1145FD}
HKCR\Interface\{7EB718DD-E41F-446A-9C1E-757F921168A0}
HKCR\Interface\{8C9377D3-D823-46A6-A8AC-B3913F9B6CA2}
HKCR\TypeLib\{25649A6A-637D-4416-9D03-98146330492A}\1.0
HKCR\TypeLib\{292D202F-E519-45F4-8D50-DE8513B87CE9}\1.0
HKCR\TypeLib\{86645AFC-0B33-4275-BFE6-FAE9FCD886D1}\1.0
HKCU\Software\sharehelper
HKLM\SOFTWARE\clubmember
HKLM\SOFTWARE\dmshareware
HKLM\SOFTWARE\IE-Bar
HKLM\SOFTWARE\sharehelper

[1] [2] [3] 下一页