2008-11-03,08:41:40
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<NeroHomeFirstStart><uusea.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SoundMan><SoundMan.exe> [1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{22B1E816-2CEF-4345-8142-7699C7C9935F}><C:\WINDOWS\system32\Up360.vxd> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Loader.exe]
<IFEO[360Loader.exe]><svchost.exe> [(Infected) Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe]
<IFEO[360Safe.exe]><svchost.exe> [(Infected) Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe]
<IFEO[360tray.exe]><svchost.exe> [(Infected) Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe]
<IFEO[ctfmon.exe]><SoundMan.exe> [1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword]
<IFEO[IceSword]><svchost.exe> [(Infected) Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe]
<IFEO[Iparmor.exe]><svchost.exe> [(Infected) Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.exe]
<IFEO[kmailmon.exe]><svchost.exe> [(Infected) Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ras]
<IFEO[ras]><svchost.exe> [(Infected) Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep]
<IFEO[runiep]><svchost.exe> [(Infected) Microsoft Corporation]
==================================
正在运行的进程
[C:\WINDOWS\system32\Up360.vxd] [N/A, ]
[PID: 2748 / Administrator][C:\WINDOWS\system32\uusea.exe] [N/A, ]
[PID: 3884 / SYSTEM][C:\WINDOWS\TEMP\winlogon.exe] [N/A, ]
==================================
HOSTS 文件
[file]
open=y
url1=http://down.cvz2.cn/hb/0.exe
url2=http://down.cvz2.cn/hb/1.exe
url3=http://down.cvz2.cn/hb/2.exe
url4=http://down.cvz2.cn/hb/3.exe
url5=http://down.cvz2.cn/hb/4.exe
url6=http://down.cvz2.cn/hb/5.exe
url7=http://down.cvz2.cn/hb/6.exe
url8=http://down.cvz2.cn/hb/7.exe
url9=http://down.cvz2.cn/hb/8.exe
url10=http://down.cvz2.cn/hb/9.exe
url11=http://down.cvz2.cn/hb/10.exe
url12=http://down.cvz2.cn/hb/11.exe
url13=http://down.cvz2.cn/hb/12.exe
url14=http://down.cvz2.cn/hb/13.exe
url15=http://down.cvz2.cn/hb/14.exe
url16=http://down.cvz2.cn/hb/15.exe
url17=http://down.cvz2.cn/hb/16.exe
url18=http://down.cvz2.cn/hb/17.exe
url19=http://down.cvz2.cn/hb/18.exe
url20=http://down.cvz2.cn/hb/19.exe
url21=http://down.cvz2.cn/hb/20.exe
url22=http://down.cvz2.cn/hb/21.exe
url23=http://down.cvz2.cn/hb/22.exe
url24=http://down.cvz2.cn/hb/23.exe
url25=http://down.cvz2.cn/hb/24.exe
url26=http://down.cvz2.cn/hb/25.exe
url27=http://down.cvz2.cn/hb/27.exe
url28=http://down.cvz2.cn/hb/28.exe
url29=http://down.cvz2.cn/hb/29.exe
url30=http://down.cvz2.cn/hb/30.exe
url31=http://down.cvz2.cn/hb/31.exe
url32=http://down.cvz2.cn/hb/32.exe
url33=http://down.cvz2.cn/hb/33.exe
url34=http://down.cvz2.cn/hb/26.exe
url35=http://down.cvz2.cn/hb/34.exe
count=35
