Ban ID:仅有的温柔 [发布教程捆绑木马]
本帖最后由 是昔流芳 于 2011-8-6 12:10 编辑感谢举报:落崖惊风
http://www.52pojie.cn/thread-102910-1-1.html
木马地址:
http://u.115.com/file/aqz8imi2#
ID:仅有的温柔在发布教程中捆绑了木马,发布帖子后还用自己的马甲账号:52丶破解给自己加分推荐,行为可耻!
特此做BanID处理,永久禁止访问!
该会员示例程序没有问题,教程带毒.
有兴趣的可以看Comodo的报告,整理的比较详细.
http://camas.comodo.com/cgi-bin/submit?file=1daaa52dc1a56d72f4a5430925489cbfba76780e11e5ba55dcc26e971fc160d3
本帖最后由 LCG 于 2011-8-6 12:05 编辑
最后释放的木马dl字符串l如下:
中文搜索引擎
地址 文本字符串
100010B2 winsta0
100010D2 default
1000110E winsta0\default
1000115B open
10001208 TempLocal.txt
1000121A urlmon
1000122B URLDownloadToFileA
100013D2 WEBTEXT:
10001405 |
10001448 WEBTEXT:
100014C6 |
1000156E Newtemp_387.exe
10001654 Explorer.exe
100016D6 !
100016EC h
1000170C |
1000174B !
100017EF h
10001A04 <iframe
10001BD8 index
10001BEE Default
10001FE2 g
1000202D g
10002446 g
10002527 è
1000265B 94A7A7DA-6D69-472e-8981-DBC71C77FC66
1000284B %s X -ibck "%s" "%s\"
10002954 %s\
100029CC %s M -ibck -r -o+ -ep1 "%s" "%s\*"
10002B78 ,d
10002BCD 猥*猥猥
10002C32 %s%s
10002C56 .
10002C6C ..
10002C82 \
10002CD9 .
10002CF3 ..
10002D45 exe
10002D66 htm
10002D7B html
10002D90 asp
10002DA5 aspx
10002DC6 rar
10002EC1 %s%s
10002EE5 .
10002EFB ..
10002F11 \
10002F68 .
10002F82 ..
10002FD5 exe
10002FFB htm
10003010 html
10003025 asp
1000303A aspx
10003060 rar
10003160 Program Files\WinRAR\Rar.exe
10003170 94A7A7DA-6D69-472e-8981-DBC71C77FC66
10003184 207C6A67-5861-4aaf-A336-C255C7AE4C57
10003225 A:\
10003238 B:\
10003355 4F9E860C-9BE9-474b-8FD1-F0EEDB20C77B
1000345D \drivers\etc\hosts
10003491 127.0.0.1 localhost\r\n
100034EA \dllcache\systembox.bak
10003614 LAN
1000365E Internet
1000367D g
100036F4 g
10003803 n,Administrator,Guest,admin,Root,
1000382E n,1234,password,6969,harley,123456,golf,pussy,mustang,1111,shadow,1313,fish,5150,7777,qwerty,baseball,2112,letmein,12345678,12345,ccc,admin,5201314,qq520,1,12,123,1234567,123456789,654321,54321,111,000000,abc,pw,11111111,88888888,pass,passwd,database,abcd,
10003859 360hotfix.exe|360rpt.exe|360safe.exe|360safebox.exe|360tray.exe|agentsvr.exe|apvxdwin.exe|ast.exe|avcenter.exe|avengine.exe|avgnt.exe|avguard.exe|avltmain.exe|avp32.exe|avtask.exe|bdagent.exe|bdwizreg.exe|boxmod.exe|ccapp.exe|ccenter.exe|ccevtmgr.exe|ccreg
100038CC FILE
10003982 WmiSvc
10003987 WmiSvc
1000399A WmiSvc
100039DF 360hotfix.exe|360rpt.exe|360safe.exe|360safebox.exe|360tray.exe|agentsvr.exe|apvxdwin.exe|ast.exe|avcenter.exe|avengine.exe|avgnt.exe|avguard.exe|avltmain.exe|avp32.exe|avtask.exe|bdagent.exe|bdwizreg.exe|boxmod.exe|ccapp.exe|ccenter.exe|ccevtmgr.exe|ccreg
10003A0F avp.exe
10003AA5 \\.\NtBox
10003AE5 \system32\drivers\
10003AF7 WmiSvc.sys
10003B47 \\.\NtBox
10003CD5 \\%s\pipe
10003D4E \\%s\pipe\browser
10003DAB 3.0
10003DB0 4b324fc8-1670-01d3-1278-5a47bf6ee188
10003E70 Program Files\Internet Explorer\iexplore.exe
10003EC5 open
10003F65 xg
10003F84 8g
10003FC8 asp
10003FF3 8g
10003FF9 xg
10003FFF http://%s%s
100040FB xg
10004108 8g
1000410E GET %s?name=%s HTTP/1.1\r\nUser-Agent: Mozilla/4.0\r\nHost: %s\r\n\r\n
1000437B NtQuerySystemInformation
10004380 ntdll.dll
1000441D KeServiceDescriptorTable
100044CF MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
10004526 Everyone
100045A1 ntsd -d
100045BB SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
100045FD Debugger
10004700 Dj
10004707 SYSTEM\CurrentControlSet\Services\%s
1000475A Start
10004783 360hotfix.exe|360rpt.exe|360safe.exe|360safebox.exe|360tray.exe|agentsvr.exe|apvxdwin.exe|ast.exe|avcenter.exe|avengine.exe|avgnt.exe|avguard.exe|avltmain.exe|avp32.exe|avtask.exe|bdagent.exe|bdwizreg.exe|boxmod.exe|ccapp.exe|ccenter.exe|ccevtmgr.exe|ccreg
1000488D %s\desktop.txt
100048F6 %s\
100049E9 0
10004B36 \\%s\ipc$
10004B96 \\%s\C$\bootfont.exe
10004BED at \\%s %d:%d C:\bootfont.exe
10004F1D 0
100050C4 %d.%d.%d.%d
10005131 n,Administrator,Guest,admin,Root,
10005160 n,1234,password,6969,harley,123456,golf,pussy,mustang,1111,shadow,1313,fish,5150,7777,qwerty,baseball,2112,letmein,12345678,12345,ccc,admin,5201314,qq520,1,12,123,1234567,123456789,654321,54321,111,000000,abc,pw,11111111,88888888,pass,passwd,database,abcd,
10005278 LAN
10005457 %sautorun.inf
100054EA %s%d%d%d%d%d%d
1000553D Ghost.exe
10005542 recycle.{645FF040-5081-101B-9F08-00AA002F954E}
1000554A %s%s\%s
100056E3 %sautorun.inf
1000570E Bak
10005713 Ghost.exe
10005718 recycle.{645FF040-5081-101B-9F08-00AA002F954E}
1000571D Bak
10005722 Ghost.exe
10005727 recycle.{645FF040-5081-101B-9F08-00AA002F954E}
1000572C Ghost.exe
10005731 recycle.{645FF040-5081-101B-9F08-00AA002F954E}
10005736 \r\nOPEN=%s\%s\r\nshell\open=打开(&O)\r\nshell\open\Command=%s\%s %s\r\nshell\open\Default=1\r\nshell\explore=资源管理器(&X)\r\nshell\explore\Command=%s\%s %s\r\n
100057F4 recycle.{645FF040-5081-101B-9F08-00AA002F954E}
100057FC %s%s
10005859 Ghost.exe
10005865 %s\%s
1000592F %c:\
100059C2 ntdll.dll
100059D0 ZwQueryInformationThread
10005B2A Newtemp_387.exe
10005B95 %s %s
10005D51 (Initial CPU selection)
可怜的孩子默哀 超鄙视这样的垃圾。 本帖最后由 Smallsea 于 2011-8-6 14:52 编辑
这个东西总体开启了挺猛的，还有加个猛壳就.......
鄙视这种没教养的 ╮(╯▽╰)╭，这个会员之前还天天到举报区举报呢，居然教程捆木马啊。{:301_996:} 够贱的 这样的行为一定要严处. 这种垃圾禁止访问最好，让他不要登陆论坛了。。