恭喜您中二等奖？原来是中标了——IEPlus.exe
endurer 原创
2008-12-29 第
2版 补充卡巴斯基的回复
1版
今天一开机就发现任务栏里有一个QQ的喇叭图标在闪烁，点击后出现：
点击的话，会用IE浏览器打开 hxxp://www.qq**i***t*9***.cn/
这么走运？
不对呀，偶的QQ还没开呢。
拔号上网，运行QQ医生，发现：
另外还发现hosts被劫持 和 几个系统漏洞。
断开宽带连接，运行 pe_xscan 扫描 log 并分析，发现如下可疑项：
pe_xscan 08-11-22 by Purple Endurer
2008-12-28 10:17:38
Windows XP Service Pack 2(5.1.2600)
MSIE:7.0.5730.13
管理员用户组
正常模式
C:/Documents and Settings/All Users/「开始」菜单/程序/启动/IEPlus.exe * 200 | 2008-12-27 8:59:36
O1 - Hosts: 121.11.76.26 qq．com
O1 - Hosts: 121.11.76.26 sn．qq．com
O1 - Hosts: 157.150.195.10 www．dhghost．com Welcome to the UN_ It's your world
O4 - HKLM/../Policies/Explorer/Run: [gem] C:/Documents and Settings/All Users/「开始」菜单/程序/启动/IEPlus.exe
O4 - Global Startup: IEPlus.exe -> Fail to open file
O18 - 协议: ic32pp() - {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - C:/WINDOWS/wc98pp.dll | 2008-12-27 12:44:54
打开任务管理器终止 IEPlus.exe，用bat_do将 IEPlus.exe 和 wc98pp.dll 打包备份后删除。
再用QQ医生扫描清理。
文件说明符 : C:/Documents and Settings/All Users/「开始」菜单/程序/启动/IEPlus.exe
属性 : A---
数字签名:否
PE文件:是
获取文件版本信息大小失败!
创建时间 : 2008-12-27 16:55:10
修改时间 : 2008-12-27 16:59:36
大小 : 453493 字节 442.885 KB
MD5 : bc47deb5e9bf2d3d99f6e8a38a5ecd6d
SHA1: 0E0C0AC42695015B101DF70E520F214DAC628661
CRC32: 1e3146ec
瑞星报为： Trojan.Win32.QQFish.x
卡巴斯基报为：Packed.Win32.Klone.bi
文件 IEPlus.exe 接收于 2008.12.28 10:20:02 (CET)
反病毒引擎 | 版本 | 最后更新 | 扫描结果 |
a-squared | 4.0.0.73 | 2008.12.28 | Virus.Win32.Agent.SIQ!IK |
AhnLab-V3 | 2008.12.25.0 | 2008.12.27 | Win32/MalPackedB.suspicious |
AntiVir | 7.9.0.45 | 2008.12.28 | TR/Crypt.XPACK.Gen |
Authentium | 5.1.0.4 | 2008.12.28 | - |
Avast | 4.8.1281.0 | 2008.12.27 | Win32:Hupigon-EKK |
AVG | 8.0.0.199 | 2008.12.28 | Win32/Heur |
BitDefender | 7.2 | 2008.12.28 | - |
CAT-QuickHeal | 10.00 | 2008.12.27 | - |
ClamAV | 0.94.1 | 2008.12.28 | - |
Comodo | 826 | 2008.12.27 | - |
DrWeb | 4.44.0.09170 | 2008.12.28 | - |
eSafe | 7.0.17.0 | 2008.12.24 | - |
eTrust-Vet | 31.6.6276 | 2008.12.24 | - |
Ewido | 4.0 | 2008.12.27 | - |
F-Prot | 4.4.4.56 | 2008.12.27 | - |
F-Secure | 8.0.14332.0 | 2008.12.28 | Suspicious:W32/Malware!Gemini |
Fortinet | 3.117.0.0 | 2008.12.28 | suspicious |
GData | 19 | 2008.12.28 | Win32:Hupigon-EKK |
Ikarus | T3.1.1.45.0 | 2008.12.28 | Virus.Win32.Agent.SIQ |
K7AntiVirus | 7.10.568 | 2008.12.27 | - |
Kaspersky | 7.0.0.125 | 2008.12.28 | - |
McAfee | 5476 | 2008.12.27 | - |
McAfee+Artemis | 5476 | 2008.12.27 | Generic!Artemis |
Microsoft | 1.4205 | 2008.12.28 | PWS:Win32/QQpass.AA |
NOD32 | 3719 | 2008.12.27 | - |
Norman | 5.80.02 | 2008.12.26 | - |
Panda | 9.0.0.4 | 2008.12.27 | Trj/VB.ABC |
PCTools | 4.4.2.0 | 2008.12.27 | - |
Prevx1 | V2 | 2008.12.28 | Cloaked Malware |
Rising | 21.09.62.00 | 2008.12.28 | Trojan.Win32.QQFish.x |
SecureWeb-Gateway | 6.7.6 | 2008.12.28 | Trojan.Crypt.XPACK.Gen |
Sophos | 4.37.0 | 2008.12.28 | Mal/Generic-A |
Sunbelt | 3.2.1809.2 | 2008.12.22 | - |
Symantec | 10 | 2008.12.28 | Trojan.Fakemess |
TheHacker | 6.3.1.4.200 | 2008.12.26 | - |
TrendMicro | 8.700.0.1004 | 2008.12.26 | - |
VBA32 | 3.12.8.10 | 2008.12.27 | suspected of Backdoor.XiaoBird.5 (paranoid heuristics) |
ViRobot | 2008.12.26.1536 | 2008.12.26 | - |
VirusBuster | 4.5.11.0 | 2008.12.27 | - |
附加信息 |
File size: 453493 bytes |
MD5...: bc47deb5e9bf2d3d99f6e8a38a5ecd6d |
SHA1..: 0e0c0ac42695015b101df70e520f214dac628661 |
SHA256: 15e311d50b9a53cecda03aa222602498e8a4b00181c0513efd8508a0499856bd |
SHA512: 28f0605842f49ac9750a698a379cb333abdfceaf88c66c561e843499f74eb606 f1d9212b97c16ad39cb749e3dc6d252ad25a7f7890d397120d6edec2d0c493a7 |
ssdeep: 12288:wV6/wvqJz7UF2gDEdUXqC1S2e/TCA61xgIw6tUD:NJz7rzdkqC1S20TC51 VtUD |
PEiD..: - |
TrID..: File type identification Win32 EXE Yoda's Crypter (56.9%) Win32 Executable Generic (18.2%) Win32 Dynamic Link Library (generic) (16.2%) Generic Win/DOS Executable (4.2%) DOS Executable Generic (4.2%) |
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x401000 timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992) machinetype.......: 0x14c (I386) ( 2 sections ) name viradd virsiz rawdsiz ntrpy md5 .packed 0x1000 0xc0000 0x200 6.07 b60264f893cb08122b6346714cf8e9c0 .RLPack 0xc1000 0x72c72 0x6e775 7.76 b6c35744713c21a6137a3e32cb07a710 ( 1 imports ) > kernel32.dll: LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualProtect, VirtualFree, GetModuleHandleA ( 0 exports ) |
packers (Kaspersky): PE_Patch.RLPack |
CWSandbox info: http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=bc47deb5e9bf2d3d99f6e8a38a5ecd6d |
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=CBCCF66675867DB6EB5E06C83F4B93003D017D10 |
packers (Avast): RLPack |