是网马。
这个网马有点儿意思。
两次植入系统后，释放的文件以及那几个插进程的dll所在的位置均有变化。

查杀并不难。根据SRENG日志，删除木马启动项、处理干净进程、删除木马文件即可。

——————
以下是第一次植入木马后的SRENG日志及释放/下载的木马文件：



启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <upxdhnd><C:\DOCUME~1\baohelin\LOCALS~1\Temp\upxdhnd.exe>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{4DEC9B29-F08F-4cbc-B179-592B9283FAB0}><c:\program files\common files\pfshared\vswxubov.dll>  [N/A]
    <{E464D6D7-935B-4203-9E74-8A6C60906B37}><c:\program files\common files\pfshared\lkigtece.dll>  [N/A]
    <{C883F785-102E-2427-7ADD-5B002D13D077}><C:\windows\system32\gj.dll>  [N/A]

==================================
正在运行的进程

[PID: 584][\??\C:\windows\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\program files\common files\pfshared\vswxubov.dll]  [N/A, N/A]
    [c:\program files\common files\pfshared\lkigtece.dll]  [N/A, N/A]
[PID: 1044][C:\windows\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\DOCUME~1\baohelin\LOCALS~1\Temp\upxdhnd.dll]  [N/A, N/A]
    [c:\program files\common files\pfshared\vswxubov.dll]  [N/A, N/A]
    [c:\program files\common files\pfshared\lkigtece.dll]  [N/A, N/A]
    [C:\windows\system32\gj.dll]  [N/A, N/A]
[PID: 1860][C:\Program Files\Tiny Firewall Pro\amon.exe]  [Computer Associates International, Inc., 6.5.3.2]
    [C:\windows\system32\gj.dll]  [N/A, N/A]
[PID: 3672][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\windows\system32\gj.dll]  [N/A, N/A]
[PID: 1984][C:\windows\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\windows\system32\gj.dll]  [N/A, N/A]
[PID: 276][C:\Program Files\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [C:\windows\system32\gj.dll]  [N/A, N/A]

以下是第二次植入木马后的SRENG日志及释放/下载的木马文件：


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <upxdhnd><C:\DOCUME~1\baohelin\LOCALS~1\Temp\upxdhnd.exe>  [N/A]
    <kernel32><C:\windows\Kernel32.exe>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{4DEC9B29-F08F-4cbc-B179-592B9283FAB0}><c:\program files\internet download manager\pqiwgkiw.dll>  [N/A]
    <{E464D6D7-935B-4203-9E74-8A6C60906B37}><c:\program files\internet download manager\wcxpjetr.dll>  [N/A]
    <{C883F785-102E-2427-7ADD-5B002D13D077}><C:\windows\system32\gj.dll>  [N/A]

正在运行的进程

[PID: 584][\??\C:\windows\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\program files\internet download manager\pqiwgkiw.dll]  [N/A, N/A]
    [c:\program files\internet download manager\wcxpjetr.dll]  [N/A, N/A]

[PID: 1608][C:\windows\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\DOCUME~1\baohelin\LOCALS~1\Temp\upxdhnd.dll]  [N/A, N/A]
    [c:\program files\internet download manager\pqiwgkiw.dll]  [N/A, N/A]
    [c:\program files\internet download manager\wcxpjetr.dll]  [N/A, N/A]
    [C:\windows\system32\gj.dll]  [N/A, N/A]
    [C:\DOCUME~1\baohelin\LOCALS~1\Temp\~TmD.tmp.rom]  [N/A, N/A]
    [C:\DOCUME~1\baohelin\LOCALS~1\Temp\~TmE.tmp..rom]  [N/A, N/A]
[PID: 2008][C:\windows\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\DOCUME~1\baohelin\LOCALS~1\Temp\~TmD.tmp.rom]  [N/A, N/A]
[PID: 2020][C:\Program Files\Tiny Firewall Pro\amon.exe]  [Computer Associates International, Inc., 6.5.3.2]
    [C:\windows\system32\gj.dll]  [N/A, N/A]
    [C:\DOCUME~1\baohelin\LOCALS~1\Temp\~TmD.tmp.rom]  [N/A, N/A]
    [C:\DOCUME~1\baohelin\LOCALS~1\Temp\~TmE.tmp..rom]  [N/A, N/A]
[PID: 1156][C:\Program Files\Internet Download Manager\IDMan.exe]  [Internet Download Manager Corp., Tonec Inc. , 5, 0, 2, 5]
    [C:\windows\system32\gj.dll]  [N/A, N/A]
    [C:\DOCUME~1\baohelin\LOCALS~1\Temp\~TmD.tmp.rom]  [N/A, N/A]
[PID: 2640][C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe]  [TechSmith Corporation, 7.1.2.0]
    [C:\windows\system32\gj.dll]  [N/A, N/A]
[PID: 384][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\windows\system32\gj.dll]  [N/A, N/A]
    [C:\DOCUME~1\baohelin\LOCALS~1\Temp\~TmD.tmp.rom]  [N/A, N/A]
[PID: 3216][C:\windows\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\windows\system32\gj.dll]  [N/A, N/A]
[PID: 4036][C:\Program Files\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [C:\windows\system32\gj.dll]  [N/A, N/A]
    [C:\DOCUME~1\baohelin\LOCALS~1\Temp\~TmD.tmp.rom]  [N/A, N/A]
    [C:\DOCUME~1\baohelin\LOCALS~1\Temp\~TmE.tmp..rom]  [N/A, N/A]

学习了  呵呵

学习

帮顶下。。。

楼主就是传说中的猫叔么?

引用:

【￡影子虫あ的贴子】楼主就是传说中的猫叔么? ………………

不是传说,就是猫叔

学习了...

郁闷，在这要一分闪人

顺便问个小问题：

猫叔以前有没有过哪个贴子关于Tiny的

baohe

在这方面下了工夫了。

第二次释放出的文件里：deleteme.bat

你是怎么知道的？

是那些监控工具提示出的吗？