【求助】又中毒了！这次是crs.exe！ - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛【求助】又中毒了！这次是crs.exe！

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

【求助】又中毒了！这次是crs.exe！

xxookk 初生襁褓狮帖子:19 注册: 2006-02-02 来自:	发表于： 2007-04-03 21:58 \| 只看楼主短消息资料字号：小中大 1楼【求助】又中毒了！这次是crs.exe！这个够恨，用了sreng.exe，注册表，安全模式——全部都没用！这个文件自启动（安全模式下照样启动），删了又自我恢复。那位仁兄有办法的请指点一二，先谢过了。 2007-04-03 23:46:21
xxookk 初生襁褓狮帖子:19 注册: 2006-02-02 来自:	分享到：

KeiGo 初生襁褓狮帖子:10 注册: 2006-02-07 来自:	发表于： 2007-04-03 22:19 \| 短消息资料字号：小中大 2楼对吧，我也中招了。简直把瑞星封杀了，杀毒软件和监控都开不了。（包括在安全模式下）只能用开机前扫描，可是一点用都没有。等着看怎么解决吧。
KeiGo 初生襁褓狮帖子:10 注册: 2006-02-07 来自:

xxookk 初生襁褓狮帖子:19 注册: 2006-02-02 来自:	发表于： 2007-04-03 23:55 \| 只看楼主短消息资料字号：小中大 3楼找到了一位仁兄的分析，但是看不出来解决办法，大家研究下。 Win32/IRCBot.worm.82855是 Win32/IRCBot.worm蠕虫变种之一. 该蠕虫试图利用Windows漏洞来传播. 运行该蠕虫后会在Windows系统目录下生成crs.exe(82,855 bytes)文件并修改注册表当系统启动时自动运行. 试图连接特定IRC服务器. 连接成功后，以管理者(Operator)的身份执行恶意控制. 内容 * 扩散程度收集病毒信息的安博士公司已在 2005年 9月 14日 18：20分(GMT+9 标准) 从客户收到一件感染报告. * 传播路径该蠕虫是与 Win32/IRCBot.worm 的变种一样，是通过Windows漏洞来传播. MS03-039 RPC DCOM2 漏洞英文 - http://www.microsoft.com/technet/security/bulletin/MS03-039.mspx 韩文 - http://www.microsoft.com/korea/t ... lletin/MS03-039.asp * 运行后症状 [生成文件] 在Windows系统目录下生成以下文件. - crs.exe (82,855 bytes) 注) windows系统文件夹的类型以版本不同有差异. 在Windows 95/98/Me C:\Windows\System, windows NT/2000, C:\WinNT\System32, windows XP是C:\Windows\System32 文件夹. [修改注册表] 修改注册表当系统启动时自动运行. HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Run\ 的 crs="crs.exe" HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ RunServices\ 的 crs="crs.exe" [结束进程] 强行结束以下进程. F-AGOBOT.EXE HIJACKTHIS.EXE _AVPM.EXE _AVPCC.EXE _AVP32.EXE ZONEALARM.EXE ZONALM2601.EXE ZATUTOR.EXE ZAPSETUP3001.EXE ZAPRO.EXE XPF202EN.EXE WYVERNWORKSFIREWALL.EXE WUPDT.EXE WUPDATER.EXE WSBGATE.EXE WRCTRL.EXE WRADMIN.EXE WNT.EXE WNAD.EXE WKUFIND.EXE WINUPDATE.EXE WINTSK32.EXE WINSTART001.EXE WINSTART.EXE WINSSK32.EXE WINSERVN.EXE WINRECON.EXE WINPPR32.EXE WINNET.EXE WINMAIN.EXE WINLOGIN.EXE WININITX.EXE WININIT.EXE WININETD.EXE WINDOWS.EXE WINDOW.EXE WINACTIVE.EXE WIN32US.EXE WIN32.EXE WIN-BUGSFIX.EXE WIMMUN32.EXE WHOSWATCHINGME.EXE WGFE95.EXE WFINDV32.EXE WEBTRAP.EXE WEBSCANX.EXE WEBDAV.EXE WATCHDOG.EXE W9X.EXE W32DSM89.EXE VSWINPERSE.EXE VSWINNTSE.EXE VSWIN9XE.EXE VSSTAT.EXE VSMON.EXE VSMAIN.EXE VSISETUP.EXE VSHWIN32.EXE VSECOMR.EXE VSCHED.EXE VSCENU6.02D30.EXE VSCAN40.EXE VPTRAY.EXE VPFW30S.EXE VPC42.EXE VPC32.EXE VNPC3000.EXE VNLAN300.EXE VIRUSMDPERSONALFIREWALL.EXE VIR-HELP.EXE VFSETUP.EXE VETTRAY.EXE VET95.EXE VET32.EXE VCSETUP.EXE VBWINNTW.EXE VBWIN9X.EXE VBUST.EXE VBCONS.EXE VBCMSERV.EXE UTPOST.EXE UPGRAD.EXE UPDAT.EXE UNDOBOOT.EXE TV**.EXE TVMD.EXE TSADBOT.EXE TROJANTRAP3.EXE TRJSETUP.EXE TRJSCAN.EXE TRICKLER.EXE TRACERT.EXE TITANINXP.EXE TITANIN.EXE TGBOB.EXE TFAK5.EXE TFAK.EXE TEEKIDS.EXE TDS2-NT.EXE TDS2-98.EXE TDS-3.EXE TCM.EXE TCA.EXE TC.EXE TBSCAN.EXE TAUMON.EXE TASKMON.EXE TASKMO.EXE TASKMG.EXE SYSUPD.EXE SYSTEM32.EXE SYSTEM.EXE SYSEDIT.EXE SYMTRAY.EXE SYMPROXYSVC.EXE SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE SWEEP95.EXE SVSHOST.EXE SVCHOSTS.EXE SVCHOSTC.EXE SVC.EXE SUPPORTER5.EXE SUPPORT.EXE SUPFTRL.EXE STCLOADER.EXE START.EXE ST2.EXE SSG_4104.EXE SSGRATE.EXE SS3EDIT.EXE SRNG.EXE SREXE.EXE SPYXX.EXE SPOOLSV32.EXE SPOOLCV.EXE SPOLER.EXE SPHINX.EXE SPF.EXE SPERM.EXE SOFI.EXE SOAP.EXE SMSS32.EXE SMS.EXE SMC.EXE SHOWBEHIND.EXE SHN.EXE UPDATE.EXE SHELLSPYINSTALL.EXE SH.EXE SGSSFW32.EXE SFC.EXE SETUP_FLOWPROTECTOR_US.EXE SETUPVAMEEVAL.EXE SERVLCES.EXE SERVLCE.EXE SERVICE.EXE SERV95.EXE SD.EXE SCVHOST.EXE SCRSVR.EXE SCRSCAN.EXE SCANPM.EXE SCAN95.EXE SCAN32.EXE SCAM32.EXE SC.EXE SBSERV.EXE SAVENOW.EXE SAVE.EXE SAHAGENT.EXE SAFEWEB.EXE RUXDLL32.EXE RUNDLL16.EXE RUNDLL.EXE RUN32DLL.EXE RULAUNCH.EXE RTVSCN95.EXE RTVSCAN.EXE RSHELL.EXE RRGUARD.EXE RESCUE32.EXE RESCUE.EXE REGEDT32.EXE REGEDIT.EXE REGED.EXE REALMON.EXE RCSYNC.EXE RB32.EXE RAY.EXE RAV8WIN32ENG.EXE RAV7WIN.EXE RAV7.EXE RAPAPP.EXE QSERVER.EXE QCONSOLE.EXE PVIEW95.EXE PUSSY.EXE PURGE.EXE PSPF.EXE PROTECTX.EXE PROPORT.EXE PROGRAMAUDITOR.EXE PROCEXPLORERV1.0.EXE PROCESSMONITOR.EXE PROCDUMP.EXE PRMVR.EXE PRMT.EXE PRIZESURFER.EXE PPVSTOP.EXE PPTBC.EXE PPINUPDT.EXE POWERSCAN.EXE PORTMONITOR.EXE PORTDETECTIVE.EXE POPSCAN.EXE POPROXY.EXE POP3TRAP.EXE PLATIN.EXE PINGSCAN.EXE PGMONITR.EXE PFWADMIN.EXE PF2.EXE PERSWF.EXE PERSFW.EXE PERISCOPE.EXE PENIS.EXE PDSETUP.EXE PCSCAN.EXE PCIP10117_0.EXE PCFWALLICON.EXE PCDSETUP.EXE PCCWIN98.EXE PCCWIN97.EXE PCCNTMON.EXE PCCIOMON.EXE PCC2K_76_1436.EXE PCC2002S902.EXE PAVW.EXE PAVSCHED.EXE PAVPROXY.EXE PAVCL.EXE PATCH.EXE PANIXK.EXE PADMIN.EXE OUTPOSTPROINSTALL.EXE OUTPOSTINSTALL.EXE OTFIX.EXE OSTRONET.EXE OPTIMIZE.EXE ONSRVR.EXE OLLYDBG.EXE NWTOOL16.EXE NWSERVICE.EXE NWINST4.EXE NVSVC32.EXE NVC95.EXE NVARCH16.EXE NUI.EXE NTXconfig.EXE NTVDM.EXE NTRTSCAN.EXE NT.EXE NSUPDATE.EXE NSTASK32.EXE NSSYS32.EXE NSCHED32.EXE NPSSVC.EXE NPSCHECK.EXE NPROTECT.EXE NPFMESSENGER.EXE NPF40_TW_98_NT_ME_2K.EXE NOTSTART.EXE NORTON_INTERNET_SECU_3.0_407.EXE NORMIST.EXE NOD32.EXE NMAIN.EXE NISUM.EXE NISSERV.EXE NETUTILS.EXE NETSTAT.EXE NETSPYHUNTER-1.2.EXE NETSCANPRO.EXE NETMON.EXE NETINFO.EXE NETD32.EXE NETARMOR.EXE NEOWATCHLOG.EXE NEOMONITOR.EXE NDD32.EXE NCINST4.EXE NC2000.EXE NAVWNT.EXE NAVW32.EXE NAVSTUB.EXE NAVNT.EXE NAVLU32.EXE NAVENGNAVEX15.NAVLU32.EXE NAVDX.EXE NAVAPW32.EXE NAVAPSVC.EXE NAVAP.NAVAPSVC.EXE AUTO-PROTECT.NAV80TRY.EXE NAV.EXE OUTPOST.EXE NUPGRADE.EXE N32SCANW.EXE MWATCH.EXE MU0311AD.EXE MSVXD.EXE MSSYS.EXE MSSMMC32.EXE MSMSGRI32.EXE MSMGT.EXE MSLAUGH.EXE MSINFO32.EXE MSIEXEC16.EXE MSDOS.EXE MSDM.EXE MSCONFIG.EXE MSCMAN.EXE MSCCN32.EXE MSCACHE.EXE MSBLAST.EXE MSBB.EXE MSAPP.EXE MRFLUX.EXE MPFTRAY.EXE MPFSERVICE.EXE MPFAGENT.EXE MOSTAT.EXE MOOLIVE.EXE MONITOR.EXE MMOD.EXE MINILOG.EXE MGUI.EXE MGHTML.EXE MGAVRTE.EXE MGAVRTCL.EXE MFWENG3.02D30.EXE MFW2EN.EXE MFIN32.EXE MD.EXE MCVSSHLD.EXE MCVSRTE.EXE MCTOOL.EXE MCSHIELD.EXE MCMNHDLR.EXE MCAGENT.EXE MAPISVC32.EXE LUSPT.EXE LUINIT.EXE LUCOMSERVER.EXE LUAU.EXE LSETUP.EXE LORDPE.EXE LOOKOUT.EXE LOCKDOWN2000.EXE LOCKDOWN.EXE LOCALNET.EXE LOADER.EXE LNETINFO.EXE LDSCAN.EXE LDPROMENU.EXE LDPRO.EXE LDNETMON.EXE LAUNCHER.EXE KILLPROCESSSETUP161.EXE KERNEL32.EXE KERIO-WRP-421-EN-WIN.EXE KERIO-WRL-421-EN-WIN.EXE KERIO-PF-213-EN-WIN.EXE KEENVALUE.EXE KAZZA.EXE KAVPF.EXE KAVPERS40ENG.EXE KAVLITE40ENG.EXE JEDI.EXE JDBGMRG.EXE JAMMER.EXE ISTSVC.EXE MCUPDATE.EXE LUALL.EXE ISRV95.EXE ISASS.EXE IRIS.EXE IPARMOR.EXE IOMON98.EXE INTREN.EXE INTDEL.EXE INIT.EXE INFWIN.EXE INFUS.EXE INETLNFO.EXE IFW2000.EXE IFACE.EXE IEXPLORER.EXE IEDRIVER.EXE IEDLL.EXE IDLE.EXE ICSUPPNT.EXE ICMON.EXE ICLOADNT.EXE ICLOAD95.EXE IBMAVSP.EXE IBMASN.EXE IAMSTATS.EXE IAMSERV.EXE IAMAPP.EXE HXIUL.EXE HXDL.EXE HWPE.EXE HTPATCH.EXE HTLOG.EXE HOTPATCH.EXE HOTACTIO.EXE HBSRV.EXE HBINST.EXE HACKTRACERSETUP.EXE GUARDDOG.EXE GUARD.EXE GMT.EXE GENERICS.EXE GBPOLL.EXE GBMENU.EXE GATOR.EXE FSMB32.EXE FSMA32.EXE FSM32.EXE FSGK32.EXE FSAV95.EXE FSAV530WTBYB.EXE FSAV530STBYB.EXE FSAV32.EXE FSAV.EXE FSAA.EXE FRW.EXE FPROT.EXE FP-WIN_TRIAL.EXE FP-WIN.EXE FNRB32.EXE FLOWPROTECTOR.EXE FIREWALL.EXE FINDVIRU.EXE FIH32.EXE FCH32.EXE FAST.EXE FAMEH32.EXE F-STOPW.EXE F-PROT95.EXE F-PROT.EXE F-AGNT95.EXE EXPLORE.EXE EXPERT.EXE EXE.AVXW.EXE EXANTIVIRUS-CNET.EXE EVPN.EXE ETRUSTCIPE.EXE ETHEREAL.EXE ESPWATCH.EXE ESCANV95.EXE ICSUPP95.EXE ESCANHNT.EXE ESCANH95.EXE ESAFE.EXE ENT.EXE EMSW.EXE EFPEADM.EXE ECENGINE.EXE DVP95_0.EXE DVP95.EXE DSSAGENT.EXE DRWEBUPW.EXE DRWEB32.EXE DRWATSON.EXE DPPS2.EXE DPFSETUP.EXE DPF.EXE DOORS.EXE DLLREG.EXE DLLCACHE.EXE DIVX.EXE DEPUTY.EXE DEFWATCH.EXE DEFSCANGUI.EXE DEFALERT.EXE DCOMX.EXE DATEMANAGER.EXE Claw95.EXE CWNTDWMO.EXE CWNB181.EXE CV.EXE CTRL.EXE CPFNT206.EXE CPF9X206.EXE CPD.EXE CONNECTIONMONITOR.EXE CMON016.EXE CMGRDIAN.EXE CMESYS.EXE CMD32.EXE CLICK.EXE CLEANPC.EXE CLEANER3.EXE CLEANER.EXE CLEAN.EXE CFINET32.EXE CFINET.EXE CFIADMIN.EXE CFGWIZ.EXE CFD.EXE CDP.EXE CCPXYSVC.EXE CCEVTMGR.EXE CCAPP.EXE BVT.EXE BUNDLE.EXE BS120.EXE BRASIL.EXE BPC.EXE BORG2.EXE BOOTWARN.EXE BOOTCONF.EXE BLSS.EXE BLACKICE.EXE BLACKD.EXE BISP.EXE BIPCPEVALSETUP.EXE BIPCP.EXE BIDSERVER.EXE BIDEF.EXE BELT.EXE BEAGLE.EXE BD_PROFESSIONAL.EXE BARGAINS.EXE BACKWEB.EXE CLAW95CF.EXE CFIAUDIT.EXE AVXMONITORNT.EXE AVXMONITOR9X.EXE AVWUPSRV.EXE AVWUPD.EXE AVWINNT.EXE AVWIN95.EXE AVSYNMGR.EXE AVSCHED32.EXE AVPTC32.EXE AVPM.EXE AVPDOS32.EXE AVPCC.EXE AVP32.EXE AVP.EXE AVNT.EXE AVLTMAIN.EXE AVKWCTl9.EXE AVKSERVICE.EXE AVKSERV.EXE AVKPOP.EXE AVGW.EXE AVGUARD.EXE AVGSERV9.EXE AVGSERV.EXE AVGNT.EXE AVGCTRL.EXE AVGCC32.EXE AVE32.EXE AVCONSOL.EXE AU.EXE ATWATCH.EXE ATRO55EN.EXE ATGUARD.EXE ATCON.EXE ARR.EXE APVXDWIN.EXE APLICA32.EXE APIMONITOR.EXE ANTS.EXE ANTIVIRUS.EXE ANTI-TROJAN.EXE AMON9X.EXE ALOGSERV.EXE ALEVIR.EXE ALERTSVC.EXE AGENTW.EXE AGENTSVR.EXE ADVXDWIN.EXE ADAWARE.EXE AVXQUAR.EXE ACKWIN32.EXE AVWUPD32.EXE AVPUPD.EXE AUTOUPDATE.EXE AUTOTRACE.EXE AUTODOWN.EXE AUPDATE.EXE
xxookk 初生襁褓狮帖子:19 注册: 2006-02-02 来自:

xxookk 初生襁褓狮帖子:19 注册: 2006-02-02 来自:	发表于： 2007-04-03 23:56 \| 只看楼主短消息资料字号：小中大 4楼（接上） [打开端口] 感染的系统会打开如下端口并处于等待状态(LISTENING). - TCP 任意端口从外部利用该端口可以执行远程控制. 带着恶意心理的人连接他人电脑时会执行(运行程序, 删除资料等) 或者盗取个人信息，各种文件，机密文件. [修改 hosts] 修改HOSTS 文件，搜索特定主机名称时会提示错误的地址让用户找不到正确的相关地址. 并防止连接相关防病毒网站或者升级防病毒软件的版本的地址. 拦截的地址如下. 127.0.0.1 www.symantec.com 127.0.0.1 securityresponse.symantec.com 127.0.0.1 symantec.com 127.0.0.1 www.sophos.com 127.0.0.1 sophos.com 127.0.0.1 www.mcafee.com 127.0.0.1 mcafee.com 127.0.0.1 liveupdate.symantecliveupdate.com 127.0.0.1 www.viruslist.com 127.0.0.1 viruslist.com 127.0.0.1 viruslist.com 127.0.0.1 f-secure.com 127.0.0.1 www.f-secure.com 127.0.0.1 kaspersky.com 127.0.0.1 www.avp.com 127.0.0.1 www.kaspersky.com 127.0.0.1 avp.com 127.0.0.1 www.networkassociates.com 127.0.0.1 networkassociates.com 127.0.0.1 www.ca.com 127.0.0.1 ca.com 127.0.0.1 mast.mcafee.com 127.0.0.1 my-etrust.com 127.0.0.1 www.my-etrust.com 127.0.0.1 download.mcafee.com 127.0.0.1 dispatch.mcafee.com 127.0.0.1 secure.nai.com 127.0.0.1 nai.com 127.0.0.1 www.nai.com 127.0.0.1 update.symantec.com 127.0.0.1 updates.symantec.com 127.0.0.1 us.mcafee.com 127.0.0.1 liveupdate.symantec.com 127.0.0.1 customer.symantec.com 127.0.0.1 rads.mcafee.com 127.0.0.1 trendmicro.com 127.0.0.1 www.trendmicro.com 注) HOST 文件以 windows系统文件夹的类型以版本不同有差异. 在Windows 95/98/Me C:\Windows\System, windows NT/2000, C:\WinNT\System32\Drivers\ETC , windows XP是C:\Windows\System32\Drivers\ETC 文件夹. [删除文件] 在文件名里包含 sound 就会删除. * 恶性 IRC bot 功能试图连接特定 IRC(Internet Relay Chat: 利用因特网的一种聊天服务)服务器和聊天室. 连接成功后，以管理者(Operator)的身份执行恶意控制. 一般可运行的恶性功能如下.但IRC 服务器管理者封闭该聊天室时，该恶性功能不会运行. - 运行文件并删除 - 下载文件并装入 - 泄露系统信息及网络信息 - 记录用户输入的内容(泄露用户的密码) - 对特定 IP进行攻击 (因增加网络流量会崩溃) - 泄露特定游戏 CD 密码试图连接的地址如下. 28..15.*9 21.6..5 注) 一些地址由 * 来替代. 在以下网站中试图下载恶性文件. www.sc**nd.nt www.u*ene.nl vio.fr www.1d1.de www.wh.ch www.bue.e de.**o.com www..net www.stod.ed* www.v**o.cm www.n**tr.com www.r.e www.co*tco.c www.b*t.n *ro.uc.eu www.l*l.cm www.ab.n www.b.nt.e*.t www.t..ko..jp www.dsia.c www.ny.** 注) 一些地址由 * 来替代
xxookk 初生襁褓狮帖子:19 注册: 2006-02-02 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT