又中毒了。。。
症状：开机一个Coilk.exe,运行msconfig之后，发现C:\Program Files\Cffe\Coilk.exe随机启动，不知道什么进程，打开ie，360监控到木马行为(木马居然20m内存...)
原因：1.8装了boundscheck,有病毒，病毒原网址：
http://www.3ddown.com/soft/31594.htm
分析：
文件细节：
C:\Program Files\Cffe
创建时间：2013年1月8日, 18:47:21
C:\Program Files\Cffe\Tepvr
C:\Program Files\Cffe\Tepvr\Coilk.ini
[DRV]
dBat1=41295
dBat2=41283
[SRV]
iC=1
[DBI]
CD1=5DDB3E62C9EC4039
CD2=2352E35A0C5179E0
CD3=B23B3905AD920B87
C:\Program Files\Cffe\Tepvr\Xaze.dll
20.8 MB (21,879,093 字节)
SystemRegister
C:\Program Files\CffeCoilk.exe
20.7 MB (21,730,187 字节)
C:\Program Files\Glekk.exe
20.7 MB (21,803,629 字节)
上传到https://www.virustotal.com/zh-cn/
Agnitum Backdoor.Hupigon!SXmfDxK5Dx0 20130120
AhnLab-V3 Backdoor/Win32.Hupigon 20130120
AntiVir - 20130121
Antiy-AVL - 20130120
Avast Win32:Delf-RA [Trj] 20130121
AVG Generic20.BXTP 20130121
BitDefender Trojan.Banker.MJZ 20130121
ByteHero - 20130118
CAT-QuickHeal - 20130120
ClamAV - 20130121
Commtouch W32/Iyeclore.A.gen!Eldorado 20130120
Comodo - 20130121
DrWeb Trojan.PWS.Banker.54544 20130121
Emsisoft Trojan.Banker.MJZ (B) 20130120
eSafe - 20130120
ESET-NOD32 probably a variant of Win32/Iyeclore.D 20130120
F-Prot W32/Iyeclore.A.gen!Eldorado 20130120
F-Secure Trojan.Banker.MJZ 20130120
Fortinet W32/Delf.NTCC!tr 20130121
GData Trojan.Banker.MJZ 20130121
Ikarus Trojan-Dropper.Delf 20130121
Jiangmin Backdoor/Hupigon.brhv 20121221
K7AntiVirus Riskware 20130119
Kaspersky Backdoor.Win32.Hupigon.ndme 20130121
Kingsoft Win32.Hack.Huigezi.(kcloud) 20130115
Malwarebytes Trojan.Iyeclore 20130121
McAfee - 20130121
McAfee-GW-Edition - 20130121
Microsoft Trojan:Win32/Iyeclore.A 20130121
MicroWorld-eScan Trojan.Banker.MJZ 20130121
NANO-Antivirus Trojan.Win32.Hupigon.dukjs 20130121
Norman - 20130120
nProtect - 20130121
Panda - 20130120
PCTools Backdoor.Trojan 20130121
Rising Trojan.Win32.Yalrevo.o 20130117
Sophos Mal/Delf-BC 20130121
SUPERAntiSpyware - 20130120
Symantec Backdoor.Trojan 20130121
TheHacker Backdoor/Hupigon.ndme 20130120
TotalDefense Win32/Delf.ALG 20130120
TrendMicro BKDR_IYECLORE.AQ 20130121
TrendMicro-HouseCall BKDR_IYECLORE.AQ 20130121
VBA32 Backdoor.Hupigon.ndme 20130118
VIPRE Trojan.Win32.Delf.bc (v) 20130121
ViRobot - 20130120
同时使用命令netstat -ano，开了tcp/udp端口，端口不固定，如
C:\Documents and Settings\Administrator>netstat -ano|findstr 3128
TCP 192.168.1.183:3417 219.138.163.64:80 ESTABLISHED 3128
UDP 127.0.0.1:2701 *:* 3128
C:\Documents and Settings\Administrator>netstat -ano|findstr 3128
TCP 192.168.1.183:3128 119.188.9.119:80 ESTABLISHED 3332
UDP 127.0.0.1:2701 *:*
| 
转播
