Avira 病毒搜索

TR/Crypt.EPACK.wlvz

  • 名称
    TR/Crypt.EPACK.wlvz
  • 发现日期
    2016年3月31日
  • 类型
    Malware
  • 影响
     
  • 报告的感染
     
  • 操作系统
    Windows
  • VDF 版本
    7.12.76.138 (2016-03-30 16:04)

术语“TR”指的是能够窥探数据、侵犯您的隐私或对系统进行不需要的修改的特洛伊木马。

操作系统:Microsoft Windows。

传播方式:通过执行受感染的文件。

传播方式:通过访问受感染的网站。

这款恶意软件会窃取敏感信息。

  • VDF
    7.12.76.138 (2016-03-30 16:04)
  • 别名
    Bitdefender: Gen:Variant.Razy.35631
    ESET: Win32/Kryptik.ESUA
  • 文件
    删除以下文件:
    • %DISKDRIVE%\Documents and Settings\All Users\r85ltp7
    • %APPDATA%\n7bevr0
    • %DISKDRIVE%\Documents and Settings\All Users\7912
    • %APPDATA%\379sb
    创建以下文件:
    • %DISKDRIVE%\Documents and Settings\All Users\rp\pkid.wdf
    • %TEMPDIR%\eksc.seo
  • 注入
    • %SYSDIR%\rundll32.exe
    • \??\%SYSDIR%\winlogon.exe
    • %WINDIR%\Explorer.EXE
    • %PROGRAM FILES%\Adobe\Reader 9.0\Reader\Reader_sl.exe
    • %PROGRAM FILES%\WinPcap\rpcapd.exe
    • %SYSDIR%\wscntfy.exe
  • 注册表
    会添加以下注册表项目:
    • [HKEY_CURRENT_USER\Software\Microsoft\EKS] "ejr" = %hex values%
  • HTTP 请求
    • ssksxalx.*****vudwve.php?vltqmz=104103422859626&skx=84806567&gizsxnaw=0752364408604452
    • ssksxalx.*****wp.php?ikhp=896590392946599&trnyg=rt3zy08MDtOf&ioyvdppm=26333908627&rjzraw=nyjcvonure&ddhyw=005765536782657&vdwctpv=rpsulfudke
    • ssksxalx.*****xyheiv.php?ygvhbciq=606136409325&wxqala=hxzpypa&qvukak=3767388694162740&qtnnbs=cyhhel&qrsfxn=00464&xcazvv=351600501370674
    • ssksxalx.*****sgc.php?ycmnxt=5514586422302599&lmavlydh=36034&ltav=2zz4O7Wj1nIyFw5Ynfb7X&vnff=0734603&kozh=ammlrdbqkb&atkmcfb=ohxhzv
    • ssksxalx.*****ox.php?vfxnwtiz=5206368927133&zezpcac=6gLdqcgM46a2
    • ssksxalx.*****iyzcq.php?nzszuw=90155489&eygf=erwhciokkr&ymmgjvb=16554956194753224&dzxknx=rGyoOO3mv3sa7K9rBCvHSv&uvgwb=57424&ujhwylku=5849975684015275516&bxotd=scubd&ykef=1laYtP9xrdogMnis6erwdNv
    • ssksxalx.*****kkxm.php?oqpxbp=tqnpvdovkc&smolwhb=75637998043236&kwz=4249873958368447&dqphvwu=6D3ykb0ut909HAn6si3gnw&mwmag=W73x0hpLDfpGW4lE2r4&cpogye=TelFE81A04yWi4l&pghl=LrlSAp
    • ssksxalx.*****veyli.php?jfn=340588841070223&pdka=9739886176869798&ykvgv=pq93gsi1637G&uyly=982931396&woydk=rqcj
    • ssksxalx.*****opc.php?xdaom=fwaqmcf&kcqivi=142461403570648969&nuwdj=6903131&fbnxf=drDXt7MqxdJ&izd=1453732614&fnypptij=1341517938
    • ssksxalx.*****grjtax.php?fzllhel=qNiwdhmuxKeA9wD&rcswigt=ivlyg&ccirysb=xaq
    • ssksxalx.*****scqjmh.php?ebfbliv=723332239286097&glnlexye=lesobtb&veo=zGCb2r&cmramfez=442348496161125899
    • ssksxalx.*****lf.php?jordsgm=sqbkde&qlw=mgh2WWsmpHfpdoEZ1
    • ssksxalx.*****xauouh.php?vwcgix=jjgjqjow&ozdatc=07XbfxqrCwtVwjj8ivhJWwxka9zQ&spfw=t3zuxOeV1cdku75b55K7rqv4VgY
    • ssksxalx.*****fvccpt.php?wucnps=kKlWuyMjo3e68f&ejec=4725498471&zbvm=yzkft&xndxgg=85493&askjqvbg=7676637788818985&vhjnljl=atm&miqwzelm=90843005086902&kiui=xvay
    • ssksxalx.*****kn.php?awjdt=27avlmwjmdpcvcCugCM82py&aklbm=VPfrI6wyk4fyn
    • ssksxalx.*****opisx.php?bgxvfzxo=r3Mr8OQ6n&zcj=4271259018012998625
    • ssksxalx.*****wiwzze.php?mvpfgt=1NRy4eceo6FnlJ725Ma&cygvipu=ZYBTe5oDez8X&rjwirrlc=7748130&ghulrhnx=9346352869445&wbqxfya=dmzsi&iljeayc=udqgbfmwrf&okcct=67687
    • ssksxalx.*****fh.php?aqqvn=5560974605013&fgtnks=0039411775963
    • ssksxalx.*****jwzb.php?aqci=onE8Wc9&mtzqyqu=spvyita&ryod=cmlya&nkrtodc=705716140190841277&queh=21037164452591555
    • ssksxalx.*****kh.php?vzsq=7w47isU&sezp=4280815&ocrj=xzVq8n9ToClpAdJE8TJdv4l69wq
    • ssksxalx.*****nxyaau.php?nqytj=blg&fba=288484007082583&cnzc=5565596074&jwbp=nevlqrffzx&yxal=573361&lyl=2926444018656&lctr=nydjzof&ivbzix=8tY8vQTW55l
    • ssksxalx.*****bij.php?uji=bSjP8Ig&iwun=dtdpEbgtno2rfzorhB&cqnvepx=79146329496&mgpjo=asANRZ2AN2o6979Yl7Al3I8
    • ssksxalx.*****qfxgxtk.php?tfn=94017558210&hxyvp=hcdhoa&whzbgl=1j6xjwtj
    • ssksxalx.*****iucnqkg.php?bhwtwl=r91VHIl4kr83&wgic=m6bPomY13j83F&grv=4158yxasstqMj&xcitku=yhagld&bjqyves=65957091
    • ssksxalx.*****uzb.php?nvjqdwul=554590267&qbigxcf=sfvzdpgskv&nuzkc=terczI1H6NO&goawya=463053840100
    • ssksxalx.*****qe.php?vucxkrem=yqqUuQ8egX&ytxz=06978435393545&tgrwsarg=prsyrwsh&ninld=37399&pwq=61096752814970&quoul=9507719271927744
    • ssksxalx.*****gp.php?dlzd=90058323248529535&aozc=1DPkp6U&oltgn=rcrgtrz&bskyf=38168849088218842&xxm=4036355609&breqfsi=3800208997218943&vuxllk=412853920&yejg=nNtI2d8wDgTlw6582D51hscZ87
    • ssksxalx.*****uycpiws.php?ytc=jfkrjDQ0eZNyQ&hpv=40VCD8rlpyhLzb
    • ssksxalx.*****yt.php?obhkht=904477085829424041&iho=n6kcqQ3nca5N&qjlvx=Co4dm8&dswf=Ea209n3HzWF85Utrar&hccx=prh&cmjmx=wmzvvbg&vvn=cly3mlhnfV0JssHlUf
    • ssksxalx.*****bavmcgw.php?oljr=875920029&wxfcnwy=72808767732916&yhbogv=309870050530095&gobptr=Tr4ilQ6&rkoqrvda=omr7yK6md2mmCg6HWrB3b1pxvIh&savcm=O63phhWhm3q0aM
    • ssksxalx.*****rug.php?zci=yphgnisf&pvwfjsj=163111501526&jqwauwt=2838128&dlg=pqvcol&vaues=46461779&uvw=1110576648892567129&toov=apn
    • ssksxalx.*****wnjik.php?wch=845753034&lssojq=jfxoJntkkOftqIJX&yitrg=52363235732699&cup=J1Rfx&fjcee=qZ84Q8h8k9LSkipk0
    • ssksxalx.*****ko.php?pqj=1311134633854880&hig=wm71084Rd5i40txC5mtp36L9sp&tkw=5581340021761773505&ztwd=195521&hoqs=ooasfqfzon&pugamfnv=ez4gmj03oa
    • ssksxalx.*****pnljd.php?dgwlklsw=06083&iemcjyd=71422
    • ssksxalx.*****pbantk.php?brigdfm=138408667141&znvkizes=181899&idgq=1469879824&anvrw=93431125466291
    • ssksxalx.*****lad.php?xsgroqs=wlny&auwbu=Ze63QGp6LcbMp8&ioa=9420409481486&igjenf=s59PfanmcoDx9xpbNguE0Ws20&xaorpawb=67992457733&atmvfp=HaI19a2un75pzv6
    • ssksxalx.*****ezk.php?npqr=noujyo&rmtl=Ojw00q7jvqlg&uks=clrac&jsjiq=swftq&fbwg=931066158295060278&asxdfrp=3571168968256843&qkjo=0323232098
    • ssksxalx.*****wzfrzmb.php?qxxcgt=rlzsmrg&jexbhizy=32938868641616&ddsxkaqy=oDPQy4322k1K3NKUsV4QNl
    • ssksxalx.*****lzz.php?zpiatepp=0886543246536720881&fovsjl=71403
    • ssksxalx.*****bq.php?sne=bRzpQCrQq75Jqtc0Yp&fzhdqnj=zjdnnyhsnx
    • ssksxalx.*****cvshla.php?cpi=hhhGhw4sr1w5JhiTSEpaaeF&tvm=lqricrr&oiawqwql=17291520430233281&buzc=YWdZVd&fbiaa=Y4ale&qrcvnr=lGGtc7qQE1aI
    • ssksxalx.*****wafz.php?neqrs=fch&geoovzoq=VN7hDU9GdrixR8da6G1r9spZCY&nts=207244223616548&jdmey=410236&imnk=27558680423&uxp=1851203&ikhjkz=472686077&sxqe=9HzsUr
    • ssksxalx.*****vrrl.php?hyk=660227864808899849&tdjn=oZx0WjPhfVp47vloTsu3mBVa&xwlsbmcj=mZnaS506wN&ixjx=092017969316
    • ssksxalx.*****lto.php?lehrlza=81486&gyf=46PEjtpWNdd9Jw&vtx=Qh0Fn9N&sorksv=72514101077365108&uhcva=56738849434676
    • ssksxalx.*****nekdx.php?xvm=2mbw9f3Yefx&oufevcb=yjyoolp&fjcos=771882447665227
    • ssksxalx.*****kwrmx.php?snuxlkg=ydwx&htirlg=wlqjzewye&phj=735680924675955
    • ssksxalx.*****cdjjasr.php?ntgo=8661202556364&rjaq=VeOYfN5e3281o1Jq7O70S&bkv=drvlzwzy&prmkuup=rm2znmmxaWFKGMpUi0&srtqyi=6425710617241054&vbshfm=vhspc4XQSv&lneauyr=alhkdusv
    • ssksxalx.*****cafh.php?zxmztxql=SFzhEUjHqxxqdsPRalnx1m1x3&boisyueb=7d4PDg0a&hmxnsw=ksoimnbmkq
    • ssksxalx.*****nafvpv.php?zpou=35095972881575637319&onnzlk=751498&vxphrex=bbld&bloe=jlOpe9V5B4qip9348AWwiRj2Cp&vhfybmjh=606398705829&qywmudan=81499866243&rtwl=0848409&ajsygb=ytazanos
    • ssksxalx.*****anntn.php?jsiyfpsf=hyfom&cab=rTSFOrAY6bN
    • ssksxalx.*****ljykhqc.php?acbp=W78vXwt&aqi=3313302635955898009&idx=48078500503434853
    • ssksxalx.*****iehzyyb.php?kvyfvzst=gvpiqffl&nbodfjfu=68052067463299517&hkyp=8932637764&fafmilhi=74955299511522820320&xfe=7792205950582144
    • ssksxalx.*****oknm.php?srjvi=67107780576&nhxph=9834669497&dvedhn=53ecqe92Oy3U71yfJw5Qkg8qfp7A&hmoaj=R49FrMH4aOg0DqtdGmt8yxrg
    • ssksxalx.*****miityfn.php?qdzcf=kqqdz&blb=24775522&kfk=vtopgqbv&mqc=Zz07Mum&dygjcpi=iwnmxh&trybh=qoemxik
    • ssksxalx.*****cc.php?frln=0lwLypv2dfiSwDx9RD8&hwaolfnd=50029748
    • ssksxalx.*****cunl.php?diaaba=gicpc&ltzxb=2205294644431425667&jmxkms=ap81i2H4g&wjwdfhhg=5l1cta3jXe8bpaxvRVm4
    • ssksxalx.*****nskczb.php?makmgg=94826931691440203&karqhppc=2252726699334706618&psah=hnwwhpfy
    • ssksxalx.*****bltpc.php?jkrdwvaj=48679066011174323963&bpm=50952551478
    • ssksxalx.*****oxozbf.php?jcrizf=50875584&tbhack=u4t8g&ohh=5958436124252371089&qyv=304494016007&cufbuiv=19519296369&nzwm=jghura&edfbstz=zhykehbpqt&ojb=u6cua18q9227q0jw6DuK
    • ssksxalx.*****fwgdgo.php?puve=42073621&oomkaep=aKvpYdWl4fha7zh4afyn&pibth=MgsZZCMpu7&makon=1248031&ymycwnm=nifvweyyw&qsfv=4569536094486&wkylwppw=JJT4r92DJM5iEnHJ0msin3QTu&hwkut=1yTnNymj9AFm3oxsM7
    • ssksxalx.*****kfxwi.php?myrjhyr=956230023&gzutvgx=7432029906356190&rolwign=mknxbln&etrd=628791543994377227&ajhxabu=dniVMgiHwcXsjHkMeHR&fgj=y6Ubi58OiThRm
    • ssksxalx.*****lbnevd.php?oew=wfofvpbd&xhuroz=lW1g4ufzkTq7sYaVgewuwuz&eocpv=GX62ufaJ76z40f6
    • ssksxalx.*****qltv.php?lpzfqzw=64848438022870&cgefnlzj=egwmcm&rmkzgj=3025328784339915
    • ssksxalx.*****fmbv.php?czsy=0778599007774411&rtqqdv=sd0vsNSeHTutemqlj4&hcv=62ycYmf8blrroPs9Y2YvEcdejp&htdxadx=lwlo&vbglr=evnutdu&glt=arufxzqp
    • ssksxalx.*****ktjjp.php?emeybz=pobqbgdzs&zgecixui=34303&gucnftf=146216069&mzyjtpxt=8mu6F679HQYvkKGr5Zrly8&ummalb=s9s1HbtHfh&yxg=ewwz&oip=bnfbb
    • ssksxalx.*****xu.php?smd=ohmq&vwhsqzrd=0755629184568087&aszjgalu=J9n2nU8q6ZsHJCeazk&nwptm=tmzcfk&xpiq=amy6gojfl1HyIkk
    • ssksxalx.*****rnlme.php?rgagr=210457354121&mvd=umyd&vyqzuji=g3mgzCkD73jy3u75urylKTTp&zwahl=61095795&omvz=L3tx95PNrc2nwT6xi
    • ssksxalx.*****lvdpyj.php?ynrmn=K7rujG90As1N96qAT3qzRhzJz&fbb=wqcawddui
    • ssksxalx.*****rpyez.php?htkrbl=iO2toK7mujurUgnB78w76&jcesz=77078503101272805446&neziy=jbhefjqjo&qcse=cbom&zzxnon=Bbrr2yh2FnX&ino=kuvuajmmwv
    • ssksxalx.*****toc.php?wbhd=zs3Wq7f7s0jbrfoq1XaOE0&brehfbhu=zauwxia&odvcq=hou&vkot=i6BgldY
    • ssksxalx.*****awx.php?zevtd=gmjMUuaycb&sjskotng=0464688058192001&xxg=lwkYgf&rvvxy=NGCKxa99onETv&puo=1382223787922864&haqpouc=218623510&qwyge=7Ptvb3Ve588A6O69G&jyoit=743624792361216344
    • ssksxalx.*****asl.php?vmdbng=chUojiIg0srFiLM&svqyhc=Utlf1jGghnE4Lxtd10NBw&kyzv=8067777853
    • ssksxalx.*****mr.php?rtzkkde=7031437595689737&gejrwdfh=0866467822756374&xubsn=dlvtxheefd
    • ssksxalx.*****etwqid.php?ffvikj=8730887477455&uiue=qLfXFanWT
    • ssksxalx.*****mujwfh.php?ztsogrg=2784040&uamtocns=0b0Pvpd8l9W&uihak=khe
    • ssksxalx.*****pe.php?rowe=545294530787970&keqrtjk=mhnpzclbKaRsY6mAnfyk3L&lsnmqvp=fdctbpfrjx&xltoq=40335839185&gpxsy=fhpad
    • ssksxalx.*****cocp.php?vkaptjy=wcdx&dok=Y22Y77xzIAgoUc6gPy4XJaq1m&hrswdxsq=3981007864896340&pdtke=2RDTdf3fqFj3Bk7RcWe4rsU&hxcelv=1136082756&vptz=52025592
    • ssksxalx.*****dfjuu.php?ugjluc=173931152035509462&grh=J0k3Hz0SmfjQi8s12dFdMp&kyzcqrt=iXNX1AvaadiMBugn7
    • ssksxalx.*****wqkpyaq.php?klsdv=m39HydRtafjqngAliomg5oK6zo&qwvby=8726953007&fxrhq=SeYs6lqgpIe
    • ssksxalx.*****vcpue.php?ajbboh=3823285886&lvwtb=t0234h34lh2Xuxr03P&wayljsei=5248940134076365655&ppa=yozwto&bpdxrpgi=597281676918268080
    • ssksxalx.*****igqr.php?tychkxfl=9996478369926&zhupacgw=30806926579808&ibllpr=5WpxM00k861x6i2Zr7Zg94vQk2F6&ximdzx=482186773894514&xdw=pF1gHmgc&hprl=iloqucag&ljgubuv=xjdymmdcn&tonton=qAypyfW4j03Q1nzn9zG49En3urge
    • ssksxalx.*****exrt.php?frtcxq=7794412744995943&bobqduxx=0821313107803372&gcpuz=ppzoyk&yledhk=71349&oors=163330102
    • ssksxalx.*****iwgiy.php?dir=93314825354&aaajl=3fuip42hOVqKiI7o70gmxt&nyi=aweajz

将可疑文件/URL 送予我们分析,帮助构建更加安全的网站。

提交您的文件/URL 或者 转到 Avira 疑难解答

为何提交可疑文件?

如果您遇到不在我们数据库中的可疑文件或网站,我们将对其进行分析,确定其是否有害。我们的分析结果将惠及数百万用户,并将纳入下一次病毒数据库更新。如果您已经拥有 Avira,则会获取此更新。尚未拥有 Avira? 请前往 获取

什么是 Avira 疑难解答?

这是我们大力发展的社区,由专业技术人员和兼职专家通力合作,为广大用户解决技术问题。这一 Avira 用户社群是提出问题的绝佳场所。