騙主防，hxxp://ajitpimayus.com/index.php?tp=001e4bb7b4d7333d

显示全部楼层 · 发表于 2011-9-21 14:55:40

本帖最后由 a256886572008 于 2011-9-21 15:10 编辑

comodo 沒有被騙到，看看你的主防是否被騙

显示全部楼层 · 发表于 2011-9-21 14:56:40

样本呢？

显示全部楼层 · 发表于 2011-9-21 14:57:08

本帖最后由 IOOOOI 于 2011-9-21 14:57 编辑

打不开网页。

显示全部楼层 · 发表于 2011-9-21 15:01:19

倾枫锝渔♂ 发表于 2011-9-21 14:56
样本呢？

想測試主防，自行開IE進惡意網站吧

樣本是 dll文件

显示全部楼层 · 发表于 2011-9-21 15:04:01

2011-09-21 14:47:11 C:\Documents and Settings\Roger\Local Settings\Temp\0.7759767381094348.exe Sandboxed As Partially Limited

2011-09-21 14:47:19 C:\Documents and Settings\Roger\Local Settings\Temp\0.7759767381094348.exe Modify Key HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations

2011-09-21 14:47:19 C:\Documents and Settings\Roger\Local Settings\Temp\0.7759767381094348.exe Direct Disk Access \Device\Harddisk0\DR0

2011-09-21 14:47:47 C:\Documents and Settings\Roger\Local Settings\Temp\25C.tmp Sandboxed As Partially Limited

2011-09-21 14:47:51 C:\Documents and Settings\Roger\Local Settings\Temp\25D.tmp Sandboxed As Partially Limited

2011-09-21 14:47:57 C:\Documents and Settings\Roger\Local Settings\Temp\25C.tmp Modify Key HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations

2011-09-21 14:47:57 C:\Documents and Settings\Roger\Local Settings\Temp\25C.tmp Modify File C:\WINDOWS\system32\NVd211.sys

會寫磁盤

显示全部楼层 · 发表于 2011-9-21 16:10:36

hxxp://ajitpimayus.com/w.php?f=26&e=6

hxxp://ajitpimayus.com/w.php?f=26&e=8

显示全部楼层 · 发表于 2011-9-21 16:30:49

之前那个打不开~

显示全部楼层 · 发表于 2011-9-21 16:32:28

毒霸提交云鉴定~~~
鉴定为病毒~
杀之~

显示全部楼层 · 发表于 2011-9-21 16:47:50

eset 拦截

显示全部楼层 · 发表于 2011-9-21 16:48:02

大蜘蛛均clean，已上报！

[病毒样本] 騙主防，hxxp://ajitpimayus.com/index.php?tp=001e4bb7b4d7333d

本帖子中包含更多资源

本帖子中包含更多资源