Sinowal/Mebroot，http://jabbdstjyus.com/index.php?tp=001e4bb7b4d7333d

a256886572008

密碼：123

2011-09-25 09:49:24   C:\Documents and Settings\Roger\Local Settings\Temp\0.7980349292412589.exe   Sandboxed As   Partially Limited   

2011-09-25 09:49:27   C:\Documents and Settings\Roger\Local Settings\Temp\0.7980349292412589.exe   Modify Key   HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations   

2011-09-25 09:49:35   C:\Documents and Settings\Roger\Local Settings\Temp\0.7980349292412589.exe   Direct Disk Access   \Device\Harddisk0\DR0   

2011-09-25 09:49:57   C:\Documents and Settings\Roger\Local Settings\Temp\C2.tmp   Sandboxed As   Partially Limited   

2011-09-25 09:49:57   C:\Documents and Settings\Roger\Local Settings\Temp\C3.tmp   Sandboxed As   Partially Limited   

2011-09-25 09:50:04   C:\Documents and Settings\Roger\Local Settings\Temp\C2.tmp   Install Hook   C:\Documents and Settings\Roger\Local Settings\Temp\C6.tmp   

2011-09-25 09:50:06   C:\Documents and Settings\Roger\Local Settings\Temp\C2.tmp   Modify File   C:\WINDOWS\system32\drivers\nsv42.sys   

2011-09-25 09:50:06   C:\Documents and Settings\Roger\Local Settings\Temp\C2.tmp   Modify File   C:\WINDOWS\system32\providor2l1g.dll   

a256886572008

進去之後，腳本啟動之後，紅傘 WG 才彈框。

終於發現漏報了

bbs2811125

过AVG
。exe 360 kill 余下两个temp
C3：http://www.virustotal.com/file-s ... 8dbd95a5-1316917794
C2：http://www.virustotal.com/file-s ... 994aafdd-1316917899
红伞、ik、K7均 kill

a256886572008

bbs2811125 发表于 2011-9-25 10:34
过AVG
。exe 360 kill 余下两个temp

進去那個網站，看看 AVG IDP 是否雞肋

bbs2811125

a256886572008 发表于 2011-9-25 10:35
進去那個網站，看看 AVG IDP 是否雞肋

实机，不敢弄，万一挂了还麻烦-.-

hx1997

To ESET.

留侯

过大蜘蛛，已上报

froggy

Palkia

无视密码