Sinowal/Mebroot，hxxp://jabqnhijyus.com/index.php?tp=001e4bb7b4d7333d

显示全部楼层 · 发表于 2011-9-29 10:35:20

本帖最后由 a256886572008 于 2011-9-29 10:56 编辑

看右下角，comodo 都已經發現這麼大的動作，AVG link scanner 一點反應也沒有

2011-09-29 10:25:31 C:\Documents and Settings\Roger\Local Settings\Temp\0.021654800986286915.exe Sandboxed As Partially Limited

2011-09-29 10:25:39 C:\Documents and Settings\Roger\Local Settings\Temp\0.021654800986286915.exe Modify Key HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations

2011-09-29 10:25:39 C:\Documents and Settings\Roger\Local Settings\Temp\0.021654800986286915.exe Direct Disk Access \Device\Harddisk0\DR0

2011-09-29 10:26:04 C:\Documents and Settings\Roger\Local Settings\Temp\13F.tmp Sandboxed As Partially Limited

2011-09-29 10:26:06 C:\Documents and Settings\Roger\Local Settings\Temp\140.tmp Sandboxed As Partially Limited

2011-09-29 10:26:11 C:\Documents and Settings\Roger\Local Settings\Temp\13F.tmp Modify File C:\WINDOWS\system32\drivers\nsv42.sys

2011-09-29 10:26:11 C:\Documents and Settings\Roger\Local Settings\Temp\13F.tmp Modify File C:\WINDOWS\system32\providorzra82.dll

2011-09-29 10:26:13 C:\Documents and Settings\Roger\Local Settings\Temp\13F.tmp Install Hook C:\Documents and Settings\Roger\Local Settings\Temp\143.tmp

掛馬網站：
hxxp://jabqnhijyus.com/index.php?tp=001e4bb7b4d7333d

dll網馬：
hxxp://jabqnhijyus.com/w.php?f=26&e=2

其他：
hxxp://jabqnhijyus.com/content/worms.jar

显示全部楼层 · 发表于 2011-9-29 10:42:59

mb kill2x

显示全部楼层 · 发表于 2011-9-29 10:44:39

本帖最后由 dalianjhc1986 于 2011-9-29 23:57 编辑

eset拦截下载上报文件eset

Thank you for your submission.
The detection for this threat will be included in our next signature update.

Regards,

Malware Research Team
ESET spol. s r.o.

显示全部楼层 · 发表于 2011-9-29 10:53:16

毒霸kill

显示全部楼层 · 发表于 2011-9-29 10:56:58

小a吃果果的无视

显示全部楼层 · 发表于 2011-9-29 11:13:46

BitDefender
0.021654800986286915.exe Gen:Variant.Kazy.38732
jar_cache1223043686640339135.tmp Gen:Variant.Kazy.38732
13F.tmp Gen:Variant.Kazy.37995

显示全部楼层 · 发表于 2011-9-29 11:20:02

norton2012没反应！

显示全部楼层 · 发表于 2011-9-29 11:35:54

Trend Micro Web Protection Add-On全拦截

显示全部楼层 · 发表于 2011-9-29 11:41:43

，另外一个WD clean

显示全部楼层 · 发表于 2011-9-29 13:26:44

Panda Cloud Antivirus
Trj/CI.A

[病毒样本] Sinowal/Mebroot，hxxp://jabqnhijyus.com/index.php?tp=001e4bb7b4d7333d

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源