Win32/Gapz

360Tencent

http://blog.eset.com/2012/12/27/win32gapz-new-bootkit-technique

http://blog.eset.com/2012/12/27/win32gapz-steps-of-evolution

3 droppers

zmzcy

诺顿清空

huicuan

密码是什么啊

3801187

huicuan

3801187 发表于 2012-12-27 21:24

哥哥密码是啥啊

huicuan

瑞星剩余一个文件

夜ㄝ殇

q管kill all

a256886572008

2012-12-27 21:38:13   C:\virus\Win32Gapz\Win32Gapz\82a19f2e4c9a1b4295a51df9d23af84aae848a7984c141a0c7f67b3bbb77b271.exe   Sandboxed As   Partially Limited   

2012-12-27 21:38:15   C:\WINDOWS\System32\svchost.exe   Sandboxed As   Partially Limited   

2012-12-27 21:38:20   C:\WINDOWS\system32\svchost.exe   Modify File   C:\virus\Win32Gapz\Win32Gapz\82a19f2e4c9a1b4295a51df9d23af84aae848a7984c141a0c7f67b3bbb77b271.exe   

2012-12-27 21:38:20   C:\WINDOWS\system32\svchost.exe   Modify Key   HKUS\S-1-5-21-448539723-261903793-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Run\SOPAgent   

2012-12-27 21:38:20   C:\WINDOWS\system32\svchost.exe   Modify File   C:\Documents and Settings\All Users\Application Data\SOPAgent\sopag_jcxejjs.exe   

這隻不錯，svchost.exe 會寫磁盤

2012-12-27 22:05:54   C:\virus\Win32Gapz\4768c3d2b522c8f42a2123594961dea3d531876aacd47fce626d70fe9eca0cd6.exe   Sandboxed As   Partially Limited   

2012-12-27 22:05:56   C:\WINDOWS\System32\svchost.exe   Sandboxed As   Partially Limited   

2012-12-27 22:06:01   C:\WINDOWS\system32\svchost.exe   Direct Disk Access   \??\PhysicalDrive0   

2012-12-27 22:06:01   C:\WINDOWS\system32\svchost.exe   Modify File   C:\virus\Win32Gapz\4768c3d2b522c8f42a2123594961dea3d531876aacd47fce626d70fe9eca0cd6.exe   

2012-12-27 22:06:01   C:\WINDOWS\system32\svchost.exe   Modify Key   HKUS\S-1-5-21-448539723-261903793-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Run\PiracyGuard   

2012-12-27 22:06:01   C:\WINDOWS\system32\svchost.exe   Modify File   C:\Documents and Settings\All Users\Application Data\PiracyGuard\pguard_ctfdbwq.exe   

s8706042

huicuan 发表于 2012-12-27 21:26
哥哥密码是啥啊

infected

XywCloud

巡警
云kill1X
启发kill2X
清空。