来自救援区的感染型样本，欢迎各位前来测试修复能力！！！

zhou0197

样本在此：http://pan.baidu.com/share/link? ... 22&uk=154382069

密码：virus


火眼：http://fireeye.ijinshan.com/anal ... 1b0&type=1#full


VT：https://www.virustotal.com/en/fi ... nalysis/1383925262/


求各路修复能力NB的杀软前来测试…………蜘蛛似乎已经不幸失败了…………


update ！：这些是我用MD拦截下来的衍生物，貌似很多都是后门——http://pan.baidu.com/share/link? ... 92&uk=154382069      

密码：virus

Luca.l

火眼分析
文件名称：感染样本.rar
MD5：b2b1047e5efcdd8f18f6e7bdb1959fe6
Sha-1：69aa4c25d07c921eeebcd09c73825a658d542d08
文件大小：5.80MB
创建时间：2013-11-09 00:55:38
文件类型：RAR
PEID信息：Not a valid PE file

Luca.l

火眼分析
文件名称：感染样本.rar
MD5：b2b1047e5efcdd8f18f6e7bdb1959fe6
Sha-1：69aa4c25d07c921eeebcd09c73825a658d542d08
文件大小：5.80MB
创建时间：2013-11-09 00:55:38
文件类型：RAR
PEID信息：Not a valid PE file

hddu

毒霸：杀2余1
报MyWeather.exe安全   

hddu

运行AutoUpDate.exe：

2013-11-09 01:23:40    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\@AE118.tmp.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Temp
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2013-11-09 01:23:41    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\@AE118.tmp.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\*.exe


2013-11-09 01:23:48    修改文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\@AE118.tmp.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\*.exe


2013-11-09 01:24:00    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\@AE118.tmp.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\*.exe


2013-11-09 01:24:03    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\@AE118.tmp.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c ""C:\Documents and Settings\Administrator\Application Data\Temp\Administrator0.bat" "
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2013-11-09 01:24:04    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
触发规则:应用程序规则->程序->?:\*


2013-11-09 01:24:08    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\@AE118.tmp.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c ""C:\Documents and Settings\Administrator\Application Data\Temp\Administrator1.bat" "
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2013-11-09 01:24:22    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Identities\Administrator\arc.dll
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*.dll


2013-11-09 01:24:22    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\Addins
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\Windows\*


2013-11-09 01:24:22    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\Addins\att.dll
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\Windows\*


2013-11-09 01:24:22    修改文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\Addins\att.dll
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\Windows\*


2013-11-09 01:24:22    修改文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\Addins\att.dll
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\Windows\*


2013-11-09 01:24:22    修改文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\Addins\att.dll
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\Windows\*


2013-11-09 01:25:05    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Common\Shared\dis.dll
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*.dll


2013-11-09 01:25:16    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Shared\Modules\fil.dll
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*.dll


2013-11-09 01:25:18    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Repairs\sha.dll
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*.dll


2013-11-09 01:25:19    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Caches\Files\usd.dll
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*.dll


2013-11-09 01:25:24    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Defender\launch.exe
触发规则:应用程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Application Data\*.exe->?:\Documents and Settings\*\Application Data\*.exe


2013-11-09 01:25:26    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Defender\launch.exe
触发规则:应用程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Application Data\*.exe->?:\Documents and Settings\*\Application Data\*.exe


2013-11-09 01:25:31    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Messenger\Extension\WdExt.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c ""C:\Documents and Settings\Administrator\Application Data\Temp\Administrator1.bat" "
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2013-11-09 01:25:32    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Defender\launch.exe
命令行:/i 1012
触发规则:应用程序规则->程序->?:\*


2013-11-09 01:25:32    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Defender\launch.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
注册表名称:Windows Defender Extension
触发规则:所有程序规则->自动运行->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*


2013-11-09 01:25:32    创建远程线程      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Defender\launch.exe
目标进程:C:\WINDOWS\explorer.exe
触发规则:所有程序规则->*


2013-11-09 01:25:32    创建远程线程      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Defender\launch.exe
目标进程:C:\WINDOWS\explorer.exe
触发规则:所有程序规则->*


2013-11-09 01:25:33    创建远程线程      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Defender\launch.exe
目标进程:C:\WINDOWS\explorer.exe
触发规则:所有程序规则->*


2013-11-09 01:25:33    创建远程线程      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Defender\launch.exe
目标进程:C:\WINDOWS\explorer.exe
触发规则:所有程序规则->*


2013-11-09 01:25:37    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Defender\launch.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c ""C:\Documents and Settings\Administrator\Application Data\Temp\Administrator0.bat" "
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2013-11-09 01:25:38    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\wtmps.exe
触发规则:所有程序规则->其它程序设置->*\Temp\*


2013-11-09 01:25:38    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\wtmps.exe
文件路径:C:\WINDOWS\system32\mscaps.exe
触发规则:应用程序规则->TEMP临时文件夹（二）->*\Temp\*->%WinDir%\system32\*


2013-11-09 01:25:39    修改文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\wtmps.exe
文件路径:C:\WINDOWS\system32\mscaps.exe
触发规则:所有程序规则->WINDOWS文件设置->%windir%\system32\*.exe


2013-11-09 01:25:39    删除文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\wtmps.exe
文件路径:C:\WINDOWS\system32\mscaps.exe
触发规则:所有程序规则->WINDOWS文件设置->%windir%\system32\*.exe


2013-11-09 01:25:39    删除文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\wtmps.exe
文件路径:C:\WINDOWS\system32\mscaps.exe
触发规则:所有程序规则->WINDOWS文件设置->%windir%\system32\*.exe

aplk1002

卡巴全殲 不過沒有修復

jayavira

卡巴 kill all
无法修复

2013/11/9 6:14:34        已删除        木马程序 Trojan-Dropper.Win32.Daws.awfy        C:\Users\Administrator\Downloads\感染样本\感染样本\AutoUpDate.exe        高       
2013/11/9 6:14:39        已删除        木马程序 Trojan-Dropper.Win32.Daws.awfy        C:\Users\Administrator\Downloads\感染样本\感染样本\VStart.exe        高       
2013/11/9 6:14:39        已删除        木马程序 Trojan-Dropper.Win32.Daws.awfy        C:\Users\Administrator\Downloads\感染样本\感染样本\MyWeather.exe        高       

XywCloud

占位测试
超级巡警没有发现感染型病毒。
百度杀毒国际版云杀1个，启发杀2个，也没有发现感染型病毒

275751198

360卫士 本地QVM启发3个，金山云引擎杀掉2个

shihaono1

管家