本帖最后由 wjcharles 于 2010.7.23 22:59 编辑
优盘去学校实验室电脑插了一下，回来发现中奖了，没想到传说中的0day漏洞竟然这么快影响到我了。。。大家要小心啊
MSE日志：
Microsoft Antimalware has detected spyware or other potentially unwanted software.
For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=Exploit:Win32/CplLnk.B&threatid=2147636391
Name: Exploit:Win32/CplLnk.B
ID: 2147636391
Severity: Severe
Category: Exploit
Path: file:M:\__e__.lnk;file:M:\__f__.lnk;file:M:\__g__.lnk;file:M:\__h__.lnk;file:M:\__i__.lnk;filelocalcopy:C:\ProgramData\Microsoft\Microsoft Antimalware\LocalCopy\{31942C15-FCD7-4F3D-B7E7-5BC52DD1C9E0}-__h__.lnk;filelocalcopy:C:\ProgramData\Microsoft\Microsoft Antimalware\LocalCopy\{98A81616-F2C5-42D4-ABE1-BAE41AF739B0}-__f__.lnk;filelocalcopy:C:\ProgramData\Microsoft\Microsoft Antimalware\LocalCopy\{9A4B4792-33A8-4986-9A93-5D2CD44DA9A6}-__i__.lnk;filelocalcopy:C:\ProgramData\Microsoft\Microsoft Antimalware\LocalCopy\{CF1A460F-219A-4AC5-AA8E-8AD944E8BC6B}-__g__.lnk;filelocalcopy:\\?\C:\ProgramData\Microsoft\Microsoft Antimalware\LocalCopy\{C20F9126-DA2A-4875-A459-9621A3EDA72D}-__e__.lnk
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Status: Suspended
User: LH-2UYY8QJXV2NM\Administrator
Process Name: C:\Windows\explorer.exe
Signature Version: AV: 1.87.421.0, AS: 1.87.421.0
Engine Version: 1.1.6004.0
NIS的日志：
2010/7/23 22:36,高,检测到 autorun.inf (W32.Downadup!autorun) (检测方: Auto-Protect),已隔离,已解决 - 不采取操作
微软的病毒百科：
注意病毒还是新版的。。。
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Exploit%3aWin32%2fCplLnk.B&threatid=2147636391
Exploit:Win32/CplLnk.B (?)
Encyclopedia entry
Updated: Jul 20, 2010 | Published: Jul 20, 2010
Aliases
Alert Level (?)
Severe
Antimalware protection details
Microsoft recommends that you download the latest definitions to get protected.Detection initially created:
Definition: 1.87.193.0
Released: Jul 20, 2010 |
On this pageSummary|Symptoms|Technical Information|Prevention|Recovery
SummaryExploit:Win32/CplLnk.B is a generic detection for the vulnerability that is described by CVE-2010-2568. When a user browses a folder that contains the malicious shortcut using an application that displays shortcut icons, the malware runs instead. An example of an application that displays shortcut icons is Windows Explorer. No further user interaction is required, in most cases.
Top
SymptomsThere are no common symptoms associated with this threat. Alert notifications from installed antivirus software may be the only symptom(s).
Top
Technical Information (Analysis)Exploit:Win32/CplLnk.B is a generic detection for the vulnerability that is described by CVE-2010-2568. Exploit:Win32/CplLnk.B is a minor variation ofExploit:Win32/CplLnk.A.
When a user browses a folder that contains the malicious shortcut using an application that displays shortcut icons, the malware runs instead. An example of an application that displays shortcut icons is Windows Explorer. No further user interaction is required, in most cases.
Successful exploitation results in the malware running with the privileges of the logged-on user.
Additional Information
Analysis by Peter Ferrie
| 
[复制链接]
发表于 2010-7-23 22:57:00
楼主
学校的机器你也敢查U盘？
