2x带签名

显示全部楼层 · 发表于 2011-6-11 20:37:31

去除杀软防护,没什么动劲啊,这毒

显示全部楼层 · 发表于 2011-6-11 20:41:21

小A秒杀

显示全部楼层 · 发表于 2011-6-11 20:58:26

卡巴 KILL

显示全部楼层 · 发表于 2011-6-11 21:01:13

本帖最后由 JusT.Like 于 2011-6-11 21:02 编辑

Virus Signature X1
Behavior Blocker X1 |File-Cloud-Check

*** Process ***
Process: 4812
File name: a.exe
Path: d:\applic\sandbox\vinsk_lee\test\user\current\appdata\local\temp\a.exe
Publisher: Unknown publisher
Started by: shadowg.exe
Publisher: Unknown publisher

*** Actions ***
The program is trying to create a startup item to launch a program automatically at system startup.
The program has created or manipulated an executable file.

*** Quarantine ***
The following files were moved into quarantine:
C:\Users\Vinsk_Lee\Desktop\shadowg.exe
D:\Applic\Sandbox\Vinsk_Lee\TEST\user\current\AppData\Local\Microsoft\Internet Explorer\IEXPL0RE.EXE
D:\Applic\Sandbox\Vinsk_Lee\TEST\user\current\AppData\Local\Temp\a.exe
D:\Applic\Sandbox\Vinsk_Lee\TEST\user\current\AppData\Local\Temp\perf85d210.dat
D:\Applic\Sandbox\Vinsk_Lee\TEST\user\current\AppData\Roaming\LiveUpd360.dll
D:\Applic\Sandbox\Vinsk_Lee\TEST\user\public\Favorites\Cache

The following registry entries were deleted:

显示全部楼层 · 发表于 2011-6-11 21:16:37

大蜘蛛clean，已上報！

显示全部楼层 · 发表于 2011-6-12 00:58:57

怎么没人用红伞扫扫吗？
红伞报毒了。

显示全部楼层 · 发表于 2011-6-12 01:01:42

显示全部楼层 · 发表于 2011-6-12 01:07:41

gsetup.exe 运行后

shadowg.exe 运行后没反应

显示全部楼层 · 发表于 2011-6-12 16:39:53

2011-06-12 16:33:58 运行应用程序    操作:允许
进程路径:F:\virus\Desktop\gsetup.exe
文件路径:C:\WINDOWS\system32\winlogon.exe
触发规则:所有程序规则->系统进程设置->%windir%\system32\winlogon.exe

2011-06-12 16:33:59 修改其它进程内存    操作:允许
进程路径:F:\virus\Desktop\gsetup.exe
目标进程:C:\WINDOWS\system32\winlogon.exe
触发规则:所有程序规则->系统进程设置->%windir%\system32\winlogon.exe

2011-06-12 16:34:00 修改其它进程内存    操作:允许
进程路径:F:\virus\Desktop\gsetup.exe
目标进程:C:\WINDOWS\system32\winlogon.exe
触发规则:所有程序规则->系统进程设置->%windir%\system32\winlogon.exe

2011-06-12 16:34:00 修改其它进程内存    操作:允许
进程路径:F:\virus\Desktop\gsetup.exe
目标进程:C:\WINDOWS\system32\winlogon.exe
触发规则:所有程序规则->系统进程设置->%windir%\system32\winlogon.exe

2011-06-12 16:34:01 修改其它进程内存    操作:允许
进程路径:F:\virus\Desktop\gsetup.exe
目标进程:C:\WINDOWS\system32\winlogon.exe
触发规则:所有程序规则->系统进程设置->%windir%\system32\winlogon.exe

2011-06-12 16:34:01 创建文件    操作:阻止
进程路径:C:\WINDOWS\system32\winlogon.exe
文件路径:C:\WINDOWS\system32\eset.dll
触发规则:应用程序规则->WINDOWS文件设置->%windir%\system32\winlogon.exe->%windir%\*.dll

2011-06-12 16:34:01 创建文件    操作:阻止
进程路径:C:\WINDOWS\system32\winlogon.exe
文件路径:C:\WINDOWS\eset.dll
触发规则:应用程序规则->WINDOWS文件设置->%windir%\system32\winlogon.exe->%windir%\*.dll

2011-06-12 16:34:05 删除文件    操作:允许
进程路径:C:\WINDOWS\system32\winlogon.exe
文件路径:F:\virus\Desktop\gsetup.exe
触发规则:所有程序规则->全局设置->?:\*.exe

显示全部楼层 · 发表于 2011-6-12 16:40:34

2011-06-12 16:35:50 运行应用程序    操作:允许
进程路径:F:\virus\Desktop\shadowg.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\a.exe
触发规则:所有程序规则->其它程序设置->*\Temp\*

2011-06-12 16:35:52 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\a.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\LiveUpd360.dll
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*

2011-06-12 16:35:57 创建文件    操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\a.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\IEXPL0RE.EXE
触发规则:所有程序规则->Documents and Settings设置（一）->?:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\*

2011-06-12 16:35:57 创建文件    操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\a.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\IEXPL0RE.EXE
触发规则:所有程序规则->Documents and Settings设置（一）->?:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\*

2011-06-12 16:35:57 创建文件    操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\a.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\IEXPL0RE.EXE
触发规则:所有程序规则->Documents and Settings设置（一）->?:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\*

[病毒样本] 2x带签名

本帖子中包含更多资源

本帖子中包含更多资源