測主防，母體紅傘免殺，hxxp://iegeoe.sullivanjewel.ru/d.php?f=30&e=5

显示全部楼层 · 发表于 2011-7-8 22:45:24

本帖最后由 a256886572008 于 2011-7-9 01:03 编辑

calc.exe
http://camas.comodo.com/cgi-bin/submit?file=36355164c755f7131c18ee8e1b3e967afaffea2673ec5b48baa6517bf7bde048

‧ Verdict
Auto Analysis Verdict
Suspicious+

‧ Description
Suspicious Actions Detected
Copies self to other locations
Creates autorun records

---------------------------------------------
sdnC49.tmp
http://camas.comodo.com/cgi-bin/submit?file=3fa093c7f0c3642b54214ca24f979870de84ecf32b1dd357b4b24055182fe8a9

‧ Verdict
Auto Analysis Verdict
Suspicious+

‧ Description
Suspicious Actions Detected
Creates files in windows system directory
Creates system services or drivers
Load system drivers

----------------------------------------

2011-07-08 22:27:59 C:\Documents and Settings\Roger\桌面\VIRUS\iegeoe\calc.exe Sandboxed As Partially Limited

2011-07-08 22:28:06 C:\Documents and Settings\Roger\桌面\VIRUS\iegeoe\calc.exe Modify File C:\Documents and Settings\Roger\879r07mh9g.exe

2011-07-08 22:28:06 C:\Documents and Settings\Roger\桌面\VIRUS\iegeoe\calc.exe Modify Key HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\879r07mh9g

2011-07-08 22:28:18 C:\DOCUME~1\Roger\LOCALS~1\Temp\sdn4746.tmp Sandboxed As Partially Limited

2011-07-08 22:28:21 C:\DOCUME~1\Roger\LOCALS~1\Temp\sdn5E0E.tmp Sandboxed As Partially Limited

2011-07-08 22:28:23 C:\DOCUME~1\Roger\LOCALS~1\Temp\sdn3456.tmp Sandboxed As Partially Limited

2011-07-08 22:28:33 C:\DOCUME~1\Roger\LOCALS~1\Temp\sdnC49.tmp Sandboxed As Partially Limited

2011-07-08 22:28:46 C:\Documents and Settings\Roger\Local Settings\Temp\sdnC49.tmp Modify File C:\WINDOWS\system32\drivers\wcscd.sys

2011-07-08 22:28:46 C:\Documents and Settings\Roger\Local Settings\Temp\sdnC49.tmp Modify Key HKLM\SYSTEM\ControlSet001\Services\wcscd

2011-07-08 22:28:46 C:\Documents and Settings\Roger\Local Settings\Temp\sdnC49.tmp Load Driver \Registry\Machine\System\CurrentControlSet\Services\cdfss

-----------------------------------------------------------------------

comodo 雲查殺

2011-07-08 22:43:11 c:\documents and settings\roger\桌面\virus\iegeoe\sdnc49.exe
.UnclassifiedMalware@1

2011-07-09 01:02:21 c:\documents and settings\roger\桌面\virus\iegeoe\cdfss
Virus.Win32.Protector.A@1

显示全部楼层 · 发表于 2011-7-8 22:48:25

大蜘蛛：
母體：calc.exe infected with BackDoor.Siggen.30509

衍生物加了殼：
sdnC49.exe packed by BINARYRES
sdnC49.exe infected with Trojan.NtRootKit.9912

显示全部楼层 · 发表于 2011-7-8 22:50:53

自启动出站小蠕虫吧，对付这些有防火墙就行了

显示全部楼层 · 发表于 2011-7-8 22:52:42

本帖最后由 a256886572008 于 2011-7-8 22:53 编辑

saga3721 发表于 2011-7-8 22:50
自启动出站小蠕虫吧，对付这些有防火墙就行了

這要看你的防火牆，能否攔截 svchost.exe 訪問網路。

這隻很牛，調用 svchost.exe 大量訪問網路，CPU 瞬間飆高。

显示全部楼层 · 发表于 2011-7-8 22:56:28

a256886572008 发表于 2011-7-8 22:52
這要看你的防火牆，能否攔截 svchost.exe 訪問網路。

這隻很牛，調用 svchost.exe 大量訪問網路，CP ...

哪有调用？红伞不杀的那个就自启动然后试图出站而已

显示全部楼层 · 发表于 2011-7-8 22:59:08

母体panda云kill
衍生物sophos杀，这组合太美妙了

显示全部楼层 · 发表于 2011-7-8 23:05:09

NOD32网页防护直接拦截下载

显示全部楼层 · 发表于 2011-7-8 23:08:17

2011-7-8 23:07:08 修改注册表值阻止并结束进程
进程: f:\program files\calc\calc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\879r07mh9g
值: C:\Documents and Settings\db\879r07mh9g.exe
规则: [应用程序组]cx★(禁) -> [注册表组]阻止结束

显示全部楼层 · 发表于 2011-7-8 23:18:56

金山下载保护拦截！
忘了截图，发个扫描结果吧。

显示全部楼层 · 发表于 2011-7-9 00:45:11

SEP
母体运行 Bloodhound.Sonar.9
下载物 Backdoor.Trojan

[病毒样本] 測主防，母體紅傘免殺，hxxp://iegeoe.sullivanjewel.ru/d.php?f=30&e=5

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块