pp.exe-------Rootkit

显示全部楼层 · 发表于 2011-7-29 11:27:50

360杀

显示全部楼层 · 发表于 2011-7-30 15:09:43

显示全部楼层 · 发表于 2011-7-30 15:10:09

hx1997 发表于 2011-7-30 15:09

去试试流氓样本看

显示全部楼层 · 发表于 2011-7-30 15:12:28

dm34343667 发表于 2011-7-30 15:10
去试试流氓样本看

？
流氓难找啊

显示全部楼层 · 发表于 2011-7-30 15:13:19

hx1997 发表于 2011-7-30 15:12
？
流氓难找啊

样本区 setup多啊

显示全部楼层 · 发表于 2011-7-30 15:13:34

dm34343667 发表于 2011-7-30 15:10
去试试流氓样本看

这货？
http://bbs.kafan.cn/forum.php?mod=viewthread&tid=904514

还是这货？
http://bbs.kafan.cn/forum.php?mod=viewthread&tid=930007

显示全部楼层 · 发表于 2011-7-30 15:13:58

hx1997 发表于 2011-7-30 15:13
这货？
http://bbs.kafan.cn/forum.php?mod=viewthread&tid=904514

试试OA看

显示全部楼层 · 发表于 2011-7-30 15:18:31

本帖最后由 hx1997 于 2011-7-30 15:18 编辑

dm34343667 发表于 2011-7-30 15:13
试试OA看

第一个，OA很多弹窗，但没有红色弹窗

部分日志

Created:    2011-7-30 15:16:45
Summary:    Program Guard: naqbsk.e
Description:  C:\Documents and Settings\Administrator\桌面\naqbsk.e wants to get a list of the files C:\Documents and Settings\Administrator\Local Settings\Temp\nsg11.tmp\*
Event type: Alert(5)
Event action: Allowed(2)

Created:    2011-7-30 15:16:18
Summary:    Program Guard: naqbsk.e
Description:  C:\Documents and Settings\Administrator\桌面\naqbsk.e wants to get a list of the files C:\Documents and Settings\Administrator\Local Settings\Temp\nspB.tmp\*
Event type: Alert(5)
Event action: Allowed(2)

Created:    2011-7-30 15:16:17
Summary:    Firewall: Automatic decision
Description:  C:\Documents and Settings\Administrator\桌面\naqbsk.e, Outgoing TCP access allowed to: 222.217.240.28:1200
Event type: Firewall: Automatic decision(16)
Event action: Allowed(2)

Created:    2011-7-30 15:15:48
Summary:    Program Guard: naqbsk.e -> tanchu.exe
Description:  C:\Documents and Settings\Administrator\桌面\naqbsk.e wants to delete executable file C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tanchu.exe
Event type: Suspicious file(13)
Event action: Allowed(2)

Created:    2011-7-30 15:15:47
Summary:    Firewall: Automatic decision
Description:  C:\Documents and Settings\Administrator\桌面\naqbsk.e, Outgoing TCP access allowed to: 222.217.240.28:1351
Event type: Firewall: Automatic decision(16)
Event action: Allowed(2)

Created:    2011-7-30 15:15:46
Summary:    Program Guard: naqbsk.e -> svchost.exe
Description:  C:\Documents and Settings\Administrator\桌面\naqbsk.e(464) wants to use C:\WINDOWS\system32\svchost.exe(864)
Event type: Program Guard(9)
Event action: Allowed(2)

Created:    2011-7-30 15:15:30
Summary:    Program Guard: naqbsk.e -> tanchu.exe
Description:  C:\Documents and Settings\Administrator\桌面\naqbsk.e wants to create executable file C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tanchu.exe
Event type: Suspicious file(13)
Event action: Allowed(2)

显示全部楼层 · 发表于 2011-7-30 15:22:42

dm34343667 发表于 2011-7-30 15:13
试试OA看

第二个，两个弹窗后就没动作了...

日志
Created:    2011-7-30 15:19:50
Summary:    Program Guard: kernel event
Description:  OADriver: OpenProcess, 1880 -> 292, Mask: 1F0FFF - 1F0414 - Deny (watched)
Event type: Kernel event(26)
Event action: None(1)
Processes:
  PID: 1880 Name: P42.e
  PID:    292 Name: ctfmon.exe

Created:    2011-7-30 15:19:49
Summary:    Program Guard: P42.e -> xvhost.sb
Description:  C:\Documents and Settings\Administrator\桌面\P42.e wants to create executable file C:\WINDOWS\system32\xvhost.sb
Event type: Suspicious file(13)
Event action: Blocked(3)

Created:    2011-7-30 15:19:29
Summary:    Autorun detected: P42.exe
Description:  C:\Documents and Settings\Administrator\桌面\P42.exe
Event type: Autorun(10)
Event action: Allowed(2)

Created:    2011-7-30 15:19:19
Summary:    Program Guard: P42.exe
Description:  C:\WINDOWS\explorer.exe -> C:\Documents and Settings\Administrator\桌面\P42.exe
Event type: Program Guard(9)
Event action: Allowed(2)

显示全部楼层 · 发表于 2011-7-30 15:30:03

hx1997 发表于 2011-7-30 15:18
第一个，OA很多弹窗，但没有红色弹窗

第一个运行自动退出

第二个瑞星未知木马。。

[病毒样本] pp.exe-------Rootkit

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源