測主防，TDSS rootkit

a256886572008

2011-09-22 09:05:22   C:\Documents and Settings\Roger\桌面\virus\1\1.exe   Sandboxed As   Partially Limited   

2011-09-22 09:05:28   C:\Documents and Settings\Roger\桌面\virus\1\1.exe   Modify File   \Device\globalroot\Device\HarddiskVolume1\Documents and Settings\Roger\桌面\virus\1\1.exe   

2011-09-22 09:05:28   C:\Documents and Settings\Roger\桌面\virus\1\1.exe   Direct Disk Access   physicaldrive0  

2011-09-22 09:05:28   C:\Documents and Settings\Roger\桌面\virus\1\1.exe   Modify File   C:\Documents and Settings\Roger\Local Settings\Temp\1EE.tmp   

2011-09-22 09:05:28   C:\Documents and Settings\Roger\桌面\virus\1\1.exe   Modify Key   HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations   

2011-09-22 09:05:28   C:\Documents and Settings\Roger\桌面\virus\1\1.exe   Modify Key   HKUS\S-1-5-21-1004336348-1383384898-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable   

2011-09-22 09:05:29   C:\Documents and Settings\Roger\桌面\virus\1\1.exe   Scanned Online and Found Malicious      

訪問網路



雲查殺

jayavira

to eset

http://samples.nod32.com.hk/inde ... 6a7913b560d24c7759d

saga3721

关闭打印服务OP全防TDSS加驱，开启服务则spool被注入，但可防止被注入后的直接磁盘访问和联网
楼主漏了个注册表吧Sysmon <SPOOLSV.EXE> learn {System Objects} |HKEY_LOCAL_MACHINE\system\currentcontrolset\services\aed9ca90|

星晨

BitDefender
1.exe Trojan.Generic.KD.361514

hansyu

Panda Cloud Antivirus 启发

C.C.

360SD KILL
C:\Documents and Settings\Administrator\桌面\1.rar=>1.exe        具有木马特征程序(Win32/Trojan.e6d)

留侯

大蜘蛛：1.exe infected with BackDoor.Tdss.5070

Palkia

抱金砖

to avira

mxf147

2011-09-22 10:51:02         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         \Device\KsecDD 
2011-09-22 10:51:04         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         \Device\globalroot\Device\HarddiskVolume1\Documents and Settings\Administrator\桌面\Test\1.exe 
2011-09-22 10:51:12         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\3.tmp 
2011-09-22 10:51:17         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\4.tmp 
2011-09-22 10:51:21         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         C:\Documents and Settings\Administrator\桌面\Test\1.exe 
2011-09-22 10:51:27         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\5.tmp 
2011-09-22 10:51:28         C:\Documents and Settings\Administrator\桌面\Test\1.exe         访问COM接口         GLOBALROOT\RPC Control\spoolss 
2011-09-22 10:51:28         C:\Documents and Settings\Administrator\桌面\Test\1.exe         直接磁盘访问         physicaldrive0 
2011-09-22 10:51:31         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         \Device\Tcp 
2011-09-22 10:51:36         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         \Device\Ip 
2011-09-22 10:51:38         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         \Device\Afd\Endpoint 
2011-09-22 10:51:41         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改注册表项         HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations 
2011-09-22 10:51:41         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         \Device\NamedPipe\ROUTER 
2011-09-22 10:51:41         C:\WINDOWS\explorer.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\ShellNoRoam\BagMRU\NodeSlots 
2011-09-22 10:51:41         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         \Device\NamedPipe\ROUTER 
2011-09-22 10:51:41         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改注册表项         HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData 
2011-09-22 10:51:41         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         \Device\NamedPipe\ROUTER 
2011-09-22 10:51:41         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy 
2011-09-22 10:51:41         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         \Device\NamedPipe\ROUTER 
2011-09-22 10:51:50         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\6.tmp 
2011-09-22 10:51:53         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改文件         \Device\NamedPipe\ROUTER 
2011-09-22 10:51:53         C:\Documents and Settings\Administrator\桌面\Test\1.exe         修改注册表项         HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations 
报告结束