y.exe

显示全部楼层 · 发表于 2011-9-23 18:03:31

to eset

显示全部楼层 · 发表于 2011-9-23 18:32:33

运行后毒霸秒杀

显示全部楼层 · 发表于 2011-9-23 18:35:26

BitDefender
y.part1.rar=>y.exe=>(Instyler o)=>(Instyler Module 1) Dialer.Generic.59816
y.part1.rar=>y.exe=>(Instyler o)=>(Instyler Module 13) Trojan.Generic.6492035
y.part1.rar=>y.exe=>(Instyler o)=>(Instyler Module 5) Trojan.Generic.6542488
y.part1.rar=>y.exe=>(Instyler o)=>(Instyler Module 7) Application.ActualSpy.S

显示全部楼层 · 发表于 2011-9-23 18:50:48

2011-09-23 18:44:09 运行应用程序    操作:允许
进程路径:F:\virus\y[1]\y.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
命令行:/SL5="$1800EC,1343431,53248,F:\virus\y[1]\y.exe"
触发规则:所有程序规则->其它程序设置->*\Temp\*

2011-09-23 18:44:21 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*

2011-09-23 18:44:23 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\unins000.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2011-09-23 18:44:24 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\unins000.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2011-09-23 18:44:25 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\Actual Spy
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\*

2011-09-23 18:44:25 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\Actual Spy\ActualSpy.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*.exe

2011-09-23 18:44:50 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\ASMonitor.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2011-09-23 18:44:51 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\ASMonitor.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2011-09-23 18:44:52 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\hk.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2011-09-23 18:44:52 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\hk.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2011-09-23 18:44:52 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\hk2.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2011-09-23 18:44:52 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\hk2.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2011-09-23 18:44:52 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\hprog.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2011-09-23 18:44:52 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\hprog.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2011-09-23 18:44:52 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\libeay32.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2011-09-23 18:44:52 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\libeay32.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2011-09-23 18:44:53 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\ssleay32.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2011-09-23 18:44:53 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\ssleay32.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2011-09-23 18:44:55 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\settings.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2011-09-23 18:44:56 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Program Files\ACSPMonitor\settings.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2011-09-23 18:44:57 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\Actual Spy\Actual Spy Help.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk

2011-09-23 18:45:00 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\Actual Spy\Readme.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk

2011-09-23 18:45:03 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\Actual Spy\Uninstall Actual Spy.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk

2011-09-23 18:45:06 运行应用程序    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/C ""C:\Program Files\ACSPMonitor\rights.bat""
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe

2011-09-23 18:45:07 创建文件    操作:允许
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\Program Files\ACSPMonitor\logs
触发规则:应用程序规则->CMD设置->%windir%\system32\cmd.exe->%ProgramFiles%\*

2011-09-23 18:45:08 运行应用程序    操作:阻止
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:logs /G Everyone:F /E
触发规则:所有程序规则->系统程序设置->*\cacls.exe

2011-09-23 18:45:08 运行应用程序    操作:阻止
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:logs /G 傖?F /E
触发规则:所有程序规则->系统程序设置->*\cacls.exe

2011-09-23 18:45:13 运行应用程序    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-TKP25.tmp\y.tmp
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/C ""C:\Program Files\ACSPMonitor\f.bat""
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe

2011-09-23 18:45:14 运行应用程序    操作:阻止
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\WINDOWS\system32\netsh.exe
命令行:firewall add allowedprogram program=asmonitor.exe name=System
触发规则:所有程序规则->系统程序设置->%windir%\system32\net*.exe

显示全部楼层 · 发表于 2011-9-23 18:52:29

本帖最后由 Palkia 于 2011-9-23 18:52 编辑

hddu 发表于 2011-9-23 18:50
2011-09-23 18:44:09 运行应用程序操作:允许
进程路径:F:\virus\y[1]\y.exe
文件路径:C:\Docume ...

MS很中意对我放的样本发行为。。。。。

显示全部楼层 · 发表于 2011-9-23 18:53:57

过eset

显示全部楼层 · 发表于 2011-9-23 18:55:19

运行ASMonitor.exe的日志

2011-09-23 18:52:06 修改注册表内容    操作:使用任务隔离区操作
进程路径:C:\Program Files\ACSPMonitor\ASMonitor.exe
注册表路径:HKEY_CLASSES_ROOT\.key
注册表名称:[Default]
触发规则:所有程序规则->文件类型关联->HKEY_CLASSES_ROOT\.*

2011-09-23 18:52:06 修改注册表内容    操作:使用任务隔离区操作
进程路径:C:\Program Files\ACSPMonitor\ASMonitor.exe
注册表路径:HKEY_CLASSES_ROOT\.key
注册表名称:[Default]
触发规则:所有程序规则->文件类型关联->HKEY_CLASSES_ROOT\.*

2011-09-23 18:52:08 创建文件    操作:阻止
进程路径:C:\Program Files\ACSPMonitor\ASMonitor.exe
文件路径:C:\WINDOWS\system\actualspystart.lnk
触发规则:所有程序规则->WINDOWS文件设置->%windir%\*.lnk

2011-09-23 18:52:43 创建文件    操作:阻止
进程路径:C:\Program Files\ACSPMonitor\ASMonitor.exe
文件路径:C:\WINDOWS\system\actualspystart.lnk
触发规则:所有程序规则->WINDOWS文件设置->%windir%\*.lnk

显示全部楼层 · 发表于 2011-9-23 18:57:18

Norton：High Risk

Full Path: c:\users\jianfei\desktop\y\y.exe
____________________________
____________________________
On computers as of Not Available
Last Used 2011/9/23 at 18:55:22
Startup Item No
Launched No
____________________________
____________________________
Unknown
Number of users in the Norton Community that have used this file: Unknown
____________________________
Unknown
This file release is currently not known.
____________________________
High
This file risk is high.
____________________________
Threat Details
Threat type: Spyware. Programs that actively track and send personal or confidential information to third parties.
____________________________
http://bbs.kafan.cn/forum.php?mo ... DQ3OTEyNXwxMDkyMTA3 Downloaded File y.exe
Threat name:
Spyware.ActualSpy from
bbs.kafan.cn
____________________________
File Actions
File: c:\users\jianfei\desktop\y\y.exe
Removed
____________________________
File Thumbprint - SHA:
110958fa3b577244cf1411d20f906e2db57d190b0097920d813f75856ff803eb
____________________________
File Thumbprint - MD5:
22bfc8c35d8921939e53bc60d035494c
____________________________

显示全部楼层 · 发表于 2011-9-23 18:59:54

Palkia 发表于 2011-9-23 18:52
MS很中意对我放的样本发行为。。。。。

接受批评，保证以后不犯，请监督。

[病毒样本] y.exe

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块