Sinowal/Mebroot，http://pdeefdwpyus.com/index.php?tp=001e4bb7b4d7333d

a256886572008

2011-10-02 15:43:56   C:\Documents and Settings\Roger\Local Settings\Temp\0.028326047436737167.exe   Sandboxed As   Partially Limited   

2011-10-02 15:44:03   C:\Documents and Settings\Roger\Local Settings\Temp\0.028326047436737167.exe   Modify Key   HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations   

2011-10-02 15:44:03   C:\Documents and Settings\Roger\Local Settings\Temp\0.028326047436737167.exe   Direct Disk Access   \Device\Harddisk0\DR0   

2011-10-02 15:44:27   C:\Documents and Settings\Roger\Local Settings\Temp\8E8.tmp   Sandboxed As   Partially Limited   

2011-10-02 15:44:27   C:\Documents and Settings\Roger\Local Settings\Temp\8E9.tmp   Sandboxed As   Partially Limited   

2011-10-02 15:44:32   C:\Documents and Settings\Roger\Local Settings\Temp\8E8.tmp   Modify File   C:\WINDOWS\system32\drivers\nsv42.sys   

2011-10-02 15:44:32   C:\Documents and Settings\Roger\Local Settings\Temp\8E8.tmp   Modify File   C:\WINDOWS\system32\providorqtnhw4.dll   

2011-10-02 15:44:35   C:\Documents and Settings\Roger\Local Settings\Temp\8E8.tmp   Install Hook   C:\Documents and Settings\Roger\Local Settings\Temp\8ED.tmp   

掛馬網站：
http://pdeefdwpyus.com/index.php?tp=001e4bb7b4d7333d

dll網馬：
http://pdeefdwpyus.com/w.php?f=26&e=2

dalianjhc1986

下载拦截  文件to eset

7758521wang

诺顿MISS

chihhua

Gen:Variant.Kazy.31446,
Gen:Variant.Kazy.38732 (2x) (引擎A),
Win32:Sinowal-JN [Trj] (4x) (引擎B)

ywsuda

7758521wang 发表于 2011-10-2 16:01
诺顿MISS

试一下那两个挂马网页吧。。诺顿果断拦截

livlva

ESS栏下

7758521wang

ywsuda 发表于 2011-10-2 16:08
试一下那两个挂马网页吧。。诺顿果断拦截

这个还是不敢试  万一漏一点系统就遭殃了

wuyongliang

卡巴   继续 全部拦截

电影结束了

BDS/Sinowal.aakal
还是老的。。。

一万个理由

avast杀