木马已经运行的查杀问题

喜欢清淡

自己实验用别人的工具做了个木马，这个工具的主服务端用kis7扫没反应，木马生成后，没做任何处理

kis7.0报报警，关闭卡巴，打开影子做实验，运行木马，然后用kis7.0最新病毒库查杀C盘下windows目录，好像没什么反应，用iceword看不到可疑进程！

以下是木马的说明：1、免杀容易：EXE服务端内存注入svchost.exe进程穿越防火墙，不释放DLL（键盘记录DLL要释放的），免杀省力
2、稳定性强：服务端可以在windows 2000，XP，2003系列安装，重启后上线稳定（有系统还原或者以用户权限启动、注册表保护等除外）

是不是因为写入了svchost而查不出？木马本身是没有经过任何处理的，直接生成然后运行
附件为生成的木马，直接下载是报的，但木马运行了以后，kis7查不出来！
有兴趣的，可以下下来在影子或虚拟机下运行自己试下

[ 本帖最后由 喜欢清淡 于 2007-7-21 20:30 编辑 ]

喜欢清淡

感觉是不是发错区了？   
我想找个查杀此类已运行的木马的方法

微点卫士

微点:
木马名称:Trojan.Win32.Delf.blq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX02.250\SERVER.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

平淡

不尝试了

[ 本帖最后由 卡饭论坛 于 2007-7-21 21:40 编辑 ]

jlennon

Processes:
PID ParentPID User Path
--------------------------------------------------
2252 2236 NT AUTHORITY:SYSTEM  
2268 2252 NT AUTHORITY:SYSTEM C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\drive\C\WINDOWS\system32\svchost.exe
Ports:
Port PID Type Path
--------------------------------------------------
Explorer Dlls:
DLL Path Company Name File Description
--------------------------------------------------
No changes Found   
IE Dlls:
DLL Path Company Name File Description
--------------------------------------------------
No changes Found   
Loaded Drivers:
Driver File Company Name Description
--------------------------------------------------
Monitored RegKeys
Registry Key Value
--------------------------------------------------
Hklm\SYSTEM\CurrentControlSet\Services netservice
Kernel31 Api Log

--------------------------------------------------
***** Installing Hooks *****
71a270df     RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\WinSock2\Parameters)
71a27cc4     RegOpenKeyExA (Protocol_Catalog9)
71a2737e     RegOpenKeyExA (00000004)
71a2724d     RegOpenKeyExA (Catalog_Entries)
71a278ea     RegOpenKeyExA (000000000001)
71a278ea     RegOpenKeyExA (000000000002)
71a278ea     RegOpenKeyExA (000000000003)
71a278ea     RegOpenKeyExA (000000000004)
71a278ea     RegOpenKeyExA (000000000005)
71a278ea     RegOpenKeyExA (000000000006)
71a278ea     RegOpenKeyExA (000000000007)
71a278ea     RegOpenKeyExA (000000000008)
71a278ea     RegOpenKeyExA (000000000009)
71a278ea     RegOpenKeyExA (000000000010)
71a278ea     RegOpenKeyExA (000000000011)
71a22623     WaitForSingleObject(794,0)
71a283c6     RegOpenKeyExA (NameSpace_Catalog5)
71a27f5b     RegOpenKeyExA (Catalog_Entries)
71a280ef     RegOpenKeyExA (000000000001)
71a280ef     RegOpenKeyExA (000000000002)
71a280ef     RegOpenKeyExA (000000000003)
71a22623     WaitForSingleObject(78c,0)
71a11afa     RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\Winsock2\Parameters)
71a11996     GlobalAlloc()
7c80b689     ExitThread()
40403c     GetCommandLineA()
77f469fd     WaitForSingleObject(7dc,0)
7d5f2dbd     LoadLibraryA(ole32.dll)=76990000
746826aa     GetVersionExA()
746830a7     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\Compatibility\server.exe)
746830a7     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\SystemShared\)
7468245b     CreateMutex(CTF.LBES.MutexDefaultS-1-5-21-790525478-682003330-1801674531-500)
7468245b     CreateMutex(CTF.Compart.MutexDefaultS-1-5-21-790525478-682003330-1801674531-500)
7468245b     CreateMutex(CTF.Asm.MutexDefaultS-1-5-21-790525478-682003330-1801674531-500)
7468245b     CreateMutex(CTF.Layouts.MutexDefaultS-1-5-21-790525478-682003330-1801674531-500)
7468245b     CreateMutex(CTF.TMD.MutexDefaultS-1-5-21-790525478-682003330-1801674531-500)
746830a7     RegOpenKeyExA (HKCU\Keyboard Layout\Toggle)
7468260a     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\)
74684683     GetCurrentProcessId()=2224
7468245b     CreateMutex(CTF.TimListCache.FMPDefaultS-1-5-21-790525478-682003330-1801674531-500MUTEX.DefaultS-1-5-21-790525478-682003330-1801674531-500)
7469d232     WaitForSingleObject(76c,1388)
746b556a     GetCurrentProcessId()=2224
77f469fd     WaitForSingleObject(764,0)
77f58b88     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\server.exe)
77f487f7     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D})
77f4896f     RegOpenKeyExA (HKCR\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32)
7d5f2dbd     LoadLibraryA(SETUPAPI.dll)=76060000
77f5b4c4     LoadLibraryA(SHELL32.dll)=7d590000
77f5b4c4     LoadLibraryA(ole32.dll)=76990000
77f469fd     WaitForSingleObject(734,0)
406550     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system)
405e88     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup)
7c864b24     GetCurrentProcessId()=2224
405db8     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup)
405de5     RegSetValueExA (netinfo)
405de5     RegSetValueExA (cover)
406739     CreateFileA(C:\Documents and Settings\All Users\Favorites\plug\001.dll)
40674e     WriteFile(h=730)
406ba9     Copy(C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\桌面\server\server.exe->C:\Documents and Settings\All Users\Favorites\netservice.exe)
7c8283f4     WriteFile(h=73c)
40647f     CreateFileA(C:\WINDOWS\cmd.exe)
405ccb     RegOpenKeyExA (HKLM\SYSTEM\CurrentControlSet\Services\netservice)
405d02     RegSetValueExA (Description)
406c83     GetCommandLineA()
406cab     WinExec(cmd /c del "C:\Documents and Settings\Administrator\桌面\server\server.exe",0)
7d23a737     CreateProcessA((null),cmd /c del "C:\Documents and Settings\Administrator\桌面\server\server.exe",0,(null))
7c816513     WaitForSingleObject(72c,64)
76d74cd7     LoadLibraryA(VERSION.dll)=77bd0000
7c819154     LoadLibraryA(advapi32.dll)=77da0000
10001e25     LoadLibraryA(psapi.dll)=76bc0000
10001e66     GetCurrentProcessId()=2224
76bc183b     ReadProcessMemory(h=73c)
76bc185a     ReadProcessMemory(h=73c)
76bc1878     ReadProcessMemory(h=73c)
76bc17bb     ReadProcessMemory(h=73c)
*****   Injecting C:\iDEFENSE\SysAnalyzer\api_log.dll into new process
*****   OpenProcess Handle=73c
*****   Remote Allocation base: 150000
*****   WriteProcessMemory=1 BufLen=23  BytesWritten:23
*****   LoadLibraryA=7c801d77
*****   CreateRemoteThread=724
406d74     ExitProcess()
74681d36     GetCurrentProcessId()=2224
74682056     GetCurrentProcessId()=2224
***** Injected Process Terminated *****
DirwatchData

--------------------------------------------------
WatchDir Initilized OK
Watching C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
Watching C:\WINDOWS
Watching C:\Program Files
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET8416.tmp
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET8416.tmp
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF3870.tmp
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF3870.tmp
Created: C:\WINDOWS\system32\svchost.exe
Modifed: C:\WINDOWS\system32\svchost.exe
Modifed: C:\WINDOWS\system32

喜欢清淡

谢楼上的，能简单坐下介绍吗感觉好复杂
最近乱玩木马，好像自己给自己中了 帮忙看下有大问题吗？

[ 本帖最后由 喜欢清淡 于 2007-7-22 00:04 编辑 ]

jlennon

手杀鸽子很简单，用gmer，IS，等等就可以了