穿破 Norton SONAR 的病毒

a256886572008

2011-10-29 08:10:33   C:\DOCUME~1\Roger\LOCALS~1\Temp\0.3818980073156655exe   Sandboxed As   Partially Limited   

2011-10-29 08:10:34   C:\Documents and Settings\Roger\Local Settings\Temp\0.3818980073156655exe   Scanned Online and Found Malicious     

2011-10-29 08:10:35   C:\WINDOWS\explorer.exe   Sandboxed As   Partially Limited   

2011-10-29 08:10:47   C:\WINDOWS\explorer.exe   Modify File   C:\Program Files\COMODO\COMODO Internet Security\Quarantine\3DD486CA-CCB4-4DDD-898A-221C5EC107F4.data   

2011-10-29 08:10:47   C:\WINDOWS\explorer.exe   Access COM Interface   LocalSecurityAuthority.Tcb   

雲查殺

掛馬網站：
hxxp://paybucksinternet.ru/allow.php?page=ce7e6bb7d9eb6c7a

hx1997

ESET killed 1×, missed 1×.

C:\Users\Gateway\Desktop\0.3818980073156655exe\0.3818980073156655exe - Win32/Kryptik.UQE 特洛伊木马 的变种

To ESET.

hx1997

直接 USERPROFILE 根目录禁写...

2011-10-29 8:31:00        C:\Program Files\Internet Explorer\IEXPLORE.EXE        获取文件访问权        C:\Documents and Settings\Administrator\.exe        阻止一些访问        082.C:\Documents and Settings\*\*.exe        写入到文件

hx1997

似乎 IDP 被穿透，至少我看见了 ZeroAccess 的进程。

hx1997

OA 到这里才出现红色框，不过也防住了。

hx1997

DW 无鸭梨防住。

DefenseWall log file

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\.exe， 2:Attempt to change memory region attributes into the process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\.exe， 2:Close handle TOCTTOU (TOCTTOU)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， 1:Process is running untrusted now (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to open thread in process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to open thread in process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to open thread in process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to open thread in process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to open thread in process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to open thread in process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to open thread in process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to open thread in process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to open thread in process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to open thread in process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to open thread in process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to open thread in process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to open thread in process C:\WINDOWS\explorer.exe (进程)

10.29.2011  08:45:14，模块 C:\Documents and Settings\Administrator\Local Settings\Application Data\df64ecac\X， Attempt to add new APC event into the process C:\WINDOWS\explorer.exe (线程)

10.29.2011  08:45:13，模块 C:\Documents and Settings\Administrator\.exe， 1:Process is running untrusted now (进程)

10.29.2011  08:45:00，模块 C:\Program Files\Internet Explorer\IEXPLORE.EXE， Attempt to register new service (服务)

10.29.2011  08:45:00，模块 C:\Program Files\Internet Explorer\IEXPLORE.EXE， Attempt to register new service (服务)

10.29.2011  08:45:00，模块 C:\Program Files\Internet Explorer\IEXPLORE.EXE， Attempt to register new service (服务)

10.29.2011  08:45:00，模块 C:\Program Files\Internet Explorer\IEXPLORE.EXE， Attempt to register new service (服务)

hx1997

TF 都防住了...

李琛

我就不试了，怕

liulangzhecgr

Dr.Web -> 两个都是 BackDoor.Maxplus.232

hx1997

RTDS