机房产物。。。

显示全部楼层 · 发表于 2007-11-23 10:23:43

RT

Technical Details

Analysis Number

1

Parent ID

0

Process ID

1780

Filename

C:\file.exe

Filesize

19005 bytes

MD5

4d9143a18b691b517815edf5e89f8f76

Start Reason

AnalysisTarget

Termination Reason

NormalTermination

Start Time

00:00.094

Stop Time

00:05.188

DLL-Handling

Loaded DLLs

Filesystem

New Files

C:\WINDOWS\system32\del.bat

Opened Files

\\.\PIPE\lsarpc
\SystemRoot\AppPatch\sysmain.sdb
\SystemRoot\AppPatch\systest.sdb
\Device\NamedPipe\ShimViewer
C:\WINDOWS\system32\del.bat

Chronological order

Get File Attributes: C:\WINDOWS\SYSTEM32\702AF42.EXE Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:\WINDOWS\ Flags: (SECURITY_ANONYMOUS)
Open File: \\.\PIPE\lsarpc (OPEN_EXISTING)
Create File: C:\WINDOWS\system32\del.bat
Open File: \SystemRoot\AppPatch\sysmain.sdb (OPEN_EXISTING)
Open File: \SystemRoot\AppPatch\systest.sdb (OPEN_EXISTING)
Open File: \Device\NamedPipe\ShimViewer (OPEN_EXISTING)
Open File: C:\WINDOWS\system32\del.bat ()
Find File: del.bat

Registry

Changes

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "DisplayName" = 577B2F0B
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\577B2F0B "DisplayName" = 577B2F0B
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "Description" = 37AFE3
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\577B2F0B "Description" = 37AFE3
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "ErrorControl" = [REG_DWORD, value: 00000001]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "ImagePath" = C:\WINDOWS\system32\702AF42.EXE -k
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\577B2F0B "ImagePath" = C:\WINDOWS\system32\702AF42.EXE -k
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "ObjectName" = LocalSystem
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\577B2F0B "ObjectName" = LocalSystem
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "Start" = [REG_DWORD, value: 00000002]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "Type" = [REG_DWORD, value: 00000010]

Reads

HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter "Installed"

Process Management

Creates Process - Filename () CommandLine: (C:\WINDOWS\system32\del.bat) As User: () Creation Flags: ()
Kill Process - Filename () CommandLine: () Target PID: (1780) As User: () Creation Flags: ()
Enum Processes
Open Process - Filename (C:\WINDOWS\Explorer.EXE) Target PID: (1452)

Service Management

Open Service Manager - Name: "SCM"

System Info

Get System Directory

Window

Find Window - Class Name (#32770) Window Name (½ðÉ½¶¾°Ô)
Enum Windows

Analysis Number

2

Parent ID

0

Process ID

712

Filename

Filesize

-1 bytes

MD5

Start Reason

SCM

Termination Reason

Unknown

Start Time

00:04.578

Stop Time

00:00.000

Analysis Number

3

Parent ID

0

Process ID

712

Filename

Filesize

-1 bytes

MD5

Start Reason

SCM

Termination Reason

Unknown

Start Time

00:04.609

Stop Time

00:00.000

The following process was started by process: 1

Analysis Number

4

Parent ID

1

Process ID

1376

Filename

C:\WINDOWS\system32\del.bat

Filesize

388608 bytes

MD5

eeb024f2c81f0d55936fb825d21a91d6

Start Reason

CreateProcess

Termination Reason

NormalTermination

Start Time

00:04.922

Stop Time

00:05.922

DLL-Handling

Loaded DLLs

Filesystem

Opened Files

C:\WINDOWS\system32\del.bat

Deleted Files

C:\file.exe
C:\WINDOWS\system32\del.bat

Chronological order

Get File Attributes: C:\ Flags: (SECURITY_ANONYMOUS)
Find File: C:\
Find File: C:\WINDOWS\system32\del.bat
Open File: C:\WINDOWS\system32\del.bat (OPEN_EXISTING)
Get File Attributes: C:\FILE.EXE Flags: (SECURITY_ANONYMOUS)
Find File: C:\FILE.EXE
Delete File: C:\file.exe
Get File Attributes: C:\WINDOWS\system32\del.bat Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:\WINDOWS\system32 Flags: (SECURITY_ANONYMOUS)
Delete File: C:\WINDOWS\system32\del.bat

Registry

Reads

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "DisableUNCCheck"
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "EnableExtensions"
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "DelayedExpansion"
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "DefaultColor"
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "CompletionChar"
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "PathCompletionChar"
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "AutoRun"
HKEY_CURRENT_USER\Software\Microsoft\Command Processor "DisableUNCCheck"
HKEY_CURRENT_USER\Software\Microsoft\Command Processor "EnableExtensions"
HKEY_CURRENT_USER\Software\Microsoft\Command Processor "DelayedExpansion"
HKEY_CURRENT_USER\Software\Microsoft\Command Processor "DefaultColor"
HKEY_CURRENT_USER\Software\Microsoft\Command Processor "CompletionChar"
HKEY_CURRENT_USER\Software\Microsoft\Command Processor "PathCompletionChar"
HKEY_CURRENT_USER\Software\Microsoft\Command Processor "AutoRun"

Process Management

Kill Process - Filename () CommandLine: () Target PID: (1376) As User: () Creation Flags: ()

显示全部楼层 · 发表于 2007-11-23 10:25:14

反病毒引擎	版本	最后更新	扫描结果
AhnLab-V3	2007.11.23.0	2007.11.22	-
AntiVir	7.6.0.34	2007.11.22	TR/Crypt.NSPM.Gen
Authentium	4.93.8	2007.11.21	-
Avast	4.7.1074.0	2007.11.22	Win32:AutoRun-IC
AVG	7.5.0.503	2007.11.22	Downloader.Generic6.VCR
BitDefender	7.2	2007.11.23	Win32.Worm.Winko.I
CAT-QuickHeal	9.00	2007.11.22	-
ClamAV	0.91.2	2007.11.23	-
DrWeb	4.44.0.09170	2007.11.22	Trojan.Popwin.679
eSafe	7.0.15.0	2007.11.21	suspicious Trojan/Worm
eTrust-Vet	31.3.5316	2007.11.22	-
Ewido	4.0	2007.11.22	-
FileAdvisor	1	2007.11.23	-
Fortinet	3.14.0.0	2007.11.23	-
F-Prot	4.4.2.54	2007.11.22	W32/Injector.A.gen!Eldorado
F-Secure	6.70.13030.0	2007.11.23	-
Ikarus	T3.1.1.12	2007.11.23	Trojan-PWS.Win32.Agent.BU
Kaspersky	7.0.0.125	2007.11.21	-
McAfee	5169	2007.11.22	New Poly Win32
Microsoft	1.3007	2007.11.23	VirTool:Win32/Obfuscator.A
NOD32v2	2679	2007.11.22	Win32/TrojanDownloader.Flux
Norman	5.80.02	2007.11.22	-
Panda	9.0.0.4	2007.11.23	Suspicious file

显示全部楼层 · 发表于 2007-11-23 10:25:49

Starting the file scan:

Begin scan in 'E:\auto.rar'
E:\auto.rar
  [0] Archive type: RAR
  --> auto.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-11-23 11:02:22

Begin scan in 'C:\Documents and Settings\Administrator\桌面\auto.rar'
C:\Documents and Settings\Administrator\桌面\auto.rar
  [0] Archive type: RAR
  --> auto.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [WARNING] The file was ignored!

又报壳？！……
我恶心了……
KIS7过

2007-11-23 11:01:18 文件: C:\Documents and Settings\Administrator\桌面\auto.rar/auto.exe//# 正常已扫描

显示全部楼层 · 发表于 2007-11-23 11:08:14

显示全部楼层 · 发表于 2007-11-23 11:10:56

微点砍掉

显示全部楼层 · 发表于 2007-11-23 11:20:18

Roboon：程序:
D:\我的文档\桌面\AUTO.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\1730B18.EXE
2) C:\WINDOWS\SYSTEM32\3957BDED.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-11-23 11:20:43

来挂主防吧

扫描一会杀

[ 本帖最后由 wangjay1980 于 2007-11-23 11:31 编辑 ]

显示全部楼层 · 发表于 2007-11-23 11:52:22

D:\firefox download\auto.rar ?RAR ?auto.exe - Win32/TrojanDownloader.Flux 特洛伊木马的变种

显示全部楼层 · 发表于 2007-11-23 13:02:05

费尔，杀一木马

[病毒样本] 机房产物。。。

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块