瑞星新引擎活动-驭龙，反馈特殊蠕虫样本-2013.11.18，样本数：8

显示全部楼层 · 发表于 2013-11-19 12:22:09

本帖最后由驭龙于 2013-11-19 16:13 编辑

dalianjhc1986 发表于 2013-11-19 12:16
我不知道你是否了解eset的云上面的文件一般就是经过分析师测试后才加入eset云的这个话题不讨论了

这个是对该样本的行为记录,你看看吧

-----------------------------------------------------------------------

11/14/2013 05:22:09 C:\vsamas\vsamas.exe(PID:1700)::C:\vsamas\vsamas.exe(TID:1612)
      LoadProgram -> Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592), CommandLine: Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe.

11/14/2013 05:22:09 C:\vsamas\vsamas.exe(PID:1700)::C:\vsamas\vsamas.exe(TID:1612)
      CreateMainThread, Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID: 592, TID: 792) <- C:\vsamas\vsamas.exe(PID: 1700, TID: 1612).

11/14/2013 05:22:09 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      LoadNormalImage, Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592), ImageBase: 00400000(Size: 36000), SystemModule: 0.

11/14/2013 05:22:09 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      CreateFile NormalFile \Device\HarddiskVolume1\WINDOWS\rundl132.exe

11/14/2013 05:22:09 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      CreateFileFix to ExeFile \Device\HarddiskVolume1\WINDOWS\rundl132.exe

11/14/2013 05:22:09 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      CopySelfTransformers to \Device\HarddiskVolume1\WINDOWS\rundl132.exe

11/14/2013 05:22:09 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      RegSetValueKey Succed(0x0) [\REGISTRY\USER\S-1-5-21-484763869-362288127-725345543-500\Software\Microsoft\Windows NT\CurrentVersion\Windows]
                     "load"="C:\WINDOWS\rundl132.exe"
                     OldValue(Size: New: 48, Old: 2)
                     "load"=""

11/14/2013 05:22:09 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      CreateFile NormalFile \Device\HarddiskVolume2\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe.exe

11/14/2013 05:22:09 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      CreateFile NormalFile \Device\HarddiskVolume1\WINDOWS\Logo1_.exe

11/14/2013 05:22:09 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      CreateFileFix to ExeFile \Device\HarddiskVolume1\WINDOWS\Logo1_.exe

11/14/2013 05:22:09 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      CopySelfTransformers to \Device\HarddiskVolume1\WINDOWS\Logo1_.exe

11/14/2013 05:22:10 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      CreateFileFix to ExeFile \Device\HarddiskVolume2\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe.exe

11/14/2013 05:22:10 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      CreateFile NormalFile \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\Temp\$$aE.tmp

11/14/2013 05:22:10 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      CreateFile NormalFile \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\Temp\$$aE.bat

11/14/2013 05:22:10 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      LoadProgram -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\$$aE.bat(PID:528), CommandLine: cmd /c C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\$$aE.bat.

11/14/2013 05:22:10 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      CreateMainThread, C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\$$aE.bat(PID: 528, TID: 2016) <- Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID: 592, TID: 792).

11/14/2013 05:22:10 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      LoadProgram -> C:\WINDOWS\Logo1_.exe(PID:732), CommandLine: C:\WINDOWS\Logo1_.exe.

11/14/2013 05:22:10 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      CreateMainThread, C:\WINDOWS\Logo1_.exe(PID: 732, TID: 324) <- Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID: 592, TID: 792).

11/14/2013 05:22:10 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(TID:792)
      TerminateProcess Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe (PID: 592)

11/14/2013 05:22:10 Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592)::(null)(TID:792)
      UnloadProgram Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID:592), Created By C:\vsamas\vsamas.exe(PID: 1700).

11/14/2013 05:22:10 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:324)
      LoadNormalImage, C:\WINDOWS\Logo1_.exe(PID:732), ImageBase: 00400000(Size: 36000), SystemModule: 0.

11/14/2013 05:22:10 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:324)
      OverwriteFile ExeFile \Device\HarddiskVolume1\WINDOWS\rundl132.exe

11/14/2013 05:22:10 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:324)
      CopySelf to \Device\HarddiskVolume1\WINDOWS\rundl132.exe

11/14/2013 05:22:11 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:324)
      LoadProgram -> C:\WINDOWS\system32\net.exe(PID:300), CommandLine: net stop "Kingsoft AntiVirus Service".

11/14/2013 05:22:11 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:324)
      CreateMainThread, C:\WINDOWS\system32\net.exe(PID: 300, TID: 148) <- C:\WINDOWS\Logo1_.exe(PID: 732, TID: 324).

11/14/2013 05:22:11 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:920)
      CreateFile NormalFile \Device\HarddiskVolume2\_desktop.ini

11/14/2013 05:22:11 C:\WINDOWS\system32\net.exe(PID:300)::C:\WINDOWS\system32\net.exe(TID:148)
      LoadProgram -> C:\WINDOWS\system32\net1.exe(PID:952), CommandLine: net1 stop "Kingsoft AntiVirus Service".

11/14/2013 05:22:11 C:\WINDOWS\system32\net.exe(PID:300)::C:\WINDOWS\system32\net.exe(TID:148)
      CreateMainThread, C:\WINDOWS\system32\net1.exe(PID: 952, TID: 1036) <- C:\WINDOWS\system32\net.exe(PID: 300, TID: 148).

11/14/2013 05:22:12 C:\WINDOWS\system32\net1.exe(PID:952)::C:\WINDOWS\system32\net1.exe(TID:1036)
      TerminateProcess C:\WINDOWS\system32\net1.exe (PID: 952)

11/14/2013 05:22:12 C:\WINDOWS\system32\net1.exe(PID:952)::(null)(TID:1036)
      UnloadProgram C:\WINDOWS\system32\net1.exe(PID:952), Created By C:\WINDOWS\system32\net.exe(PID: 300).

11/14/2013 05:22:12 C:\WINDOWS\system32\net.exe(PID:300)::C:\WINDOWS\system32\net.exe(TID:148)
      TerminateProcess C:\WINDOWS\system32\net.exe (PID: 300)

11/14/2013 05:22:12 C:\WINDOWS\system32\net.exe(PID:300)::(null)(TID:148)
      UnloadProgram C:\WINDOWS\system32\net.exe(PID:300), Created By C:\WINDOWS\Logo1_.exe(PID: 732).

11/14/2013 05:22:13 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:860)
      CreateFile NormalFile \Device\HarddiskVolume1\WINDOWS\vDll.dll

11/14/2013 05:22:13 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:860)
      CreateFileFix to ExeFile \Device\HarddiskVolume1\WINDOWS\vDll.dll

11/14/2013 05:22:13 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:860)
      AllocateVirtualMemory(Success, 0x0): AnotherProcess, CreateMemory: Success, Rollback: FECB2470, BaseAddress: 00B50000, Size: 00001000, AllocType: 0x1000, Protect: 40, to explorer.exe(PID: 1444)

11/14/2013 05:22:13 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:860)
      AllocateVirtualMemory(Success, 0x0): AnotherProcess, CreateMemory: Success, Rollback: FECB2584, BaseAddress: 00B60000, Size: 00001000, AllocType: 0x1000, Protect: 4, to explorer.exe(PID: 1444)

11/14/2013 05:22:13 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\KERNEL32.dll(TID:1448)
      LoadInjectionImage, C:\WINDOWS\vDll.dll(PID:1444), ImageBase: 00B70000(Size: b000), SystemModule: 0.

11/14/2013 05:22:13 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:860)
      SetThreadContext  C:\WINDOWS\explorer.exe(PID: 1444, TID: 1448) Eip: [7C92E4F4] [IF] ntdll.dll::KiFastSystemCall+0x0, Flags: 10007

11/14/2013 05:22:13 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:860)
      FreeVirtualMemory: BaseAddress: 00B50000, Size: 00000000 from explorer.exe(PID: 1444)

11/14/2013 05:22:13 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:860)
      FreeVirtualMemory: BaseAddress: 00B60000, Size: 00000000 from explorer.exe(PID: 1444)

11/14/2013 05:22:13 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:860)
      RegCreateKey \REGISTRY\MACHINE\SOFTWARE\Soft

11/14/2013 05:22:13 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:860)
      RegCreateKey \REGISTRY\MACHINE\SOFTWARE\Soft\DownloadWWW

11/14/2013 05:22:13 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:860)
      RegSetValueKey Succed(0x0) [\REGISTRY\MACHINE\SOFTWARE\Soft\DownloadWWW]
                     "auto"="1"
                     OldValue(Size: New: 4, Old: 0)
                     "auto"=null

11/14/2013 05:22:13 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:860)
      MyNtUserUnhookWindowsHookEx: Success HookHandle: 0089013D

11/14/2013 05:22:13 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:860)
      MyNtUserUnhookWindowsHookEx: Success HookHandle: 0041014F

11/14/2013 05:22:13 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\vDll.dll(TID:1040)
      RegCreateKey \REGISTRY\MACHINE\Software\Microsoft\DownloadManager

11/14/2013 05:22:13 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\vDll.dll(TID:1040)
      RegSetValueKey Succed(0x0) [\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
                     "Directory"="C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5"
                     OldValue(Size: New: 184, Old: 186)
                     "Directory"="C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5"

11/14/2013 05:22:13 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\vDll.dll(TID:1040)
      RegSetValueKey Succed(0x0) [\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
                     "CachePath"="C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
                     OldValue(Size: New: 198, Old: 200)
                     "CachePath"="C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

11/14/2013 05:22:13 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\vDll.dll(TID:1040)
      RegSetValueKey Succed(0x0) [\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
                     "CachePath"="C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
                     OldValue(Size: New: 198, Old: 200)
                     "CachePath"="C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

11/14/2013 05:22:13 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\vDll.dll(TID:1040)
      RegSetValueKey Succed(0x0) [\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
                     "CachePath"="C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
                     OldValue(Size: New: 198, Old: 200)
                     "CachePath"="C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

11/14/2013 05:22:13 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\vDll.dll(TID:1040)
      RegSetValueKey Succed(0x0) [\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
                     "CachePath"="C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
                     OldValue(Size: New: 198, Old: 200)
                     "CachePath"="C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

11/14/2013 05:22:13 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\vDll.dll(TID:1040)
      MapViewOfSection(0x0) : SectionHandle: 000004BC, BaseAddress: 00FD0000, Size: 00028000, \BaseNamedObjects\C:_Documents and Settings_Administrator_Local Settings_Temporary Internet Files_Content.IE5_index.dat_163840, CurrentProcess, \Device\HarddiskVolume1\WINDOWS\explorer.exe

11/14/2013 05:22:13 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\vDll.dll(TID:1040)
      MapViewOfSection(0x0) : SectionHandle: 000004EC, BaseAddress: 00B60000, Size: 00008000, \BaseNamedObjects\C:_Documents and Settings_Administrator_Cookies_index.dat_32768, CurrentProcess, \Device\HarddiskVolume1\WINDOWS\explorer.exe

11/14/2013 05:22:13 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\vDll.dll(TID:1040)
      MapViewOfSection(0x0) : SectionHandle: 000004E0, BaseAddress: 00B80000, Size: 00008000, \BaseNamedObjects\C:_Documents and Settings_Administrator_Local Settings_History_History.IE5_index.dat_32768, CurrentProcess, \Device\HarddiskVolume1\WINDOWS\explorer.exe

11/14/2013 05:22:13 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\ntdll.dll(TID:1504) <- Serving(3) C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\vDll.dll(TID:1040)
      MapViewOfSection(0x0) : SectionHandle: 0000056C, BaseAddress: 021B0000, Size: 00001000, \BaseNamedObjects\SENS Information Cache, CurrentProcess, \Device\HarddiskVolume1\WINDOWS\explorer.exe

11/14/2013 05:22:14 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\ntdll.dll(TID:1504) <- Serving(3) C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\vDll.dll(TID:1040)
      RegSetValueKey Succed(0x0) [\REGISTRY\USER\S-1-5-21-484763869-362288127-725345543-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
                     "SavedLegacySettings"=hex:3c,00,00,00,13,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,50,01,4e,4d,dd,d9,cd,01,01,00,00,00,c0,a8,64,7c,00,00,00,00,00,00,00,00
                     OldValue(Size: New: 56, Old: 56)
                     "SavedLegacySettings"=hex:3c,00,00,00,12,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,50,01,4e,4d,dd,d9,cd,01,01,00,00,00,c0,a8,64,7c,00,00,00,00,00,00,00,00

11/14/2013 05:22:14 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\ntdll.dll(TID:1504) <- Serving(3) C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\WININET.dll(TID:928)
      Network Access: 192.168.100.18:1065 -> 174.139.167.109:80, http://www.wowchian.com/sysdl/dlms.txt

11/14/2013 05:22:15 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\ntdll.dll(TID:1504) <- Serving(3) C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\WININET.dll(TID:928)
      Network Access: 192.168.100.18:1066 -> 174.139.167.109:80, http://www.wowchian.com/sysdl/dlgt.txt

11/14/2013 05:22:15 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\ntdll.dll(TID:1504) <- Serving(3) C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\WININET.dll(TID:928)
      Network Access: 192.168.100.18:1067 -> 174.139.167.109:80, http://www.wowchian.com/sysdl/dlzt.txt

11/14/2013 05:22:16 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\ntdll.dll(TID:1504) <- Serving(3) C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\WININET.dll(TID:928)
      Network Access: 192.168.100.18:1068 -> 174.139.167.109:80, http://www.wowchian.com/sysdl/dlfz.txt

11/14/2013 05:22:16 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\vDll.dll(TID:1040)
      MyNtUserUnhookWindowsHookEx: Success HookHandle: 0042014F

11/14/2013 05:22:16 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\vDll.dll(TID:1040)
      MyNtUserUnhookWindowsHookEx: Success HookHandle: 008A013D

11/14/2013 05:22:18, NoValidSignature, LastError: 0x6, Singer: , CA:

11/14/2013 05:22:18 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:920) <- Serving(5) C:\vsamas\vsamas.exe(PID:1700)::C:\vsamas\vsamas.exe(TID:1612)
      CloseNormalThread, C:\WINDOWS\Logo1_.exe(PID: 732, TID: 920) <- C:\WINDOWS\Logo1_.exe(PID: 732, TID: 920).

11/14/2013 05:22:18 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\WININET.dll(TID:928) <- Serving(5) C:\vsamas\vsamas.exe(PID:1700)::C:\vsamas\vsamas.exe(TID:1612)
      CloseNormalThread, C:\WINDOWS\explorer.exe(PID: 1444, TID: 928) <- C:\WINDOWS\explorer.exe(PID: 1444, TID: 928).

11/14/2013 05:22:18 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\mswsock.dll(TID:932) <- Serving(5) C:\vsamas\vsamas.exe(PID:1700)::C:\vsamas\vsamas.exe(TID:1612)
      CloseNormalThread, C:\WINDOWS\explorer.exe(PID: 1444, TID: 932) <- C:\WINDOWS\explorer.exe(PID: 1444, TID: 932).

11/14/2013 05:22:18 C:\WINDOWS\explorer.exe(PID:1444)::C:\WINDOWS\system32\ntdll.dll(TID:1056) <- Serving(5) C:\vsamas\vsamas.exe(PID:1700)::C:\vsamas\vsamas.exe(TID:1612)
      CloseNormalThread, C:\WINDOWS\explorer.exe(PID: 1444, TID: 1056) <- C:\WINDOWS\explorer.exe(PID: 1444, TID: 1056).

11/14/2013 05:22:18 C:\WINDOWS\Logo1_.exe(PID:732)::C:\WINDOWS\Logo1_.exe(TID:324) <- Serving(5) C:\vsamas\vsamas.exe(PID:1700)::C:\vsamas\vsamas.exe(TID:1612)
      CloseMainThread, C:\WINDOWS\Logo1_.exe(PID: 732, TID: 324) <- C:\WINDOWS\Logo1_.exe(PID: 732, TID: 324).

11/14/2013 05:22:18 C:\WINDOWS\Logo1_.exe(PID:732)::(null)(TID:324)
      UnloadProgram C:\WINDOWS\Logo1_.exe(PID:732), Created By Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID: 592).

11/14/2013 05:22:18 C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\$$aE.bat(PID:528)::C:\WINDOWS\system32\cmd.exe(TID:2016) <- Serving(5) C:\vsamas\vsamas.exe(PID:1700)::C:\vsamas\vsamas.exe(TID:1612)
      CloseMainThread, C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\$$aE.bat(PID: 528, TID: 2016) <- C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\$$aE.bat(PID: 528, TID: 2016).

11/14/2013 05:22:18 C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\$$aE.bat(PID:528)::(null)(TID:2016)
      UnloadProgram C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\$$aE.bat(PID:528), Created By Y:\12345List\131111\12345.com_427f376c1eba4c80f82457a4a8a6e0d0.exe(PID: 592).

Conclusion
========================
Virus.Injector

显示全部楼层 · 发表于 2013-11-19 13:36:44

380183913 发表于 2013-11-18 20:00
本帖子中包含更多资源
您所在的用户组无法下载或查看附件

用搜狗瀏覽器，驚喜不斷

显示全部楼层 · 发表于 2013-11-19 16:09:07

驭龙发表于 2013-11-19 11:08
那个是病毒，你懂得

偶不懂这些专业的东西，不过看到MSE高效的处理，觉得很开心

显示全部楼层 · 发表于 2013-11-19 16:11:29

dalianjhc1986 发表于 2013-11-19 12:00
eset的云信誉还是很不错的另外样本7确实是安全文件不止一家这么说

我不太明白你的意思什么叫做不 ...

用第三方下载工具也会拦截吗？我用的FDM，MSE和360卫士都不监控这个下载，用IE浏览器下载的话就各种监控了

显示全部楼层 · 发表于 2013-11-19 16:11:33

HEMM 发表于 2013-11-19 16:09
偶不懂这些专业的东西，不过看到MSE高效的处理，觉得很开心

不过，有问题，我这里的MA不报啊，而且那个是被自我破坏的样本，应该已经是废的了。

1楼有原版的纯病毒，这个MA才会杀，哈

显示全部楼层 · 发表于 2013-11-19 16:11:36

无语啊

显示全部楼层 · 发表于 2013-11-19 16:28:21

驭龙发表于 2013-11-19 16:11
不过，有问题，我这里的MA不报啊，而且那个是被自我破坏的样本，应该已经是废的了。

1楼有原版的纯病毒 ...

布吉岛！难道是偶滴MSE超神了？各种KILL，感觉蛮不错，遇到可疑的还会提示上报啥的。就是暂时没杀
= =

显示全部楼层 · 发表于 2013-11-19 16:40:28

HEMM 发表于 2013-11-19 16:28
布吉岛！难道是偶滴MSE超神了？各种KILL，感觉蛮不错，遇到可疑的还会提示上报啥的。就是暂时没杀
...

其实MA已经很强大了，只是不够完善，要不然，哈哈

显示全部楼层 · 发表于 2013-11-19 16:43:44

驭龙发表于 2013-11-19 16:40
其实MA已经很强大了，只是不够完善，要不然，哈哈

对啊！特征库还是有点点拙计，不过已经满足日常的需求了的。
至少偶偶尔逛逛贴吧或者下载软件发现有问题的时候立马KILL，很敏的。

显示全部楼层 · 发表于 2013-11-19 16:46:04

HEMM 发表于 2013-11-19 16:43
对啊！特征库还是有点点拙计，不过已经满足日常的需求了的。
至少偶偶尔逛逛贴吧或者下载软件发现有问题 ...

不过未来两个月内引擎将没有变化了，所以我准备继续裸奔，哈哈，除非MA 4.5出来玩，哈

[病毒样本] 瑞星新引擎活动-驭龙，反馈特殊蠕虫样本-2013.11.18，样本数：8