VT Detection ratio: 3 / 47 qZExGTj0.exe Registry Alert说别跟我玩虚幻的

显示全部楼层 · 发表于 2013-11-22 22:20:35

skycai 发表于 2013-11-22 22:15
云端入库了。

是的，，，好像响应快起来了的节奏

显示全部楼层 · 发表于 2013-11-22 22:29:15

MSE不杀，才用MSE不久，不是虚设吧？

显示全部楼层 · 发表于 2013-11-22 22:54:36

这玩艺儿跟OA Free是绝配

显示全部楼层 · 发表于 2013-11-22 22:57:59

360IS

显示全部楼层 · 发表于 2013-11-30 09:21:01

第一个文件在线分析结果：
http://www.threatexpert.com/repo ... c2ce25e8eb906e3d5a8

Registry Modifications

* The following Registry Keys were created:
      o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
      o HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
      o HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib

* The newly created Registry Values are:
      o [HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib]
            + vga.drv 640x480x32(BGR 0) = "31,31,31,31"
      o [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
            + shell = "explorer.exe,%AppData%\Other.res"

         so that %AppData%\Other.res runs every time Windows starts

Other details

* To mark the presence in the system, the following Mutex objects were created:
      o DDrawWindowListMutex
      o DDrawDriverObjectListMutex
      o __DDrawExclMode__

* The data identified by the following URLs was then requested from the remote web server:
      o http://hnvy.ru/forum/okrsavxgdrh ... ed_clnuhkokrptt.php
      o http://efgb.su/forum/iunutnvdgmb ... qaf-tgfnititje_.php

显示全部楼层 · 发表于 2013-11-30 11:00:05

2013/11/30 10:59:54 HTTP 过滤器文件 https://att.kafan.cn/forum.php?mo ... DI2NDk0MHwxNjU2Mjg5 Win32/Kryptik.BPKX 特洛伊木马的变种连接中断 - 已隔离 home-pc\Galaxy 通过应用程序访问 web 时检测到威胁: C:\Program Files\Google\Chrome\Application\chrome.exe.

显示全部楼层 · 发表于 2013-11-30 11:40:43

这是什么软件的弹窗

显示全部楼层 · 发表于 2013-11-30 12:04:58

猪头无双发表于 2013-11-22 20:45
费尔第一个解决，第二个没反应，不知道是否能防住

已入库，下载秒杀

[可疑文件] VT Detection ratio: 3 / 47 qZExGTj0.exe Registry Alert说别跟我玩虚幻的

本帖子中包含更多资源