刚刚抓到的，感觉很像小马

cwl12315

这个ip有印象，记得当初虚拟机里测样本，然后实机诺顿IPS报警阻止连接

驭龙

XywCloud 发表于 2015-11-24 11:34
Ramnit母体。

我发现现在的Symantec特征识别太水了，明明是Ramnit，却报为Zbot，唉

xyz0703

BD双击 杀

pal家族

驭龙 发表于 2015-11-24 12:13
我发现现在的Symantec特征识别太水了，明明是Ramnit，却报为Zbot，唉

安全威脅:        BKDR_QAKBOT.SMC
來源類型:        安全威脅
受影響的檔案:        D:\360安全浏览器下载\R…\REGSrv.exe
處理行動:        已移除
偵測方式:        即時掃瞄

(⊙o⊙)…这个更奇葩~
BD也是报zbot，哎哟~~~

skyboybone

金山

230f4

驭龙

pal家族 发表于 2015-11-24 12:26
安全威脅:        BKDR_QAKBOT.SMC
來源類型:        安全威脅
受影響的檔案:        D:\360安全浏览器下载\R…\REGSrv.exe ...

不知道我大WD会报什么呢？哈哈

wjy19800315

驭龙 发表于 2015-11-24 13:10
不知道我大WD会报什么呢？哈哈

请看

驭龙

wjy19800315 发表于 2015-11-24 13:16
请看

不愧是WD，果然是精准的报Ramnit啊，看看那诺顿居然报Zbot，我已经没啥说的了

pal家族

驭龙 发表于 2015-11-24 13:10
不知道我大WD会报什么呢？哈哈

趋势科技万恶之源，genclean，修复流程又臭又长，一个病毒要调用N多修复模板
其中就包括显示隐藏文件。。。。
趋势没处理一个病毒，我这里cpu会持续占用20%好几分钟

Damage Cleanup Engine (DCE)  7.5(Build 1035)

Windows 8.1(Build 9600)


Start time : 周二 11月 24 2015 09:17:02



Load Damage Cleanup Template (DCT) "C:\Program Files\Trend Micro\AMSP\module\10002\3.8.1193\7.5.1035\TMRDCT.ptn" (version ) [fail]

Load Damage Cleanup Template (DCT) "C:\Program Files\Trend Micro\AMSP\module\10002\3.8.1193\7.5.1035\tsc.ptn" (version 1484) [success]



Complete time : 周二 11月 24 2015 09:17:06

Execute pattern count(3120), Virus found count(0), Virus clean count(0), Clean failed count(0)



Damage Cleanup Engine (DCE)  7.5(Build 1035)

Windows 8.1(Build 9600)


Start time : 周二 11月 24 2015 09:17:06



Load Damage Cleanup Template (DCT) "C:\Program Files\Trend Micro\AMSP\module\10002\3.8.1193\7.5.1035\TMRDCT.ptn" (version ) [fail]

Load Damage Cleanup Template (DCT) "C:\Program Files\Trend Micro\AMSP\module\10002\3.8.1193\7.5.1035\tsc.ptn" (version 1484) [success]



Complete time : 周二 11月 24 2015 09:17:08

Execute pattern count(14), Virus found count(0), Virus clean count(0), Clean failed count(0)



Damage Cleanup Engine (DCE)  7.5(Build 1035)

Windows 8.1(Build 9600)


Start time : 周二 11月 24 2015 12:25:33



Load Damage Cleanup Template (DCT) "C:\Program Files\Trend Micro\AMSP\module\10002\3.8.1193\7.5.1035\TMRDCT.ptn" (version ) [fail]

Load Damage Cleanup Template (DCT) "C:\Program Files\Trend Micro\AMSP\module\10002\3.8.1193\7.5.1035\tsc.ptn" (version 1484) [success]

GenericClean::Pattern:WORM_DOWNAD,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:PE_PATCHEP.A,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:BKDR_TIDIES,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:TROJ_REVETON,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:WORM_GAMARUE,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:BKDR_POISON,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:PE_QUERVAR,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:BKDR_PLUGX,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:LNK_DORKBOT,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:BREX_GENCLEAN,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:VBS_CRIGENT,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:TROJ_LNKCLEAN,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:PE_URSNIF-INF,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:File_SCAN,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:TSC_GENSCAN,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

TSC_GENCLEAN[virus found]

-->delete file("D:\360安全浏览器下载\REGSrv\REGSrv.exe","","") success

-->reboot modify registry data("HKEY_CURRENT_USER","Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced","ShowSuperHidden") success

GenericClean::Pattern:TSC_GENCLEAN,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe



Complete time : 周二 11月 24 2015 12:25:38

Execute pattern count(16), Virus found count(1), Virus clean count(1), Clean failed count(0)



Damage Cleanup Engine (DCE)  7.5(Build 1035)

Windows 8.1(Build 9600)


Start time : 周二 11月 24 2015 12:25:38



Load Damage Cleanup Template (DCT) "C:\Program Files\Trend Micro\AMSP\module\10002\3.8.1193\7.5.1035\TMRDCT.ptn" (version ) [fail]

Load Damage Cleanup Template (DCT) "C:\Program Files\Trend Micro\AMSP\module\10002\3.8.1193\7.5.1035\tsc.ptn" (version 1484) [success]

GenericClean::Pattern:WORM_DOWNAD,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:PE_PATCHEP.A,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:BKDR_TIDIES,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:TROJ_REVETON,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:WORM_GAMARUE,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:BKDR_POISON,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:PE_QUERVAR,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:BKDR_PLUGX,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:LNK_DORKBOT,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:BREX_GENCLEAN,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:VBS_CRIGENT,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:TROJ_LNKCLEAN,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:PE_URSNIF-INF,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:File_SCAN,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

GenericClean::Pattern:TSC_GENSCAN,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe

TSC_GENCLEAN[virus found]

GenericClean::Pattern:TSC_GENCLEAN,Virus Name:BKDR_QAKBOT.SMC,Virus File Path:\\?\D:\360安全浏览器下载\REGSrv\REGSrv.exe



Complete time : 周二 11月 24 2015 12:25:41

Execute pattern count(16), Virus found count(1), Virus clean count(1), Clean failed count(0)



Damage Cleanup Engine (DCE)  7.5(Build 1035)

Windows 8.1(Build 9600)


Start time : 周二 11月 24 2015 12:37:11



Load Damage Cleanup Template (DCT) "C:\Program Files\Trend Micro\AMSP\module\10002\3.8.1193\7.5.1035\TMRDCT.ptn" (version ) [fail]

Load Damage Cleanup Template (DCT) "C:\Program Files\Trend Micro\AMSP\module\10002\3.8.1193\7.5.1035\tsc.ptn" (version 1484) [success]



Complete time : 周二 11月 24 2015 12:37:17

Execute pattern count(3120), Virus found count(0), Virus clean count(0), Clean failed count(0)



Damage Cleanup Engine (DCE)  7.5(Build 1035)

Windows 8.1(Build 9600)