免杀远控木马，新的签名。

275751198

话说360还真做过拉黑白exe的事，我好像又自曝家丑了。

zixulongzhu

wu5920 发表于 2015-12-31 10:08
火绒 kill  dll

夏妹纸么？

小飞侠.net

ESET Smart Security 64位（高级启发式+启发式+DNA+智能签名）++（Win 10 th2....）：

奇虎360杀毒 64位[（QVM二代、360云查杀、Avira、BitDefender）++（Win 7....）：C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\馨妍\ZipX\123木马.zip=>1/InstLSP.dll        Gen:Variant.Graftor.260922        未处理


。。。。查杀结果看图：Scan finished.2/21 scanners reported malware.

123木马.zip - Jotti's malware scan  https://virusscan.jotti.org/en-GB/filescanjob/nefewku0km
样本MD5： Found nothing
文件名: C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\馨妍\ZipX\123木马.zip
文件大小: 284482 字节 (277.81 KB)
修改日期: 2016-01-01 03:52
MD5: 9c97a9f319fee87423df09fa482f85aa
SHA1: 296584ee9dcd94ca5b9695aa5759184d8b84c3f3
SHA256: 9c9caebbf399f3eed69ada16e2c3126ee0ac48e4363165604b0161555eb4f192
CRC32: 491bedd0

xiaofeizei

小飞侠.net 发表于 2016-1-1 04:23

妹子好早。。。
元旦快乐

sanhu35

fsrecordersrv.exe


2016-1-4 12:43:47    创建文件夹    阻止
进程: c:\documents and settings\administrator\桌面\fsrecordersrv.exe
目标: C:\Program Files\Microsoft
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:43:47    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\fsrecordersrv.exe
目标: C:\Documents and Settings\Administrator\桌面\祺
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:43:47    创建文件夹    阻止
进程: c:\documents and settings\administrator\桌面\fsrecordersrv.exe
目标: C:\Program Files\Common Files\Microsoft
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:43:47    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\fsrecordersrv.exe
目标: C:\Documents and Settings\Administrator\桌面\祺
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:43:47    创建文件夹    阻止
进程: c:\documents and settings\administrator\桌面\fsrecordersrv.exe
目标: C:\Documents and Settings\Administrator\Microsoft
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:43:47    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\fsrecordersrv.exe
目标: C:\Documents and Settings\Administrator\桌面\祺
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:43:47    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\fsrecordersrv.exe
目标: C:\Documents and Settings\Administrator\Application Data\Microsoft\px13.tmp
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:43:47    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\fsrecordersrv.exe
目标: C:\Documents and Settings\Administrator\桌面\祺
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:43:47    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\fsrecordersrv.exe
目标: C:\WINDOWS\system32\Microsoft\px14.tmp
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:43:47    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\fsrecordersrv.exe
目标: C:\Documents and Settings\Administrator\桌面\祺
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:43:47    创建文件夹    阻止
进程: c:\documents and settings\administrator\桌面\fsrecordersrv.exe
目标: C:\WINDOWS\Microsoft
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:43:47    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\fsrecordersrv.exe
目标: C:\Documents and Settings\Administrator\桌面\祺
规则: [文件组]只读磁盘 -> [文件]c:\*


====================

360se.exe


2016-1-4 12:44:02    创建新进程    允许
进程: c:\documents and settings\administrator\local settings\temp\microsoft\desktoplayer.exe
目标: c:\documents and settings\administrator\application data\360se6\application\360se.exe
命令行: "C:\Documents and Settings\Administrator\Application Data\360se6\Application\360se.exe"
规则: [应用程序]*

2016-1-4 12:44:02    创建文件    阻止
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\Application\dmlconf.dat
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:44:02    修改注册表值    阻止
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
值: c:\windows\system32\userinit.exe,,c:\docume~1\admini~1\locals~1\temp\microsoft\desktoplayer.exe
规则: [注册表组]WinLogon -> [注册表]*\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

2016-1-4 12:44:02    创建文件    阻止
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\Application\dmlconf.dat
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:44:03    修改注册表值    阻止
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
值: c:\windows\system32\userinit.exe,,c:\docume~1\admini~1\locals~1\temp\microsoft\desktoplayer.exe
规则: [注册表组]WinLogon -> [注册表]*\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

2016-1-4 12:44:04    修改注册表值    阻止
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
值: c:\windows\system32\userinit.exe,,c:\docume~1\admini~1\locals~1\temp\microsoft\desktoplayer.exe
规则: [注册表组]WinLogon -> [注册表]*\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

2016-1-4 12:44:05    修改文件    阻止
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\Application\6.2.1.232\sesafe.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:44:05    修改文件    阻止
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\Application\6.2.1.232\sesvc.exe
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:44:05    修改文件    阻止
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\Application\6.2.1.232\urlproc.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:44:05    修改文件    阻止
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\Application\6.2.1.232\urlproc_crypt.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-4 12:44:05    修改注册表值    阻止
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
值: c:\windows\system32\userinit.exe,,c:\docume~1\admini~1\locals~1\temp\microsoft\desktoplayer.exe
规则: [注册表组]WinLogon -> [注册表]*\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

尘梦幽然

Miostartos

尘梦幽然 发表于 2016-1-15 20:55

这报毒名，没见过诶

尘梦幽然

STCn1000 发表于 2016-1-15 21:03
这报毒名，没见过诶

不了解。。

windows7爱好者

360TS杀dll

vm001

windows7爱好者 发表于 2016-1-15 22:01
360TS杀dll

oem引擎报的？