很新的ZeroAccess

windows7爱好者

nick20010117 发表于 2016-2-16 21:00
ZA一般不需要联网就可以锁驱动

管理员运行，你依然这样安静

aboringman

看来吃菜时间真的到了，这顿可真丰盛啊

AVG：

扫描：kill 3 files；

"";"Trojan horse Crypt5.XVD, C:\Users\killer\Desktop\7babbfbbd4d8a15dd7b93bcd8e985c676e0e1e063162be8ef2ee789729b5f9c9.bin";"Healed, Moved to Virus Vault";"File or Directory";"2016/2/16, 19:46:18"


"";"Trojan horse Crypt5.XVD, C:\Users\killer\Desktop\GOOGLEUPDATE.bin";"Healed, Moved to Virus Vault";"File or Directory";"2016/2/16, 19:46:18"

"";"Trojan horse Atros2.BUEF, C:\Users\killer\Desktop\dump.bin";"Healed, Moved to Virus Vault";"File or Directory";"2016/2/16, 19:46:18"

"";"Trojan horse Atros2.BUEF, C:\Users\killer\Desktop\dump.bin:\k32";"Healed";"Embedded element in the archive, email attachment, cookie etc.";"2016/2/16, 19:46:18"

"";"Trojan horse Atros2.BUEE, C:\Users\killer\Desktop\dump.bin:\k64";"Healed";"Embedded element in the archive, email attachment, cookie etc.";"2016/2/16, 19:46:18"

双击：关闭监控，实机双击，IDP kill "GOOGLEUPDATE.exe" and "7babbfbbd4d8a15dd7b93bcd8e985c676e0e1e063162be8ef2ee789729b5f9c9.exe"，双击dump.exe提示错误，然后自动退出，未留下可疑痕迹。

"";"Unknown, C:\Users\killer\Desktop\新建文件夹\7babbfbbd4d8a15dd7b93bcd8e985c676e0e1e063162be8ef2ee789729b5f9c9.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/16, 19:51:09"

"";", C:\Users\killer\Desktop\新建文件夹\7babbfbbd4d8a15dd7b93bcd8e985c676e0e1e063162be8ef2ee789729b5f9c9.exe";"Object was blocked";"Process";"2016/2/16, 19:51:09"

"";", C:\Windows\explorer.exe";"Object was blocked";"Process";"2016/2/16, 19:51:09"

"";", C:\Windows\System32\svchost.exe";"Object was blocked";"Process";"2016/2/16, 19:51:09"

"";", C:\PROGRAM FILES\GOOGLE\DESKTOP\INSTALL\{47D1BB67-8CD7-5BD3-EC57-CC383EE5C2AD}\# \GOOGLEUPDATE.EXE";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/16, 19:51:09"

"";", C:\USERS\KILLER\APPDATA\LOCAL\GOOGLE\DESKTOP\INSTALL\{47D1BB67-8CD7-5BD3-EC57-CC383EE5C2AD}\# \GOOGLEUPDATE.EXE";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/16, 19:51:09"

"";", HKEY_USERS\S-1-5-21-540828005-2055914412-3868506426-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\\!";"Deleted, Moved to Virus Vault";"Registry value";"2016/2/16, 19:51:09"

"";", HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\{47D1BB67-8CD7-5BD3-EC57-CC383EE5C2AD}";"Deleted, Moved to Virus Vault";"Registry key";"2016/2/16, 19:51:09"
"";", HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\{47D1BB67-8CD7-5BD3-EC57-CC383EE5C2AD}";"Deleted";"Registry key";"2016/2/16, 19:51:09"

"";"Unknown, C:\Users\killer\Desktop\新建文件夹\GOOGLEUPDATE.exe";"Healed, Moved to Virus Vault";"File or Directory";"2016/2/16, 19:56:25"

"";", C:\Users\killer\Desktop\新建文件夹\GOOGLEUPDATE.exe";"Object was blocked";"Process";"2016/2/16, 19:56:25"

"";", C:\Windows\explorer.exe";"Object was blocked";"Process";"2016/2/16, 19:56:25"

"";", C:\USERS\KILLER\APPDATA\LOCAL\GOOGLE\DESKTOP\INSTALL\{47D1BB67-8CD7-5BD3-EC57-CC383EE5C2AD}\# \GOOGLEUPDATE.EXE";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/16, 19:56:25"

"";", HKEY_USERS\S-1-5-21-540828005-2055914412-3868506426-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\\!";"Deleted, Moved to Virus Vault";"Registry value";"2016/2/16, 19:56:25"

"";", HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\{47D1BB67-8CD7-5BD3-EC57-CC383EE5C2AD}";"Deleted, Moved to Virus Vault";"Registry key";"2016/2/16, 19:56:25"

"";", HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\{47D1BB67-8CD7-5BD3-EC57-CC383EE5C2AD}";"Deleted";"Registry key";"2016/2/16, 19:56:25"

后来全扫了一次，没有问题，Hunter也未发现可疑驱动，防御成功。

aboringman

nick20010117 发表于 2016-2-16 20:47
你打算双击吗？

当然得吃，见34楼，成功吃下了

aboringman

@ericdj @230f4

我请你们吃ZA大餐，快点来

230f4

aboringman 发表于 2016-2-16 21:15
@ericdj @230f4

我请你们吃ZA大餐，快点来

留给ericdj了

aboringman

230f4 发表于 2016-2-16 21:17
留给ericdj了

来吃啊，别客气，这只的口味还太淡了点，包你喜欢

BDIS拦截下载

我就不测ATC了，留给你们

windows7爱好者

aboringman 发表于 2016-2-16 21:22
来吃啊，别客气，这只的口味还太淡了点，包你喜欢

双击了另一只，终于有反应了

阻止后，报错，请先让我笑一会
另一只现在也有反应了，这次我允许了更改，可是结果还是，哈哈哈

aboringman

windows7爱好者 发表于 2016-2-16 21:28
双击了另一只，终于有反应了

阻止后，报错，请先让我笑一会

小心一点，虽然ZA好吃，但是有时候还会反咬你一口。

做好修复驱动的准备，这家伙喜欢对驱动下手，而且还会死而复生（与Zbot的自恢复能力差不多）。

蜘蛛的清除测试又将再次被你开启，祝好运。

windows7爱好者

aboringman 发表于 2016-2-16 21:32
小心一点，虽然ZA好吃，但是有时候还会反咬你一口。

做好修复驱动的准备，这家伙喜欢对驱动下手，而且 ...

再试一次，还是老样子，我都允许你了，你还啥都干不了，这就不怪我了 ，报错后进程也没有，蜘蛛右键杀掉，重启都不需要
完了，我怀疑我中了一种系统自我免疫病毒，怎么办啊