gdata主防突然拦截了一个阿里旺旺的动作

zq19861019

正在逛论坛呢，突然gdata主防报警，我刚还原的系统，没有下什么东西啊。想这不可能中毒，一看报告，是阿里旺旺的。
请大神们帮忙分析下，是误报还是阿里旺旺有流氓动作。



AVA 25.6595
GD 25.6877

*** Process ***

Process: 10616
File name: aliimx.dll
Path: d:\program files (x86)\aliwangwang\8.60.00c\aliimx.dll

Publisher: Unknown publisher
Creation date: 05/14/16 14:20:01
Modification date: 05/14/16 14:20:01

Publisher: Unknown publisher


*** Actions ***

The program has changed values in the system registry that can be used to endanger the system.
The program establishes a network connection.
An unknown process was accessed.
The program has downloaded infected software.
An executable file was stored in a suspicious location.


*** Quarantine ***

The following files were moved into quarantine:
c:\users\琪\appdata\local\microsoft\internet explorer\imagestore\0v5ipei\imagestore.dat
c:\users\琪\appdata\local\microsoft\internet explorer\tabroaming\e0beb17a-56c5-422d-9b3d-e5ec9935a077\machineinfo.dat
c:\users\琪\appdata\local\microsoft\windows\inetcache\ie\anu93dhm\brf2[1].dat_20160515213522
c:\users\琪\appdata\local\microsoft\windows\inetcache\ie\anu93dhm\favicon[1].ico
c:\users\琪\appdata\local\microsoft\windows\inetcache\ie\nnfn3mh1\brf2[1].dat_20160515212513
c:\users\琪\appdata\local\microsoft\windows\inetcache\ie\nnfn3mh1\iecompatviewlist[1].xml
c:\users\琪\appdata\local\microsoft\windows\inetcache\ie\s8d8frp9\brf2[1].dat_20160515210959
c:\users\琪\appdata\local\microsoft\windows\inetcache\ie\s8d8frp9\favicon[1].ico
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\6w7iu9cl\10_avatar_small[1].jpg
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\6w7iu9cl\34_avatar_small[1].jpg
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\6w7iu9cl\cceylzvu.htm
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\6w7iu9cl\fm[1].js
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\6w7iu9cl\seditor[1].js
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\6w7iu9cl\style_8_common[1].css
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\6w7iu9cl\thread-next[1].png
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\a1hk14w9\collapsed_yes[1].gif
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\a1hk14w9\control_l[1].png
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\a1hk14w9\discuz_tips[1].js
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\a1hk14w9\fj_btn[1].png
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\a1hk14w9\md5[1].js
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\a1hk14w9\mw_wz[1].css
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\a1hk14w9\style[1].css
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\rbhjgup6\logo[1].png
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\rbhjgup6\pn_post[1].png
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\rbhjgup6\style[1].css
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\rbhjgup6\style_8_forum_viewthread[1].css
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\rbhjgup6\thread-2041072-1-1[1].htm
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\rbhjgup6\thread-prev[1].png
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\vownsmlb\123520oz5ei5eiveivet88.png.thumb[1].png
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\vownsmlb\47_avatar_small[1].jpg
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\vownsmlb\65_avatar_small[1].jpg
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\vownsmlb\arw_r[1].gif
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\vownsmlb\hot_1[1].gif
c:\users\琪\appdata\local\microsoft\windows\inetcache\low\ie\vownsmlb\style_8_forum_index[1].css
c:\users\琪\appdata\local\microsoft\windows\inetcache\virtualized\c\programdata\nvidia corporation\drs\nvapptimestamps
c:\users\琪\appdata\local\microsoft\windows\inetcache\virtualized\c\programdata\nvidia corporation\drs\nvdrssel.bin
c:\users\琪\appdata\local\microsoft\windows\inetcache\virtualized\c\programdata\tencent\txpltsafe\nwb.dat
c:\users\琪\appdata\local\microsoft\windows\inetcache\virtualized\c\users\琪\appdata\roaming\tencent\deskupdate\globalmgr.db
c:\users\琪\appdata\local\microsoft\windows\inetcookies\low\1uky2g07.txt
c:\users\琪\appdata\local\microsoft\windows\inetcookies\low\a38lp841.txt
c:\users\琪\appdata\local\microsoft\windows\inetcookies\low\fqzug4pc.txt
c:\users\琪\appdata\local\microsoft\windows\inetcookies\low\i630dsk1.txt
c:\users\琪\appdata\local\microsoft\windows\inetcookies\low\my2crofv.txt
c:\users\琪\appdata\local\microsoft\windows\inetcookies\low\pwrrdb5d.txt
c:\users\琪\appdata\local\microsoft\windows\inetcookies\low\r2m5o45t.txt
c:\users\琪\appdata\local\microsoft\windows\inetcookies\low\xz9o7ef7.txt
c:\users\琪\appdata\local\microsoft\windows\inetcookies\low\zezblbb2.txt
c:\users\琪\appdata\local\temp\avk2984.tmp
c:\users\琪\appdata\local\temp\avk8042.tmp
c:\users\琪\appdata\local\temp\avk80e2.tmp
c:\users\琪\appdata\local\temp\avkdb4a.tmp
c:\users\琪\appdata\local\temp\avkf9fb.tmp
c:\users\琪\appdata\local\temp\~df6a0c8a474ea57994.tmp
c:\users\琪\appdata\roaming\adobe\flash player\nativecache\nativecache.directory
c:\users\琪\appdata\roaming\macromedia\flash player\#sharedobjects\grahymkc\static.fraudmetrix.cn\fraudmetrix.cn.sol
c:\users\琪\appdata\roaming\macromedia\flash player\#sharedobjects\grahymkc\static.fraudmetrix.cn\fraudmetrix.cn.sxx
c:\users\琪\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#static.fraudmetrix.cn\settings.sol
c:\users\琪\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#static.fraudmetrix.cn\settings.sxx
c:\users\琪\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol
c:\users\琪\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sxx
c:\users\琪\appdata\roaming\taobaoprotect\brf.dat
c:\users\琪\appdata\roaming\taobaoprotect\brf.tmp
c:\users\琪\appdata\roaming\tencent\qqpinyin\5.2.3051.400local.stat
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc\eudcbihua_12.dat
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc\eudcbihua_2.dat
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc\eudcchaizi_12.dict
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc\eudcchaizi_2.dict
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc\eudcdict_12.dict
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc\eudcdict_2.dict
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc\options.ini
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc\qqpyeudc_12.euf
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc\qqpyeudc_12.tte
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc\qqpyeudc_2.euf
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc\qqpyeudc_2.tte
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc_temp\eudc_merge.euf
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc_temp\eudc_merge.tte
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc_temp\eudcbihua.dat
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc_temp\eudcchaizi.dict
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc_temp\eudcdict.dict
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc_temp\options.ini
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc_temp\qqpyeudc.euf
c:\users\琪\appdata\roaming\tencent\qqpinyin\eudc_temp\qqpyeudc.tte
c:\users\琪\appdata\roaming\tencent\qqpinyin\sync2\base\b35be2e10948d6f73c069471afe0bfdd\enguser.dat
c:\users\琪\appdata\roaming\tencent\qqpinyin\sync2\base\b35be2e10948d6f73c069471afe0bfdd\url.dat
c:\users\琪\appdata\roaming\tencent\qqpinyin\sync2\cache\cache.ini
c:\users\琪\appdata\roaming\tencent\qqpinyin\sync2\cache\cin3cde.tmp
c:\users\琪\appdata\roaming\tencent\qqpinyin\sync2\temp\at3be1.tmp
c:\users\琪\appdata\roaming\tencent\qqpinyin\sync2\temp\smg39d6.tmp
c:\users\琪\appdata\roaming\tencent\qqpinyin\sync2\temp\smg3a57.tmp
c:\users\琪\appdata\roaming\tencent\qqpinyin\sync2\temp\smg3b15.tmp
c:\users\琪\appdata\roaming\tencent\qqpinyin\sync2\temp\uen3a37.tmp
c:\users\琪\appdata\roaming\tencent\qqpinyin\sync2\temp\url3aa6.tmp
c:\users\琪\appdata\roaming\tencent\qqpinyin\url.dat
c:\users\琪\appdata\roaming\tencent\qqpinyin\user2.dict

The following registry entries were deleted:

\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001\software\microsoft\internet explorer\lowregistry\domstorage || bbs.kafan.cn
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001\software\microsoft\internet explorer\lowregistry\domstorage || cdn.tanx.com
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001\software\microsoft\internet explorer\lowregistry\domstorage\kafan.cn || numberofsubdomains
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001\software\microsoft\internet explorer\lowregistry\domstorage\kafan.cn || total
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001\software\microsoft\internet explorer\lowregistry\domstorage\tanx.com || numberofsubdomains
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001\software\microsoft\internet explorer\lowregistry\domstorage\tanx.com || total
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001\software\microsoft\internet explorer\lowregistry\domstorage || total
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001\software\microsoft\internet explorer\recovery\active || b954e139-1aa3-11e6-8264-40e2304aedd4
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001\software\microsoft\internet explorer\tabbedbrowsing\newtabpage || decaydatequeue
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001\software\microsoft\internet explorer\tabbedbrowsing\newtabpage || lastprocessed
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001\software\microsoft\internet explorer\typedurls || url1
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001\software\microsoft\internet explorer\typedurlstime || url1
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001\software\microsoft\windows\currentversion\explorer\plmvolatile\terminationtype || microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\muicache\3c\aaf68885\@%systemroot%\system32 || fveui.dll,-843
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\muicache\3c\aaf68885\@%systemroot%\system32 || fveui.dll,-844
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\muicache\3c\aaf68885\@%systemroot%\system32 || qagentrt.dll,-10
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\muicache\3c\aaf68885\@%systemroot%\system32 || wuaueng.dll,-400
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bagmru\1\3\2 || 2
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bagmru\1\3\2\2 || mrulistex
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\106\shell || sniffedfoldertype
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\106\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || colinfo
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\106\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || groupbydirection
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\106\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || groupbykey:fmtid
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\106\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || groupbykey:pid
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\106\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || groupview
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\106\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || iconsize
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\106\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || logicalviewmode
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\106\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || mode
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\106\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || sort
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\107\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || colinfo
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\107\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || groupbykey:fmtid
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\107\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || groupview
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\107\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || iconsize
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\107\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || logicalviewmode
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\107\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || mode
\registry\user\s-1-5-21-2562550307-1284340934-1480543006-1001_classes\local settings\software\microsoft\windows\shell\bags\107\shell\5c4f28b5-f869-4e84-8e60-f11db97c5cc7 || sort

YGLRwpYJLCfuJyYmJ+4HLSeoj2JicoL6CC4n55xiYnJyzgm5YtFyaQvJcnKQLifbKiYmJ9sKenKi7GJicqLsoCwneygmJid7CNpyctcqJiYnd62wKScoJiYnCKxygnliYnKCecAtJygmJicIbXLCKSYmJ5zQLSfJYmJykgxucoIGj3KyYmJysnDWcnLXKiYmJ3etcKdycnBocsJiYnLCcIhy0mJictJwmHLSYmJy0nCocpJiYnKScLhygtkrJiYnmL1w2HKSYmJyknD4cnJiYnJycPly0v5iYnLS/nC6spFbY8aCYmKykVtjxoJw23JyJyYmJ3dw+3JyLiYmJ+dwvHKSYmJyknDscnJiYnJycPxyspdiYnKyl3CdctInJiYnfXCOcsIH9yknhyomJieHCvcvJ78qJiYnvwpoKSe8DYgvJ8ovJiYnyg+YJifKD7gvJ51iYnLSCQA
Rules version: 5.0.98
OS: Windows 6.3 Service Pack 0.0 Build: 9600 - Workstation 64bit OS
dll version: 59958


MD5: DDADE93F0E7035CB078AD5A56227368B

尘梦幽然

所以阿里旺旺是给回滚干净了吗

275751198

样本在哪里呀，样本在哪里？

zq19861019

尘梦幽然 发表于 2016-5-15 22:07
所以阿里旺旺是给回滚干净了吗

没有，阿里旺旺还能用

zq19861019

尘梦幽然 发表于 2016-5-15 22:07
所以阿里旺旺是给回滚干净了吗

这个dll文件还在，只是好像把动作回滚了

zq19861019

275751198 发表于 2016-5-15 22:08
样本在哪里呀，样本在哪里？

重新上传了，你看看吧

Nostalie

zq19861019 发表于 2016-5-15 22:14
重新上传了，你看看吧

还有 QQ拼音哦

zq19861019

Nostalie 发表于 2016-5-15 22:22
还有 QQ拼音哦

现在回滚了，是安全了还是我要把那些软件也卸载了

275751198

有效数签自然过360

Nostalie

zq19861019 发表于 2016-5-15 22:25
现在回滚了，是安全了还是我要把那些软件也卸载了

哈勃的分析