Win32.Trojan.Inject.Tejn

白露为霜

[mw_shl_code=css,true]Win32.Trojan.Inject.Tejn[/mw_shl_code]

File Type	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
File Size	1187840 Bytes
MD5	ceff4d6ed803df9f3a80046101f1455a

[mw_shl_code=css,true]Trojan/Refroso.bqkq[/mw_shl_code]

File Type	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
File Size	374635 Bytes
MD5	400adf33afb88aa5ce2e42db9dc83fbd

xyz0703

第一个：对象感染源 Trojan.Win32.Inject.aaeui
第二个：

学雷锋做人

驭龙

黑寡妇没有杀，果然是miss啊
Total records count: 5,408,057

Anti-rootkit module version ( ver: 11.1.2,01606020, api: 8.06 )

OPTION [Automatic Apply Actions] NO
OPTION [Turn Off Computer After Scan] NO
OPTION [Use Sound Alerts] NO

Using language: "English"
-----------------------------------------------------------------------------
Start scanning
-----------------------------------------------------------------------------
Command line used:/OK /HA /AR /MA /AC /SCC /SCN /SPN /SST /FL-:
"C:\Users\AppData\Local\Temp\dwlCABA.tmp"

Limit the use of the computer resources to 50%
Instances used for this session: 1
Object(s) to scan:
- List from file C:\Users\AppData\Local\Temp\dwlCABA.tmp
>E:\SAPE\S\PlanilhaPedidos.exe - packed by FLY-CODE
E:\SAPE\S\PlanilhaPedidos.exe - Ok - 2,414ms, 1,187,840 bytes
>E:\SAPE\S\S.exe - packed by UPX
>>E:\SAPE\S\S.exe is AUTOIT container
>>>E:\SAPE\S\S.exe\Users\SE\AppData\Local\Temp\aut57CD.tmp - packed by ASCRIPT
E:\SAPE\S\S.exe\Users\SE\AppData\Local\Temp\aut57CD.tmp - Ok
E:\SAPE\S\S.exe\Source\RipandReplacev5\Client\COMMON\Icons\splash.jpg - Ok
E:\SAPE\S\S.exe - Ok
E:\SAPE\S\S.exe - container - 2,024ms, 374,635 bytes

Total 1,562,475 bytes in 2 files scanned (4 objects)
Total 2 files (4 objects) are clean
There are no infected objects detected
Scan time is 00:00:05.528

好想用EMSI

第二个是白文件吧？

ymb668888

qqddliu

1】2016-06-21 18:13:45,防火墙,联网控制,PlanilhaPedidos.exe触犯网络防护规则，已阻止

操作进程：C:\Documents and Settings\Administrator\桌面\PlanilhaPedidos.exe
命令行  ："C:\Documents and Settings\Administrator\桌面\PlanilhaPedidos.exe"
网络动作：外联 TCP 200.98.165.215:80
本地地址：0.0.0.0:1618
用户操作：已阻止
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【2】2016-06-21 18:13:45,防火墙,联网控制,PlanilhaPedidos.exe触犯网络防护规则，已阻止

操作进程：C:\Documents and Settings\Administrator\桌面\PlanilhaPedidos.exe
命令行  ："C:\Documents and Settings\Administrator\桌面\PlanilhaPedidos.exe"
网络动作：外联 TCP 200.98.165.215:80
本地地址：0.0.0.0:1619
用户操作：已阻止
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【3】2016-06-21 18:13:39,系统防护,自定义防护,PlanilhaPedidos.exe触犯自定义注册表防护规则, 已阻止

操作进程：C:\Documents and Settings\Administrator\桌面\PlanilhaPedidos.exe
触犯规则：●星火●【注册表保护】〖风险设置〗 Winlogon注册表
操作类型：创建
操作注册表：HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
用户操作：已阻止

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
联网拦截，变成死马，坐等火绒更新杀之。
操作进程：C:\Documents and Settings\Administrator\桌面\S.exe
触犯规则：●星火●【文件保护】〖风险目录〗默认的系统临时目录，这个目录的程序可以适当放松限制
操作类型：创建
操作文件：C:\Documents and Settings\Administrator\Local Settings\Temp\aut112.tmp
用户操作：已忽略
第二个就在临时文件夹下创建一个临时文件就没下文了，可能规则没拦住，但是联网控制没提示联网，系统中文件也正常。

3801187

第一个样本第二个样本六楼已测，本人跳过。

心醉咖啡

猎豹miss，火绒杀第一个

追影子的十三

第一个红伞报毒，第二个大家说是白文件就没测