在沙盘中运行失败

qcqyt

2008-02-23 16:41:22    运行应用程序      操作:允许(自动创建规则)
进程路径:C:\WINDOWS\explorer.exe
文件路径:C:\Documents and Settings\qcqyt\桌面\sf\file2.exe


2008-02-23 15:54:48    删除文件      操作:阻止
进程路径:C:\Documents and Settings\qcqyt\桌面\sf\file2.exe
文件路径:C:\boot.ini
触发规则:黑名单->重要文件->%SystemDrive%\boot.ini


2008-02-23 16:41:22    创建文件      操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\qcqyt\桌面\sf\file2.exe
文件路径:C:\bOoT.ini


2008-02-23 16:41:23    运行应用程序      操作:允许(自动创建规则)
进程路径:C:\WINDOWS\explorer.exe
文件路径:C:\Documents and Settings\qcqyt\桌面\sf\file1.exe


2008-02-23 16:41:24    创建文件      操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\qcqyt\桌面\sf\file1.exe
文件路径:C:\Documents and Settings\qcqyt\桌面\sf\winlogon.exe


2008-02-23 16:41:24    运行应用程序      操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\qcqyt\桌面\sf\file1.exe
文件路径:C:\Documents and Settings\qcqyt\桌面\sf\winlogon.exe
命令行:!psw=xek


2008-02-23 16:41:28    修改其它进程内存      操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\qcqyt\桌面\sf\file2.exe
目标进程:C:\Documents and Settings\qcqyt\桌面\sf\file2.exe


2008-02-23 16:41:29    创建文件      操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\qcqyt\桌面\sf\file2.exe
文件路径:C:\Documents and Settings\qcqyt\Local Settings\Temp\svh0sts.exe


2008-02-23 16:41:33    运行应用程序      操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\qcqyt\桌面\sf\file2.exe
文件路径:C:\Documents and Settings\qcqyt\Local Settings\Temp\svh0sts.exe


2008-02-23 16:41:33    创建文件      操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\qcqyt\Local Settings\Temp\svh0sts.exe
文件路径:C:\WINDOWS\system32\drivers\ntndis.exe


2008-02-23 16:41:34    修改注册表内容      操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\qcqyt\Local Settings\Temp\svh0sts.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
注册表名称:Shell
注册表数据:Explorer.exe C:\WINDOWS\system32\drivers\ntndis.exe


2008-02-23 16:41:34    创建注册表值      操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\qcqyt\Local Settings\Temp\svh0sts.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
注册表名称:C:\DOCUME~1\qcqyt\LOCALS~1\Temp\svh0sts.exe
注册表数据:C:\DOCUME~1\qcqyt\LOCALS~1\Temp\svh0sts.exe:*:Enabled:Control

bOoT.ini内容:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

协议        本机IP：端口                     远程IP：端口                     状态              PID           路径名
TCP              192.168.1.22 : 1042             203.117.111.102 : 80           CLOSING          1676        C:\WINDOWS\system32\drivers\ntndis.exe

1688388728

检测到一个应用程序尝试创建一个 DNS 请求
询问名称:
DNS 服务器: 61.128.114.133, 61.128.114.166

2008-02-23 18:18:49    修改文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\sf\file2.exe
文件路径:C:\bOoT.ini
触发规则:黑名单->文件保护->C:\*boot.ini*

wangjay1980

file1.exe - Trojan-PSW.Win32.Delf.aqg,
file2.exe - Trojan-PSW.Win32.Delf.aqh,

woai_jolin

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

file1.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS
    * Compressed: YES
    * TLS hooks: NO
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * File length:        78912 bytes.
    * MD5 hash: a33e1cc878dfbef627283bcd7f4c46a0.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

qigang

rising20.32.52未杀！

28654621

D:\download\sf.rar>>file1.exe        Heuri.Suspicious.ERNM        启发式扫描        还未处理
D:\download\sf.rar>>file2.exe        Heuri.Suspicious.ERNM        启发式扫描        还未处理

allinwonderi

[Scanning : C:\Test]


C:\Test\sf.rar<RAR>:file1.exe <- Heur.Win32.H : No action
C:\Test\sf.rar<RAR>:file2.exe <- Heur.Win32.H : No action



Scanned objects : 3

Infected objects : 2

28654621

原帖由 allinwonderi 于 2008-2-23 20:32 发表
[Scanning : C:\Test]


C:\Test\sf.rar:file1.exe  

这是什么杀软啊

悠柚

应该是Arcabit，某波兰的

solcroft