本帖最后由 wjcharles 于 2017-5-22 16:00 编辑
多谢了！
[mw_shl_code=css,true]2017-May-22 15:52:09.128808 [6568] [INF] [4572] [arkdll]
id: 94661, type: PsCreate (16), flags: 1 (wait: 1), cid: 12668/18792:\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe
created process: \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe:12668 --> \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe:17604
type: 0, reason: 0, new: 0, dbg: 0, cmd: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-display-list-2d-canvas --enable-distance-field-text --enable-experimental-canvas-features --enable-lcd-text --enable-overlay-scrollbar --enable-smooth-scrolling --touch-events=enabled --field-trial-handle=2064 --primordial-pipe-token=86402832C9C7434CAFA102270F56BF66 --lang=zh-CN --instant-process --enable-new-bookmark-apps --javascript-harmony --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --gpu-rasterization-msaa-sample-count=16 --enable-zero-copy --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553 --service-request-channel-token=86402832C9C7434CAFA102270F56BF66 --renderer-client-id=109 --mojo-platform-channel-handle=18340 /prefetch:1
signer: C=US|ST=California|L=Mountain View|O=Google Inc|CN=Google Inc, timestamp: 09.05.2017 09:12:58.0000, thumbprint: 5a9272ce76a9415a4a3a5002a2589a049312aa40
hash: f699d662987cc0e14fadf81dd0a7cc206358226b status: db_cert_white_list, signed, pe64 / signed / unknown
id: 94661 ==> undefined [1], time: 0.671848 ms
2017-May-22 15:52:09.128808 [6572] [INF] [5036] [arkdll] path: \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe, threat: CERT:Whitelist.5a9272ce76a9415a4a3a5002a2589a049312aa40.2, hash: f699d662987cc0e14fadf81dd0a7cc206358226b, size: 1143640 ==> send detect to cloud
2017-May-22 15:52:09.194851 [6572] [INF] [event-manager] process_hips_event
2017-May-22 15:52:09.194851 [6568] [INF] [4572] [arkdll]
id: 94686, type: ShellGuard (50), flags: 1 (wait: 1), cid: 17604/20292:\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe
hips: type: 23, action: deny [5]
address: 0x7ff7914c093e
Provided message: "Protected address access from outside any known module"
Shellguard version: 11.1.8.04030
Additional information: ""
Mitigation type: Critical module access restriction
Registers:
EAX = 0x000000000000020B
ECX = 0x00007FFF640900D8
EDX = 0x00007FFF640900D8
EBX = 0x00007FF7914C0000
ESP = 0x000000A846DFF160
EBP = 0x000000000000000A
ESI = 0x0000000000000000
EDI = 0x00007FFF64090000
R8 = 0x000000A846DFF1B0
R9 = 0x00007FFF64090000
R10 = 0x0000000000000001
R11 = 0x000000A846DFF208
R12 = 0x000000000000000B
R13 = 0x000000A846DFF1D0
R14 = 0x000000A846AF1000
R15 = 0x0000000000000001
ThreadId = 20292
Instruction address is 0x7FF7914C093E
Disassembly near 0x7FF7914C093E:
0x00007FF7914C092A: mov eax, 0x20b
0x00007FF7914C092F: cmp [rcx+0x18], ax
0x00007FF7914C0933: jnz 0x914c0996
0x00007FF7914C0935: cmp dword [rcx+0x84], 0x0
0x00007FF7914C093C: jbe 0x914c0996
>>>0x00007FF7914C093E: mov r8d, [rcx+0x88]
0x00007FF7914C0945: test r8d, r8d
0x00007FF7914C0948: jz 0x914c0996
0x00007FF7914C094A: mov eax, [rcx+0x8c]
0x00007FF7914C0950: mov [rsp+0x50], eax
0x00007FF7914C0954: test r10b, r10b
0x00007FF7914C0957: jnz 0x914c0924
signer: C=US|ST=California|L=Mountain View|O=Google Inc|CN=Google Inc, timestamp: 09.05.2017 09:12:58.0000, thumbprint: 5a9272ce76a9415a4a3a5002a2589a049312aa40
hash: f699d662987cc0e14fadf81dd0a7cc206358226b status: db_cert_white_list, signed, pe64 / signed / unknown
send user blocked alert
id: 94686 ==> denied [5], time: 0.229738 ms
2017-May-22 15:52:09.194851 [6564] [INF] [5024] [arkdll] path: \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe, threat: DPH:Trojan.Exploit.6, hash: f699d662987cc0e14fadf81dd0a7cc206358226b, size: 1143640 ==> send detect to cloud
2017-May-22 15:52:09.194851 [6572] [INF] [event-manager] process common hips event
2017-May-22 15:52:09.198855 [6564] [INF] [4572] [arkdll]
id: 94687, type: PsDelete (17), flags: 0 (wait: 0), cid: 17604/20292:
terminated process: \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe:17604
signer: C=US|ST=California|L=Mountain View|O=Google Inc|CN=Google Inc, timestamp: 09.05.2017 09:12:58.0000, thumbprint: 5a9272ce76a9415a4a3a5002a2589a049312aa40
hash: f699d662987cc0e14fadf81dd0a7cc206358226b status: db_cert_white_list, signed, pe64 / signed / unknown
id: 94687 ==> undefined [1], time: 0.063948 ms
2017-May-22 15:52:09.218867 [6572] [INF] [event-manager] process shellguard event
2017-May-22 15:52:17.757846 [6568] [INF] [4572] [arkdll]
[/mw_shl_code]
|
楼主: lghcx
发表于 2017-5-21 17:01:23
另外蜘蛛设置选项很少，有些不习惯，像日志里dph啥的在设置里都没体现