微点不认识的bootkit By Joanna Rutkowska

显示全部楼层 · 发表于 2008-9-12 15:51:53

Can Micrppoint Withstand the MS08067-Force?

Found Trojan.genus , delete it or not?
program(s):
F:\EXPLOITMS08-067  WIN32GIMMIV A\N1.EXE
Trojan program(s) generates files as below:
1) C:\WINDOWS\SYSTEM32\WBEM\SYSMGR.DLL
Delete Trojan program(s) and its remains or not?

Time KEY Name Original value New value Creator

HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SYSMGR\PARAMETERS\ SERVICEDLL  C:\WINDOWS\SYSTEM32\WBEM\SYSMGR.DLL F:\EXPLOITMS08-067  WIN32GIMMIV A\N7.EXE

HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SYSMGR\ IMAGEPATH  %SYSTEMROOT%\SYSTEM32\SVCHOST.EXE -K SYSMGR F:\EXPLOITMS08-067  WIN32GIMMIV A\N7.EXE

[ 本帖最后由 Nblock 于 2008-10-29 11:35 编辑 ]

显示全部楼层 · 发表于 2008-9-12 16:11:13

有密码无法扫描

显示全部楼层 · 发表于 2008-9-12 16:19:46

密码呢？

显示全部楼层 · 发表于 2008-9-12 16:51:07

以被密码保护！

显示全部楼层 · 发表于 2008-9-12 17:23:44

mp14

显示全部楼层 · 发表于 2008-9-12 19:34:53

The scan has been done completely.

   1 Scanning directories
   4 Files were scanned
   0 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   4 Files not concerned
   0 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-9-12 19:44:45

McAfee miss

显示全部楼层 · 发表于 2008-9-12 19:49:23

金山 0

显示全部楼层 · 发表于 2008-9-12 21:01:50

已经上报。

显示全部楼层 · 发表于 2008-9-12 21:29:09

File ID    Filename    Size (Byte) Result
25132982    bootcode.sys    14.5 KB    CLEAN
25132983    bpboot.exe    10.5 KB    CLEAN
25132984    mbr.bin    415 Byte    CLEAN
25132985    restorebackup.exe    9 KB    CLEAN

[病毒样本] 微点不认识的bootkit By Joanna Rutkowska

本帖子中包含更多资源

回复 4楼 yuanliu 的帖子