可疑的驱动文件

scottxzt

感谢楼上的朋友。


但是直接在window跟目录下生成iu6002exe文件绝不是良民。

daily

daily

Sherry.ai

To KL
已经运行不起来了...

sam.to

有结果嗎?

08红伞威点

上沙盘。。。
∞∞∞∞∞∞∞∞
• File Info

Name	Value
Size	466239
MD5	6de7c3afb7eb8cc6fdb56b931e11ceef
SHA1	2cbcecc8cccc76d06aafec496393b5e88dbf2697
SHA256	adae22f9839a85f6180cb9ffadd8b16fcfc3a4e135a52a3a3dc58490158b369a
Process	Exited

• Keys Created• Keys Changed• Keys Deleted• Values Created• Values Changed• Values Deleted• Directories Created• Directories Changed• Directories Deleted• Files Created

Name	Size	Last Write Time	Creation Time	Last Access Time	Attr
C:\Documents and Settings\User\Local Settings\Temp\IRIMG1.BMP	8134	2009.01.12 14:51:06.437	2009.01.12 14:51:06.437	2009.01.12 14:51:06.437	0x20
C:\Documents and Settings\User\Local Settings\Temp\IRIMG2.BMP	8134	2009.01.12 14:51:06.453	2009.01.12 14:51:06.437	2009.01.12 14:51:06.437	0x20
C:\Documents and Settings\User\Local Settings\Temp\irsetup.dat	2852	2009.01.12 14:51:06.390	2009.01.12 14:51:06.390	2009.01.12 14:51:06.390	0x20
C:\Documents and Settings\User\Local Settings\Temp\irsetup.exe	720896	2009.01.12 14:51:06.390	2009.01.12 14:51:06.250	2009.01.12 14:51:06.250	0x20
C:\Documents and Settings\User\Local Settings\Temp\irsetup.ini	53	2009.01.12 14:51:06.468	2009.01.12 14:51:06.453	2009.01.12 14:51:06.453	0x20
C:\Documents and Settings\User\Local Settings\Temp\suf6lng.4	12476	2009.01.12 14:51:06.421	2009.01.12 14:51:06.406	2009.01.12 14:51:06.406	0x20

• Files Changed• Files Deleted• Directories Hidden• Files Hidden• Drivers Loaded• Drivers Unloaded• Processes Created

PId	Process Name	Image Name
0xb8	irsetup.exe	C:\DOCUME~1\User\LOCALS~1\Temp\irsetup.exe

• Processes Terminated• Threads Created

PId	Process Name	TId	Start	Start Mem	Win32 Start	Win32 Start Mem
0xb8	irsetup.exe	0xa8	0x7c810867	MEM_IMAGE	0x45d5dc	MEM_IMAGE
0xb8	irsetup.exe	0xb4	0x7c810856	MEM_IMAGE	0x5b890d69	MEM_IMAGE

• Modules Loaded• Windows Api Calls• DNS Queries• HTTP Queries• Verdict

Auto Analysis Verdict

Not Rated as Suspicious

• Events Created or Opened

PId	Image Name	Address	Event Name
0xb8	C:\DOCUME~1\User\LOCALS~1\Temp\irsetup.exe	0x7473d2a8	CTF.ThreadMIConnectionEvent.00000620.00000000.00000006
0xb8	C:\DOCUME~1\User\LOCALS~1\Temp\irsetup.exe	0x7473d2a8	CTF.ThreadMarshalInterfaceEvent.00000620.00000000.00000006
0xb8	C:\DOCUME~1\User\LOCALS~1\Temp\irsetup.exe	0x7473d2a8	MSCTF.SendReceive.Event.ACG.IC
0xb8	C:\DOCUME~1\User\LOCALS~1\Temp\irsetup.exe	0x7473d2a8	MSCTF.SendReceiveConection.Event.ACG.IC
0xb8	C:\DOCUME~1\User\LOCALS~1\Temp\irsetup.exe	0x77de5f48	Global\SvcctrlStartEvent_A3752DX

08红伞威点

试了下。。。点‘忽略’后可以安装成功。




安装完。没发现链网、红伞也没出现报警，机子暂无发现异常。

08红伞威点

原帖由 08红伞威点 于 2009-1-17 19:23 发表
File ID  Filename Size (Byte) Result
25234563  SETUP.EXE  455.31 KB  UNDER ANALYSIS

File ID	Filename	Size (Byte)	Result
25234563	SETUP.EXE	455.31 KB	CLEAN

17 Jan 2009 12:22 +0100

19 Jan 2009 09:49 +0100

已经决定是 '干净的' 。