一个注入Explorer,ctfmon,conime,winlogon等进程中的DLL

显示全部楼层 · 发表于 2009-3-30 17:36:51

检查机器的时候发现的，文件名很奇怪，还嵌入这么多进程。用冰刃干不掉，unlocker后会自动重启机器。利用冰刃+Unlocker+CMD终于把它从系统中删掉了，删掉后系统无异常。强烈怀疑是病毒或者木马。卡巴miss，根本不报。

附件是样本。

显示全部楼层 · 发表于 2009-3-30 17:40:58

The process Shim Engine DLL belongs to the software Microsoft Windows Operating System by Microsoft Corporation (www.microsoft.com).

Description: ShimEng.dll is located in the folder C:\Windows\System32. Known file sizes on Windows XP are 65,536 bytes (81% of all occurrence), 111,104 bytes.
A .dll file (Dynamic Link Library) is a special type of Windows program containing functions that other programs can call. This .dll file can be injected to all running processes and can change or manipulate their behavior. The program is not visible. The service has no detailed description. It can change the behavior of other programs or manipulate other programs. File ShimEng.dll is not a Windows core file. File ShimEng.dll is a trustworthy file from Microsoft. ShimEng.dll seems to be a compressed file. Therefore the technical security rating is 45% dangerous, however also read the users reviews.

看了下大小跟这里说的一样，40杀软无1报毒，大概不是毒?!

显示全部楼层 · 发表于 2009-3-30 17:45:07

卡巴不报

显示全部楼层 · 发表于 2009-3-30 17:48:47

shimeng.dll KNOWN CLEAN

显示全部楼层 · 发表于 2009-3-30 18:25:33

ik found nothing

显示全部楼层 · 发表于 2009-3-30 21:10:18

McAfee miss

显示全部楼层 · 发表于 2009-3-30 21:20:03

汗楼主还是先多学习再用XueTr吧免得误删系统文件

显示全部楼层 · 发表于 2009-3-30 22:45:00

卡巴斯基杀毒报告

扫描文件数：2

查杀（病毒、木马）数：0

详细杀毒报告列表：

无

应该不是毒吧？

显示全部楼层 · 发表于 2009-3-31 00:46:24

晕，以后没事先提交到VIRUSTOTAL里面去看看！这样的话，再来做定论！

显示全部楼层 · 发表于 2009-3-31 08:43:09

抱歉了，确实不是病毒！让大家误会了，向大家道歉！

[病毒样本] 一个注入Explorer,ctfmon,conime,winlogon等进程中的DLL

本帖子中包含更多资源