【软件下载】带木马软件

zhuhaimi

http://bbs.kafan.cn/thread-432444-1-1.html

请斑竹处理
附上日志：
http://www.threatexpert.com/repo ... 7fab42d452938ded8f4

月光下的忍者

2009-5-6 18:55:03    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\FallenLeaves\Local Settings\Temporary Internet Files
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:03    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\FallenLeaves\Cookies
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:03    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\FallenLeaves\Local Settings\History
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:03    修改文件    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: \Device\NamedPipe\lsarpc
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [文件]*

2009-5-6 18:55:03    修改文件    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: C:\WINDOWS\Debug\UserMode\userenv.log
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [文件]*

2009-5-6 18:55:03    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData
值: C:\Documents and Settings\All Users\Application Data
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:03    修改文件    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [文件]*

2009-5-6 18:55:03    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy
值: 0x00000001(1)
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:03    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
值: 0x00000000(0)
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:03    删除注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:03    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
值: <local>
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:04    删除注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:04    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable
值: 0x00000000(0)
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:04    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
值: 46 00 00 00 80 19 00 00 01 00 00 00 00 00 00 00 07 00 00 00 3c 6c 6f 63 61 6c 3e 00 00 00 00 04 00 00 00 00 00 00 00 b0 cc 4d 72 55 4d c9 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 c0 a8 0a 1a 00 00 00 00 00 00 00 00 01 03 00 00 00 00 00 00 80 03 00 00 00 00 00 00 00 02 00 00 00 00 00 00 80 02 00 00 00 00 00 00 00 02 00 00 01 00 00 00 00 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 0a 48 50 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:04    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:04    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:04    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:04    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
值: 0x00000001(1)
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:04    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:04    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:04    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:04    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
值: 0x00000001(1)
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:08    创建文件夹    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: C:\Program Files\跑跑卡丁车精简版
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [文件]*

2009-5-6 18:55:12    修改文件    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: \Device\NamedPipe\wkssvc
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [文件]*

2009-5-6 18:55:13    修改文件    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: \Device\NamedPipe\wkssvc
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [文件]*

2009-5-6 18:55:13    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C\BaseClass
值: Drive
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:13    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\BaseClass
值: Drive
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:13    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\BaseClass
值: Drive
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:13    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\BaseClass
值: Drive
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:13    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\BaseClass
值: Drive
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:13    修改注册表值    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\setup.exe
值: Windows NT Setup Executable
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe -> [注册表]*

2009-5-6 18:55:13    创建新进程    阻止
进程: f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe
目标: c:\windows\system32\setup.exe
命令行: "C:\WINDOWS\system32\setup.exe"
规则: [应用程序]f:\download\2downbank0227 ppkdc\ppkdc\ppkdc.exe

sddmao

感谢举报，已经处理。

yeow5243

真的是木马

liaoying112

现在下载区带马也时常出现，哎