今天红伞报任务管理器病毒

显示全部楼层 · 发表于 2009-5-8 09:02:31

传上来～

显示全部楼层 · 发表于 2009-5-8 09:37:21

3楼附件已传了啊。这个是番茄花园ghostxp1.2的（确定是原版番茄，验证md5正常），最后一个ghost版本的taskmgr.exe文件，确实和深度的那个taskmgr.exe不一样。

不过都一年多了，才报毒。

显示全部楼层 · 发表于 2009-5-8 09:38:22

来个在线沙盘的测试，不懂。希望高手看出点毛病来。

               ___             __ _
      +  /-          / |  ____  __  __/ /_  (_)____    -\  +
      /s  h-          / /| | / __ \/ / / / __ \/ / ___/    -h  s\
      oh-:d/       / ___ |/ / / / /_/ / /_/ / (__  )       /d:-ho
      shh+hy-       /_/  |_/_/ /_/\__,_/_.___/_/____/       -yh+hhs
   -:+hhdhyys/-                                        -\syyhdhh+:-
-//////dhhhhhddhhyss-    Analysis Report    -ssyhhddhhhhhd\\\\\\-
/++/////oydddddhhyys/    ooooooooooooooooooooo    \syyhhdddddyo\\\\\++\
-+++///////odh/-                                           -+hdo\\\\\\\+++-
+++++++++//yy+/:                                           :\+yy\\+++++++++
/+soss+sys//yyo/os++o+:                               :+o++so\oyy\\sys+ssos+\
+oyyyys++o/+yss/+/oyyyy:                            :yyyyo\+\ssy+\o++syyyyo+
+oyyyyyyso+os/o/+yyyyyy/                            \yyyyyy+\o\so+osyyyyyyo+

[#############################################################################]
Analysis Report for taskmgr.exe
               MD5: 3ad5198118a4d9db650b4dbab54d93bc
[#############################################################################]

Summary:
- Performs File Modification and Destruction:
      The executable modifiesand destructs files which are not temporary.

- Performs Registry Activities:
      The executable reads and modifies registry values. It also creates and
      monitors registry keys.

[=============================================================================]
Table of Contents
[=============================================================================]

- General information
- sample.exe
  a) Registry Activities
  b) File Activities
  c) Process Activities
  d) Other Activities

[#############################################################################]
1. General Information
[#############################################################################]
[=============================================================================]
Information about Anubis' invocation
[=============================================================================]
      Time needed:       89 s
      Report created:    05/07/09, 11:18:55 UTC
      Termination reason: All tracked processes have exited
      Program version: 1.67.0

[#############################################################################]
2. sample.exe
[#############################################################################]
[=============================================================================]
General information about this executable
[=============================================================================]
      Analysis Reason: Primary Analysis Subject
      Filename:       sample.exe
      MD5:          3ad5198118a4d9db650b4dbab54d93bc
      SHA-1:          b2993f6f7fa49fe24c817fddc552eec91292ef32
      File Size:    163840 Bytes
      Command Line: "C:\sample.exe"
      Process-status
      at analysis end: dead
      Exit Code:    1

[=============================================================================]
Load-time Dlls
[=============================================================================]
      Module Name: [ C:\WINDOWS\system32\ntdll.dll ],
            Base Address: [0x7C900000 ], Size: [0x000AF000 ]
      Module Name: [ C:\WINDOWS\system32\kernel32.dll ],
            Base Address: [0x7C800000 ], Size: [0x000F6000 ]
      Module Name: [ C:\WINDOWS\system32\ADVAPI32.dll ],
            Base Address: [0x77DD0000 ], Size: [0x0009B000 ]
      Module Name: [ C:\WINDOWS\system32\RPCRT4.dll ],
            Base Address: [0x77E70000 ], Size: [0x00092000 ]
      Module Name: [ C:\WINDOWS\system32\Secur32.dll ],
            Base Address: [0x77FE0000 ], Size: [0x00011000 ]
      Module Name: [ C:\WINDOWS\system32\GDI32.dll ],
            Base Address: [0x77F10000 ], Size: [0x00049000 ]
      Module Name: [ C:\WINDOWS\system32\USER32.dll ],
            Base Address: [0x7E410000 ], Size: [0x00091000 ]
      Module Name: [ C:\WINDOWS\system32\iphlpapi.dll ],
            Base Address: [0x76D60000 ], Size: [0x00019000 ]
      Module Name: [ C:\WINDOWS\system32\msvcrt.dll ],
            Base Address: [0x77C10000 ], Size: [0x00058000 ]
      Module Name: [ C:\WINDOWS\system32\WS2_32.dll ],
            Base Address: [0x71AB0000 ], Size: [0x00017000 ]
      Module Name: [ C:\WINDOWS\system32\WS2HELP.dll ],
            Base Address: [0x71AA0000 ], Size: [0x00008000 ]
      Module Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll ],
            Base Address: [0x773D0000 ], Size: [0x00103000 ]
      Module Name: [ C:\WINDOWS\system32\SHLWAPI.dll ],
            Base Address: [0x77F60000 ], Size: [0x00076000 ]
      Module Name: [ C:\WINDOWS\system32\SHELL32.dll ],
            Base Address: [0x7C9C0000 ], Size: [0x00817000 ]
      Module Name: [ C:\WINDOWS\system32\VDMDBG.dll ],
            Base Address: [0x5AD60000 ], Size: [0x0000A000 ]
      Module Name: [ C:\WINDOWS\system32\IMM32.DLL ],
            Base Address: [0x76390000 ], Size: [0x0001D000 ]

[=============================================================================]
Run-time Dlls
[=============================================================================]
      Module Name: [ C:\WINDOWS\system32\UxTheme.dll ],
            Base Address: [0x5AD70000 ], Size: [0x00038000 ]
      Module Name: [ C:\WINDOWS\system32\UTILDLL.dll ],
            Base Address: [0x5ADB0000 ], Size: [0x0000A000 ]
      Module Name: [ C:\WINDOWS\system32\NETAPI32.dll ],
            Base Address: [0x5B860000 ], Size: [0x00055000 ]
      Module Name: [ C:\WINDOWS\system32\MSCTF.dll ],
            Base Address: [0x74720000 ], Size: [0x0004C000 ]
      Module Name: [ C:\WINDOWS\system32\msctfime.ime ],
            Base Address: [0x755C0000 ], Size: [0x0002E000 ]
      Module Name: [ C:\WINDOWS\system32\WINSTA.dll ],
            Base Address: [0x76360000 ], Size: [0x00010000 ]
      Module Name: [ C:\WINDOWS\system32\WINMM.dll ],
            Base Address: [0x76B40000 ], Size: [0x0002D000 ]
      Module Name: [ C:\WINDOWS\system32\rtutils.dll ],
            Base Address: [0x76E80000 ], Size: [0x0000E000 ]
      Module Name: [ C:\WINDOWS\system32\TAPI32.dll ],
            Base Address: [0x76EB0000 ], Size: [0x0002F000 ]
      Module Name: [ C:\WINDOWS\system32\WTSAPI32.dll ],
            Base Address: [0x76F50000 ], Size: [0x00008000 ]
      Module Name: [ C:\WINDOWS\system32\OLEAUT32.DLL ],
            Base Address: [0x77120000 ], Size: [0x0008B000 ]
      Module Name: [ C:\WINDOWS\system32\ole32.dll ],
            Base Address: [0x774E0000 ], Size: [0x0013D000 ]
      Module Name: [ C:\WINDOWS\system32\SETUPAPI.dll ],
            Base Address: [0x77920000 ], Size: [0x000F3000 ]
      Module Name: [ C:\WINDOWS\system32\version.dll ],
            Base Address: [0x77C00000 ], Size: [0x00008000 ]

[=============================================================================]
2.a) sample.exe - Registry Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Registry Values Modified:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      Key: [ HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows NT\CurrentVersion\TaskManager ],
         Value Name: [ Preferences ], New Value: [ 0x9c020000e8030000020000000100000001000000a900000015000000c102 ]
      Key: [ HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows NT\CurrentVersion\TaskManager ],
         Value Name: [ UsrColumnSettings ], New Value: [ 0x1c0c0000340400000000000078000000010000001d0c0000350400000100 ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Registry Values Read:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      Key: [ HKLM\SOFTWARE\Microsoft\CTF\SystemShared\ ],
         Value Name: [ CUAS ], Value: [ 0 ], 1 time
      Key: [ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug ],
         Value Name: [ Debugger ], Value: [ drwtsn32 -p %ld -e %ld -g ], 1 time
      Key: [ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ],
         Value Name: [ AllowMultipleTSSessions ], Value: [ 1 ], 1 time
      Key: [ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ],
         Value Name: [ LogonType ], Value: [ 1 ], 1 time
      Key: [ HKLM\SYSTEM\CurrentControlSet\Control\Session Manager ],
         Value Name: [ CriticalSectionTimeout ], Value: [ 2592000 ], 1 time
      Key: [ HKLM\SYSTEM\Setup ],
         Value Name: [ OsLoaderPath ], Value: [ \ ], 2 times
      Key: [ HKLM\SYSTEM\Setup ],
         Value Name: [ SystemPartition ], Value: [ \Device\HarddiskVolume1 ], 2 times
      Key: [ HKLM\Software\Microsoft\CTF\SystemShared ],
         Value Name: [ CUAS ], Value: [ 0 ], 1 time
      Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\IMM ],
         Value Name: [ Ime File ], Value: [ msctfime.ime ], 1 time
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion ],
         Value Name: [ DevicePath ], Value: [ %SystemRoot%\inf ], 1 time
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Setup ],
         Value Name: [ DriverCachePath ], Value: [ %SystemRoot%\Driver Cache ], 2 times
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Setup ],
         Value Name: [ LogLevel ], Value: [ 0 ], 2 times
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Setup ],
         Value Name: [ ServicePackCachePath ], Value: [ c:\windows\ServicePackFiles\ServicePackCache ], 2 times
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Setup ],
         Value Name: [ ServicePackSourcePath ], Value: [ c:\windows\ServicePackFiles ], 2 times
      Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Setup ],
         Value Name: [ SourcePath ], Value: [ D:\ ], 2 times
      Key: [ HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName ],
         Value Name: [ ComputerName ], Value: [ USER ], 2 times
      Key: [ HKLM\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm ],
         Value Name: [ wheel ], Value: [ 1 ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters ],
         Value Name: [ Domain ], Value: [  ], 1 time
      Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters ],
         Value Name: [ Hostname ], Value: [ user ], 1 time
      Key: [ HKLM\System\Setup ],
         Value Name: [ SystemSetupInProgress ], Value: [ 0 ], 1 time
      Key: [ HKLM\System\WPA\PnP ],
         Value Name: [ seed ], Value: [ 1374283966 ], 1 time
      Key: [ HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows NT\CurrentVersion\TaskManager ],
         Value Name: [ Preferences ], Value: [ 0x9c020000e8030000020000000100000001000000a9000000150000003d02 ], 1 time
      Key: [ HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows NT\CurrentVersion\TaskManager ],
         Value Name: [ UsrColumnSettings ], Value: [ 0x1c0c0000340400000000000078000000010000001d0c0000350400000100 ], 1 time
      Key: [ HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ],
         Value Name: [ ListviewAlphaSelect ], Value: [ 0 ], 4 times
      Key: [ HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ],
         Value Name: [ ListviewShadow ], Value: [ 0 ], 4 times
      Key: [ HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ],
         Value Name: [ ListviewWatermark ], Value: [ 0 ], 4 times

[=============================================================================]
2.b) sample.exe - File Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Read:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File Name: [ PIPE\lsarpc ]
      File Name: [ PIPE\wkssvc ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Modified:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File Name: [ PIPE\lsarpc ]
      File Name: [ PIPE\wkssvc ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File System Control Communication:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File: [ PIPE\lsarpc ], Control Code: [ 0x0011C017 ], 12 times
      File: [ PIPE\wkssvc ], Control Code: [ 0x0011C017 ], 1 time

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Device Control Communication:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File: [ \Device\KsecDD ], Control Code: [ 0x00390008 ], 8 times

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Memory Mapped Files:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      File Name: [ C:\WINDOWS\system32\MSCTF.dll ]
      File Name: [ C:\WINDOWS\system32\Msimtf.dll ]
      File Name: [ C:\WINDOWS\system32\SETUPAPI.dll ]
      File Name: [ C:\WINDOWS\system32\TAPI32.dll ]
      File Name: [ C:\WINDOWS\system32\UTILDLL.dll ]
      File Name: [ C:\WINDOWS\system32\UxTheme.dll ]
      File Name: [ C:\WINDOWS\system32\WINMM.dll ]
      File Name: [ C:\WINDOWS\system32\WINSTA.dll ]
      File Name: [ C:\WINDOWS\system32\WTSAPI32.dll ]
      File Name: [ C:\WINDOWS\system32\msctfime.ime ]
      File Name: [ C:\WINDOWS\system32\ole32.dll ]
      File Name: [ C:\WINDOWS\system32\rtutils.dll ]

[=============================================================================]
2.c) sample.exe - Process Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Thread Overview:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      After 34 seconds, Number of threads: 1
      After 83 seconds, Number of threads: 0

[=============================================================================]
2.d) sample.exe - Other Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Mutexes Created:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      Mutex: [ CTF.Asm.MutexDefaultS-1-5-21-1229272821-1004336348-527237240-1003 ]
      Mutex: [ CTF.Compart.MutexDefaultS-1-5-21-1229272821-1004336348-527237240-1003 ]
      Mutex: [ CTF.LBES.MutexDefaultS-1-5-21-1229272821-1004336348-527237240-1003 ]
      Mutex: [ CTF.Layouts.MutexDefaultS-1-5-21-1229272821-1004336348-527237240-1003 ]
      Mutex: [ CTF.TMD.MutexDefaultS-1-5-21-1229272821-1004336348-527237240-1003 ]
      Mutex: [ CTF.TimListCache.FMPDefaultS-1-5-21-1229272821-1004336348-527237240-1003MUTEX.DefaultS-1-5-21-1229272821-1004336348-527237240-1003 ]
      Mutex: [ MSCTF.Shared.MUTEX.AGC ]
      Mutex: [ NTShell Taskman Startup Mutex ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Keyboard Keys Monitored:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
      Virtual Key Code: [ VK_SHIFT (16) ], 1 time
      Virtual Key Code: [ VK_ESCAPE (27) ], 263 times
      Virtual Key Code: [ VK_CONTROL (17) ], 12 times

[#############################################################################]
                     International Secure Systems Lab
                        http://www.iseclab.org

Vienna University of Technology    Eurecom France          UC Santa Barbara
http://www.tuwien.ac.at       http://www.eurecom.fr  http://www.cs.ucsb.edu

                        Contact: anubis@iseclab.org

显示全部楼层 · 发表于 2009-5-8 17:56:36

MD5:3AD5198118A4D9DB650B4DBAB54D93BC
每次打开都报，请高手看看。让我放心

显示全部楼层 · 发表于 2009-5-8 20:06:42

没有数字签名
帮你们问问吧

[ 本帖最后由 mofunzone 于 2009-5-8 04:08 编辑 ]

显示全部楼层 · 发表于 2009-5-9 07:34:16

We could not find a virus in the attachment you have sent us.
This is a false positive. We will take out the pattern recognition in one of our next updates.

We thank you for your assistance.

Attachment(s) you sent:
taskmgr.rar
--
Freundliche Gruesse / Best regards
Avira GmbH

Rene Ethner
First Level Support

显示全部楼层 · 发表于 2009-5-9 09:04:32

谢谢，更新以后不报毒了。偶也点了上报病毒，而且send成功，怎么不理我也。

显示全部楼层 · 发表于 2009-5-9 09:23:42

原帖由 zhouyyff 于 2009-5-9 09:04 发表
谢谢，更新以后不报毒了。偶也点了上报病毒，而且send成功，怎么不理我也。

因为你是隔离区上报
要网页上报才会有回复哦

显示全部楼层 · 发表于 2009-5-9 21:23:48

显然是误报，原来就报过，这是增强版的任务管理器~

[求助] 今天红伞报任务管理器病毒

本帖子中包含更多资源