上传一个疑似木马样本，麻烦大家帮忙判断一下这个是什么木马？

drmctchr

上传一个疑似木马样本，麻烦大家帮忙判断一下这个是什么木马？

lingbo110120

ROOTKIT

drmctchr

呃，说实话我对木马行为不是很了解。
这个木马会造成怎样的危害？

xyao

2009-7-23 22:53:01    删除注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
规则: [应用程序]c:\program files\rising\ris\copyrun\ravcopy.exe -> [文件]c:\documents and settings\administrator\local settings\temp\ris\download; mailmon.dll

2009-7-23 22:53:07    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: C:\WINDOWS\Temp\fat34.sys
规则: [文件组]系统执行文件 -> [文件]c:\windows\*; *.sys

2009-7-23 22:53:09    加载驱动程序    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: c:\windows\temp\fat34.sys
规则: [应用程序]*

2009-7-23 22:53:12    安装驱动程序或服务    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: fat32 driver
文件路径: C:\WINDOWS\System\fat34.sys
规则: [应用程序]*

2009-7-23 22:53:17    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: C:\WINDOWS\System\fat34.dll
规则: [文件组]系统执行文件 -> [文件]c:\windows\*; *.dll

2009-7-23 22:53:19    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: C:\WINDOWS\System\fat34.dll
规则: [文件组]系统执行文件 -> [文件]c:\windows\*; *.dll

2009-7-23 22:53:20    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: C:\WINDOWS\System\fat34.dll
规则: [文件组]系统执行文件 -> [文件]c:\windows\*; *.dll

2009-7-23 22:53:22    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\WINDOWS\Temp\00004d37.tmp !\??\C:\WINDOWS\System\fat34.dll
规则: [应用程序]c:\program files\rising\ris\copyrun\ravcopy.exe -> [文件]c:\documents and settings\administrator\local settings\temp\ris\download; mailmon.dll

2009-7-23 22:53:23    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\WINDOWS\System\fat34.dll
规则: [应用程序]c:\program files\rising\ris\copyrun\ravcopy.exe -> [文件]c:\documents and settings\administrator\local settings\temp\ris\download; mailmon.dll

2009-7-23 22:53:24    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\WINDOWS\Temp\00004d37.tmp \??\C:\WINDOWS\System\fat34.dll
规则: [应用程序]c:\program files\rising\ris\copyrun\ravcopy.exe -> [文件]c:\documents and settings\administrator\local settings\temp\ris\download; mailmon.dll

2009-7-23 22:53:28    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: C:\WINDOWS\System\windnsapi.ime
规则: [文件组]系统执行文件 -> [文件]c:\windows\*; *.ime

2009-7-23 22:53:30    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: C:\WINDOWS\System\windnsapi.ime
规则: [文件组]系统执行文件 -> [文件]c:\windows\*; *.ime

2009-7-23 22:53:31    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: C:\WINDOWS\System\windnsapi.ime
规则: [文件组]系统执行文件 -> [文件]c:\windows\*; *.ime

2009-7-23 22:53:33    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\WINDOWS\Temp\00004d57.tmp !\??\C:\WINDOWS\System\windnsapi.ime
规则: [应用程序]c:\program files\rising\ris\copyrun\ravcopy.exe -> [文件]c:\documents and settings\administrator\local settings\temp\ris\download; mailmon.dll

2009-7-23 22:53:34    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\WINDOWS\System\windnsapi.ime
规则: [应用程序]c:\program files\rising\ris\copyrun\ravcopy.exe -> [文件]c:\documents and settings\administrator\local settings\temp\ris\download; mailmon.dll

2009-7-23 22:53:35    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\rar$ex00.296\setup.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\WINDOWS\Temp\00004d57.tmp \??\C:\WINDOWS\System\windnsapi.ime
规则: [应用程序]c:\program files\rising\ris\copyrun\ravcopy.exe -> [文件]c:\documents and settings\administrator\local settings\temp\ris\download; mailmon.dll

尤金卡巴斯基

To KL

hddu

2009-07-23 22:55:08    创建文件      操作:阻止并结束进程
进程路径:E:\setup\setup.exe
文件路径:C:\WINDOWS\Temp\fat34.sys
触发规则:所有程序规则->WINDOWS文件夹设置->%SystemDrive%\*.sys

nvhaichina

红伞报了

z2665

mcafee miss,to
行为看4楼

主动防御

RIS2010

Trojan.Win32.Generic.11EAECAE
云安全自动分析系统分析的病毒

haol

drweb found BACKDOOR.Trojan


[ 本帖最后由 haol 于 2009-7-23 23:16 编辑 ]