1x

卡巴2010在下载过程种拦截

失落的手链

瑞星2010
Trojan.Win32.Generic.11EBA619

netline

1、文件：在system32目录下生成braviax.exe并运行，在dllcache目录下生成beep.sys和figaro.sys两个文件，修改drivers目录下的beep.sys文件，创建一个新的logonui.exe进程。

2、注册表：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]

• 1208 = 0x00000000
• 2500 = 0x00000003

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]

• 1208 = 0x00000000
• 2500 = 0x00000003

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]

• 1208 = 0x00000000
• 2500 = 0x00000003

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]

• 1208 = 0x00000000
• 2500 = 0x00000003

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]

• 1208 = 0x00000000
• 2500 = 0x00000003

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

• braviax = "%System%\braviax.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

• Enable Browser Extensions = "yes"
• Search Bar = http://www.google.com/ie

[HKEY_CURRENT_USER\Software\Microsoft\Security Center]

• AntiVirusDisableNotify = 0x00000001
• FirewallDisableNotify = 0x00000001
• UpdatesDisableNotify = 0x00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

• braviax = "%System%\braviax.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]

• Default_Search_URL = "http://www.google.com/ie"
• Search Page = "http://www.google.com"
• Start Page = http://www.google.com

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]

• SearchAssistant = http://www.google.com

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]

• 1201 = 0x00000000
• 1804 = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]

• 1201 = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]

• 1201 = 0x00000000
• 1804 = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]

• 1201 = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]

• 1200 = 0x00000000
• 1201 = 0x00000000
• 1608 = 0x00000000
• 1804 = 0x00000001

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

• Start Page = "http://www.google.com"
• Search Page = "http://www.google.com"

xieyun

过G DATA