贯穿于整个远景论坛长达几天之久的病毒样本

显示全部楼层 · 发表于 2009-9-2 09:40:51

没做行为分析，拦截的几个关键地方~最后个bat应该是删除自己毁尸灭迹的

2009-9-2 09:37:02 创建文件阻止
进程: j:\download\!warning\alg.exe
目标: C:\WINDOWS\system32\aa29028062t.dll
规则: [应用程序组]AF00_起式●封绝 -> [文件组]FD_系统敏感文件

2009-9-2 09:37:37 创建新进程阻止
进程: j:\download\!warning\alg.exe
目标: c:\windows\system32\rundll32.exe
命令行: C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\aa29028062t.dll testall
规则: [应用程序组]AF04_终章●天破壤碎

2009-9-2 09:37:38 创建文件阻止
进程: j:\download\!warning\alg.exe
目标: C:\WINDOWS\aa29064312.exe
规则: [应用程序组]AF00_起式●封绝 -> [文件组]FD_系统敏感文件

2009-9-2 09:37:39 创建文件阻止
进程: j:\download\!warning\alg.exe
目标: C:\WINDOWS\system32\drivers\pcidump.sys
规则: [应用程序组]AF00_起式●封绝 -> [文件组]FD_系统敏感文件

2009-9-2 09:37:45 安装驱动程序或服务阻止
进程: j:\download\!warning\alg.exe
目标: pcidump
文件路径: C:\WINDOWS\system32\drivers\pcidump.sys
规则: [应用程序组]AF04_终章●天破壤碎

2009-9-2 09:37:49 停止驱动程序或服务阻止
进程: j:\download\!warning\alg.exe
目标: PCIDump
规则: [应用程序组]AF04_终章●天破壤碎

2009-9-2 09:37:51 删除驱动程序或服务阻止
进程: j:\download\!warning\alg.exe
目标: PCIDump
规则: [应用程序组]AF04_终章●天破壤碎

2009-9-2 09:37:54 安装驱动程序或服务阻止
进程: j:\download\!warning\alg.exe
目标: pcidump
文件路径: C:\WINDOWS\system32\drivers\pcidump.sys
规则: [应用程序组]AF04_终章●天破壤碎

2009-9-2 09:37:58 停止驱动程序或服务阻止
进程: j:\download\!warning\alg.exe
目标: PCIDump
规则: [应用程序组]AF04_终章●天破壤碎

2009-9-2 09:38:00 删除驱动程序或服务阻止
进程: j:\download\!warning\alg.exe
目标: PCIDump
规则: [应用程序组]AF04_终章●天破壤碎

2009-9-2 09:38:01 创建文件阻止
进程: j:\download\!warning\alg.exe
目标: C:\WINDOWS\system32\scvhost.exe
规则: [应用程序组]AF00_起式●封绝 -> [文件组]FD_黑名单组

2009-9-2 09:38:01 创建文件阻止
进程: j:\download\!warning\alg.exe
目标: C:\WINDOWS\system32\scvhost.exe
规则: [应用程序组]AF00_起式●封绝 -> [文件组]FD_黑名单组

2009-9-2 09:38:01 创建文件阻止
进程: j:\download\!warning\alg.exe
目标: C:\WINDOWS\system32\scvhost.exe
规则: [应用程序组]AF00_起式●封绝 -> [文件组]FD_黑名单组

2009-9-2 09:38:01 创建文件阻止
进程: j:\download\!warning\alg.exe
目标: C:\Documents and Settings\Lorchid\Local Settings\Temp\_uok.bat
规则: [应用程序组]AF04_终章●天破壤碎 -> [文件组]FD_所有执行文件

显示全部楼层 · 发表于 2009-9-2 09:42:31

又见数字签证

显示全部楼层 · 发表于 2009-9-2 09:50:20

原帖由 hu3167343 于 2009-9-2 09:42 发表
又见数字签证

麻烦解释下？

显示全部楼层 · 发表于 2009-9-2 09:51:24

没发现这些东西
数字签名是什么？

显示全部楼层 · 发表于 2009-9-2 10:07:20

伪造微软的数字签名看病毒属性-数字签名

显示全部楼层 · 发表于 2009-9-2 10:07:50

嘿嘿和楼上的差不多

显示全部楼层 · 发表于 2009-9-2 10:29:44

Win32:Trojan-gen {Other}

显示全部楼层 · 发表于 2009-9-2 10:31:22

挂马的哥们想的很周到，劫持了很多安软
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360delays.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safebox.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360SoftMgrSvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antiarp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccapp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccEvtMgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSetMgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defwatch.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrUpdate.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\engineserver.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FrameworkService.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kaccore.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KavStart.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISSvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPfwSvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSWebShield.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LiveUpdate360.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcinsupd.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmscsvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcnasvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McProxy.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshell.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsysmon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McTray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdmgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfeann.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfevtps.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpfSrv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPMon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC1.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC2.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naPrdMgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctorRtp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qutmserv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegGuide.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rssafety.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsTray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscan.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScanFrm.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHSTAT.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\udaterui.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Uplive.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vptray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe

显示全部楼层 · 发表于 2009-9-2 10:32:51

554313.3322.org
有兴趣的去查查吧

显示全部楼层 · 发表于 2009-9-2 10:36:52

瑞星2010删除病毒

[病毒样本] 贯穿于整个远景论坛长达几天之久的病毒样本

回复 13楼 henmy168 的帖子

本帖子中包含更多资源

回复 1楼 henmy168 的帖子