call.exe

Sherry.ai

call.exe

jayavira

ess kill

  Win32/Adware.WSearch.AJ 应用程序 的变种

submit to mcafee

jason_jiang

启发，to xandora(panda)

XE-cj

2010-8-15 10:19:50    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\xe-cj\my documents\call.exe
命令行: "C:\Documents and Settings\XE-CJ\My Documents\call.exe"
规则: [应用程序]c:\windows\explorer.exe

2010-8-15 10:19:52    创建文件夹    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8
规则: [文件]*

2010-8-15 10:19:56    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\z.lz
规则: [文件]*

2010-8-15 10:19:57    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\_uninstall
规则: [文件]*

2010-8-15 10:19:58    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\b.dll.zgx.tmp
规则: [文件]*

2010-8-15 10:19:59    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\b.dll.zgx
规则: [文件]*

2010-8-15 10:20:01    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\b.dll
规则: [文件组]所有执行文件 -> [文件]*; *.dll

2010-8-15 10:20:02    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\msn.exe.tmp
规则: [文件]*

2010-8-15 10:20:04    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\msn.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-8-15 10:20:05    修改文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\msn.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-8-15 10:20:06    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\p.dll.zgx.tmp
规则: [文件]*

2010-8-15 10:20:07    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\p.dll.zgx
规则: [文件]*

2010-8-15 10:20:08    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\p.dll
规则: [文件组]所有执行文件 -> [文件]*; *.dll

2010-8-15 10:20:10    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\s.exe.tmp
规则: [文件]*

2010-8-15 10:20:11    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\s.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-8-15 10:20:13    修改文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\s.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-8-15 10:20:16    修改注册表值    阻止
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\Documents and Settings\XE-CJ\My Documents\antivirusGT.exe  \??\C:\Documents and Settings\XE-CJ\My Documents\antivirusGT.exe  \??\C:\WINDOWS\system32\e7rd.exe
规则: [注册表组]自动运行程序所在位置 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager; PendingFileRenameOperations

2010-8-15 10:20:17    创建新进程    阻止
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: c:\windows\system32\regsvr32.exe
命令行: C:\WINDOWS\system32\regsvr32.exe /u /s "C:\WINDOWS\system32\9el9.dll"
规则: [应用程序]*

2010-8-15 10:20:21    创建新进程    阻止
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: c:\windows\system32\regsvr32.exe
命令行: C:\WINDOWS\system32\regsvr32.exe /u /s "C:\WINDOWS\system32\dbc7.dll"
规则: [应用程序]*

2010-8-15 10:20:26    创建新进程    阻止
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: c:\windows\system32\regsvr32.exe
命令行: C:\WINDOWS\system32\regsvr32.exe /u /s "C:\WINDOWS\system32\977o.dll"
规则: [应用程序]*

2010-8-15 10:20:28    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\2.dll
规则: [文件组]所有执行文件 -> [文件]*; *.dll

2010-8-15 10:20:30    修改文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\p.dll
规则: [文件组]所有执行文件 -> [文件]*; *.dll

2010-8-15 10:20:31    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\WINDOWS\system32\9bee.dll
规则: [文件组]特殊目录 -> [文件]c:\windows\system32

2010-8-15 10:20:38    创建文件    阻止
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\WINDOWS\Tasks\ms.job
规则: [文件组]系统执行文件 -> [文件]c:\windows\tasks; *.job

2010-8-15 10:20:42    修改文件    阻止并结束进程
进程: c:\documents and settings\xe-cj\my documents\call.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\h8nil4o8\2.dll
规则: [文件组]所有执行文件 -> [文件]*; *.dll

hj5abc

FS
Generic.Rugo.70F25A45

jayavira

回复 5楼 XE-cj  的帖子

生成物
ess kill

http://bbs.kafan.cn/forum.php?mo ... DE4Mzk1NDB8NDAxODAz        多个威胁        连接中断 - 已隔离        通过应用程序访问 web 时检测到威胁: D:\Program Files\Opera\Opera.exe.
http://bbs.kafan.cn/forum.php?mo ... DE4Mzk1NDB8NDAxODAz > RAR > msn.exe        可能是 Win32/TrojanDropper.Agent.ONI 特洛伊木马 的变种               
http://bbs.kafan.cn/forum.php?mo ... DE4Mzk1NDB8NDAxODAz > RAR > s.exe        Win32/Adware.WSearch.AE 应用程序 的变种               
   

fatezero

TO KL

恋亿晓

金山升级精灵

to sunbelt