流氓木马一个

显示全部楼层 · 发表于 2010-9-10 18:32:49

小红伞杀之

显示全部楼层 · 发表于 2010-9-10 18:34:05

有提示安装，不算流氓啊。

显示全部楼层 · 发表于 2010-9-10 18:37:37

回复 3楼 hddu 的帖子

这只是表面现象

显示全部楼层 · 发表于 2010-9-10 18:43:39

2010-09-10 18:41:01 运行应用程序    操作:允许
进程路径:F:\virus\Taiqiu[1]\Taiqiu.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
触发规则:所有程序规则->其它程序设置->*\Temp\*

2010-09-10 18:41:03 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Program Files\baidu
触发规则:所有程序规则->%ProgramFiles%文件夹设置(二)->%ProgramFiles%\*

2010-09-10 18:41:03 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Program Files\baidu\bar\BDBar_tmp\BaiduBar.dll
触发规则:所有程序规则->%ProgramFiles%文件夹设置(二)->%ProgramFiles%\*.dll

2010-09-10 18:41:05 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Program Files\baidu\bar\BaiduBar.dll
触发规则:所有程序规则->%ProgramFiles%文件夹设置(二)->%ProgramFiles%\*.dll

2010-09-10 18:41:05 删除文件    操作:使用任务隔离区操作
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Program Files\baidu\bar\BDBar_tmp\BaiduBar.dll
触发规则:所有程序规则->%ProgramFiles%文件夹设置(二)->%ProgramFiles%\*

2010-09-10 18:41:05 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
注册表名称:{B580CF65-E151-49C3-B73F-70B13FCA8E86}
触发规则:所有程序规则->IE浏览器设置->*\Software\Microsoft\Internet explorer\Toolbar*

2010-09-10 18:41:09 创建注册表值    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}
注册表名称:id
触发规则:所有程序规则->资源管理器->*\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*

2010-09-10 18:41:10 删除文件    操作:使用任务隔离区操作
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Program Files\baidu\bar\BDBar_tmp\img\logo.bmp
触发规则:所有程序规则->%ProgramFiles%文件夹设置(二)->%ProgramFiles%\*

2010-09-10 18:41:10 删除文件    操作:使用任务隔离区操作
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Program Files\baidu\bar\BDBar_tmp\img\imglist.bmp
触发规则:所有程序规则->%ProgramFiles%文件夹设置(二)->%ProgramFiles%\*

2010-09-10 18:41:10 删除文件    操作:使用任务隔离区操作
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Program Files\baidu\bar\BDBar_tmp\baidubar.dat
触发规则:所有程序规则->%ProgramFiles%文件夹设置(二)->%ProgramFiles%\*

2010-09-10 18:41:13 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\百度超级搜霸
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\*菜单\*

2010-09-10 18:41:18 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\百度超级搜霸\屏蔽列表.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\*菜单\*

2010-09-10 18:41:19 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\百度超级搜霸\伴侣导航.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\*菜单\*

2010-09-10 18:41:21 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\百度超级搜霸\帮助指南.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\*菜单\*

2010-09-10 18:41:22 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\百度超级搜霸\广告拦截.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\*菜单\*

2010-09-10 18:41:24 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\百度超级搜霸\垃圾清理.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\*菜单\*

2010-09-10 18:41:26 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\百度超级搜霸\系统加速.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\*菜单\*

2010-09-10 18:41:27 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\百度超级搜霸\修复功能.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\*菜单\*

2010-09-10 18:41:28 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\百度超级搜霸\隐私保护.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\*菜单\*

2010-09-10 18:41:30 创建文件    操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\百度超级搜霸\自定义按钮.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\*菜单\*

2010-09-10 18:41:30 删除文件    操作:使用任务隔离区操作
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Program Files\baidu\bar\BDBar_tmp\baidubartmp
触发规则:所有程序规则->%ProgramFiles%文件夹设置(二)->%ProgramFiles%\*

2010-09-10 18:41:30 删除文件    操作:使用任务隔离区操作
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
文件路径:C:\Program Files\baidu\bar\baidubartmp
触发规则:所有程序规则->%ProgramFiles%文件夹设置(二)->%ProgramFiles%\*

2010-09-10 18:41:30 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search
注册表名称:CustomizeSearch_sb
触发规则:所有程序规则->IE浏览器设置->*\Software\Microsoft\Internet explorer\Search*

2010-09-10 18:41:30 修改注册表内容    操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search
注册表名称:CustomizeSearch
更改后:http://bar.baidu.com/sobar/defaultsearch.html
更改前:http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
触发规则:所有程序规则->IE浏览器设置->*\Software\Microsoft\Internet explorer\Search*

2010-09-10 18:41:30 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search
注册表名称:SearchAssistant_sb
触发规则:所有程序规则->IE浏览器设置->*\Software\Microsoft\Internet explorer\Search*

2010-09-10 18:41:30 修改注册表内容    操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\100910184101.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search
注册表名称:SearchAssistant
更改后:http://bar.baidu.com/sobar/defaultsearch.html
更改前:http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
触发规则:所有程序规则->IE浏览器设置->*\Software\Microsoft\Internet explorer\Search*

显示全部楼层 · 发表于 2010-9-10 18:51:22

NIS 2011 杀之

显示全部楼层 · 发表于 2010-9-11 07:20:30

to eset

http://samples.nod32.com.sg/inde ... c2d78c9cd69903761b9

显示全部楼层 · 发表于 2010-9-11 07:25:14

瑞星2011kill

显示全部楼层 · 发表于 2010-9-11 08:18:30

to Kaspersky lab

显示全部楼层 · 发表于 2010-9-11 10:59:16

to filseclab

[病毒样本] 流氓木马一个

浏览过的版块