样本 2x

显示全部楼层 · 发表于 2010-11-9 16:24:36

本帖最后由幸福的猪猪于 2010-11-10 07:49 编辑

这两个样本，已经分别上报卡巴斯基。

[KLAN-92990341]

您好，
此邮件由邮件自动处理系统生成。

商品细节图.scr - Trojan.VBS.KillProc.e
以上文件包含恶意代码，下次更新后即可查杀。感谢您的上报。

卡巴斯基中国病毒实验室

[KLAN-92998206]
时间：2010年11月9日(星期二) 晚上8:29

您好，
此邮件由邮件自动处理系统生成。

360aa.exe - Trojan-Banker.Win32.Banker2.aey
以上文件包含恶意代码，下次更新后即可查杀。感谢您的上报。

卡巴斯基中国病毒实验室

显示全部楼层 · 发表于 2010-11-9 16:28:02

显示全部楼层 · 发表于 2010-11-9 16:30:13

to eset

http://samples.nod32.com.sg/inde ... 54ba1d7a5840736cb1f

显示全部楼层 · 发表于 2010-11-9 16:35:01

2010-11-9 16:33:43 创建文件阻止
进程: c:\documents and settings\administrator\桌面\test\aa.exe
目标: C:\Documents and Settings\Administrator\桌面\test\ok.cmd
规则: [文件组]文件保护 -> [文件]c:\documents and settings\*\桌面\*

2010-11-9 16:33:43 读文件阻止
进程: c:\documents and settings\administrator\桌面\test\aa.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 16:33:43 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\aa.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

显示全部楼层 · 发表于 2010-11-9 16:35:19

2010-11-9 16:33:46 读文件阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 16:33:46 创建文件阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: C:\CFLog\__tmp_rar_sfx_access_check_294671
规则: [文件]*

2010-11-9 16:33:46 读文件阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: \Device\NamedPipe\wkssvc
规则: [文件]*

2010-11-9 16:33:46 读文件阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal
值: C:\Documents and Settings\Administrator\My Documents
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 16:33:46 读文件阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 16:33:46 读文件阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee1312a2-42ee-11df-9422-806d6172696f}\BaseClass
值: Drive
规则: [注册表]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee1312a3-42ee-11df-9422-806d6172696f}\BaseClass
值: Drive
规则: [注册表]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee1312a5-42ee-11df-9422-806d6172696f}\BaseClass
值: Drive
规则: [注册表]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee1312a4-42ee-11df-9422-806d6172696f}\BaseClass
值: Drive
规则: [注册表]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee1312a6-42ee-11df-9422-806d6172696f}\BaseClass
值: Drive
规则: [注册表]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Documents
值: C:\Documents and Settings\All Users\Documents
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop
值: C:\Documents and Settings\Administrator\桌面
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 16:33:46 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 16:33:46 读文件阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 16:33:46 读文件阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 16:33:46 修改文件阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: C:\WINDOWS\Debug\UserMode\userenv.log
规则: [文件]*

2010-11-9 16:33:46 修改文件阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: C:\WINDOWS\Debug\UserMode\userenv.log
规则: [文件]*

2010-11-9 16:33:47 创建新进程阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: c:\documents and settings\administrator\桌面\test\商品细节图.exe
命令行: "C:\Documents and Settings\Administrator\桌面\test\商品细节图.exe" -el -s2 "-dC:\CFLog" "-p" "-sp"
规则: [应用程序]*

2010-11-9 16:33:48 修改文件阻止
进程: c:\documents and settings\administrator\桌面\test\商品细节图.exe
目标: C:\Documents and Settings\Administrator\Application Data\Tencent\QQWubi\local.stat
规则: [文件]*

2010-11-9 16:33:51 修改文件阻止
进程: c:\documents and settings\administrator\桌面\test\aa.exe
目标: C:\Documents and Settings\Administrator\Application Data\Tencent\QQWubi\local.stat
规则: [文件]*

显示全部楼层 · 发表于 2010-11-9 16:42:10

过360 过卡巴

显示全部楼层 · 发表于 2010-11-9 17:00:25

大蜘蛛clean，已上报。

显示全部楼层 · 发表于 2010-11-9 18:46:17

过了瑞星RIS

显示全部楼层 · 发表于 2010-11-9 19:16:35

miss,to xandora(panda)

显示全部楼层 · 发表于 2010-11-9 20:45:54

本帖最后由纸团于 2010-11-9 20:48 编辑

悲剧。
手贱双击了。
KIS被过~

大家谁找到个能杀的说下。

[可疑文件] 样本 2x

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块