KEYGEN

显示全部楼层 · 发表于 2010-12-19 16:46:03

微点10只

显示全部楼层 · 发表于 2010-12-19 17:11:21

病毒: Trojan.Generic.KD.89752 (10x) (Engine-A)

下载网页内容时发现病毒。

地址: bbs.kafan.cn
状态：访问被拒绝。

显示全部楼层 · 发表于 2010-12-19 17:21:29

微点kill

显示全部楼层 · 发表于 2010-12-19 17:24:28

显示全部楼层 · 发表于 2010-12-19 17:41:53

2010-12-19 17:29:51 G:\SANDBOX\576992335\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMP\RAR$EX02.500\GAMEUPDATE1.EXE Win32.Troj.Generic 处理成功（操作：删除）

显示全部楼层 · 发表于 2010-12-19 17:57:55

avira总是查不出病毒，为什么啊？难道不能在虚拟机里运行？

显示全部楼层 · 发表于 2010-12-19 18:02:53

回复 16楼 AAA啊的帖子

注意看前边的回帖，红伞对样本无视了，已经上报，等反馈。

显示全部楼层 · 发表于 2010-12-19 18:34:37

KIS 拦截

显示全部楼层 · 发表于 2010-12-19 19:25:01

BitDefender2011清空

显示全部楼层 · 发表于 2010-12-19 19:34:50

2010-12-19 19:32:16 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (1).exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-19 19:32:16 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (1).exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-19 19:32:17 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (1).exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-19 19:32:17 访问网络阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (1).exe
目标: TCP [本机 : 1397] ->  [69.10.39.21 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-19 19:32:17 访问网络阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (1).exe
目标: TCP [本机 : 1398] ->  [91.217.153.51 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-19 19:32:17 访问网络阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (1).exe
目标: TCP [本机 : 1399] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-19 19:32:18 创建文件阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (1).exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Ukb..bat
规则: [文件组]文件安全读写规则(询问创建) -> [文件]*temp\*; *.bat

2010-12-19 19:32:38 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (2).exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-19 19:32:39 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (2).exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-19 19:32:40 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (2).exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-19 19:32:40 访问网络阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (2).exe
目标: TCP [本机 : 1400] ->  [69.10.39.21 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-19 19:32:40 访问网络阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (2).exe
目标: TCP [本机 : 1401] ->  [91.217.153.51 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-19 19:32:40 访问网络阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (2).exe
目标: TCP [本机 : 1402] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-19 19:32:40 创建文件阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (2).exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Ukb..bat
规则: [文件组]文件安全读写规则(询问创建) -> [文件]*temp\*; *.bat

2010-12-19 19:33:00 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (3).exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-19 19:33:00 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (3).exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-19 19:33:01 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (3).exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-19 19:33:01 访问网络阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (3).exe
目标: TCP [本机 : 1403] ->  [69.10.39.21 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-19 19:33:01 访问网络阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (3).exe
目标: TCP [本机 : 1404] ->  [91.217.153.51 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-19 19:33:01 访问网络阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (3).exe
目标: TCP [本机 : 1405] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-19 19:33:02 创建文件阻止
进程: c:\documents and settings\administrator\桌面\keygen\keygen (3).exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Ukb..bat
规则: [文件组]文件安全读写规则(询问创建) -> [文件]*temp\*; *.bat

样本太多，且大多一样，就只分析前三个了

[可疑文件] KEYGEN

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块