baidu.vbs

Sherry.ai

http://www.virustotal.com/file-scan/report.html?id=8fd00adafcd373f7a6d424739bec9e55bf710e909eade1beda3ff87daf15df50-1294396266

hddu

费尔，金山卫士报安全。

恋亿晓

to kaspersky lab

dalianjhc1986

ess kill
2011-1-7 18:53:29        文件系统实时防护        文件        C:\Documents and Settings\Administrator\桌面\样本\baidu\baidu.vbs        VBS/TrojanDownloader.Agent.NEU 特洛伊木马        通过删除清除 - 已隔离        PC-20110106OORQ\Administrator        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.

星晨

2011-01-07 18:51:41	C:\Users\k\Desktop\baidu.vbs	发送消息	C:\Windows\explorer.exe
2011-01-07 18:51:46	C:\Users\k\Desktop\baidu.vbs	创建进程	C:\Program Files\Internet Explorer\iexplore.exe
2011-01-07 18:51:49	C:\Users\k\Desktop\baidu.vbs	修改文件	C:\Users\k\Desktop\baidu.vbs
2011-01-07 18:51:50	C:\Users\k\Desktop\baidu.vbs	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2011-01-07 18:51:51	C:\Users\k\Desktop\baidu.vbs	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
2011-01-07 18:51:52	C:\Users\k\Desktop\baidu.vbs	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
2011-01-07 18:51:53	C:\Users\k\Desktop\baidu.vbs	DNS/RPC 客户端访问	\RPC Control\DNSResolver
2011-01-07 18:51:59	C:\Users\k\Desktop\baidu.vbs	创建进程	C:\Windows\System32\cmd.exe
2011-01-07 18:52:03	C:\Users\k\Desktop\baidu.vbs	创建进程	C:\Windows\regedit.exe
2011-01-07 18:52:06	C:\Users\k\AppData\Local\Temp\xf.vbs	发送消息	C:\Program Files\Internet Explorer\iexplore.exe
2011-01-07 18:52:08	C:\Users\k\AppData\Local\Temp\page.vbs	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2011-01-07 18:52:11	C:\Windows\System32\cmd.exe	创建进程	C:\Users\k\AppData\Local\Temp\aa.exe
2011-01-07 18:52:12	C:\Users\k\AppData\Local\Temp\page.vbs	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
2011-01-07 18:52:13	C:\Users\k\AppData\Local\Temp\aa.exe	访问COM接口	Shell.Explorer.2
2011-01-07 18:52:14	C:\Users\k\AppData\Local\Temp\page.vbs	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
2011-01-07 18:52:15	C:\Users\k\AppData\Local\Temp\aa.exe	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2011-01-07 18:52:16	C:\Users\k\AppData\Local\Temp\aa.exe	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
2011-01-07 18:52:17	C:\Users\k\AppData\Local\Temp\aa.exe	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
2011-01-07 18:52:18	C:\Users\k\AppData\Local\Temp\aa.exe	DNS/RPC 客户端访问	\RPC Control\DNSResolver
2011-01-07 18:52:19	C:\Users\k\AppData\Local\Temp\page.vbs	DNS/RPC 客户端访问	\RPC Control\DNSResolver
2011-01-07 18:52:24	C:\Users\k\AppData\Local\Temp\page.vbs	创建进程	C:\Windows\System32\cmd.exe
2011-01-07 18:52:28	C:\Users\k\AppData\Local\Temp\page.vbs	发送消息	C:\Program Files\Internet Explorer\iexplore.exe
2011-01-07 18:52:31	C:\Windows\System32\cmd.exe	创建进程	C:\Users\k\AppData\Local\Temp\aiqi4397.exe
2011-01-07 18:52:32	C:\Users\k\AppData\Local\Temp\de.vbs	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Internet Explorer\Main\Start Page
2011-01-07 18:52:33	C:\Users\k\AppData\Local\Temp\aiqi4397.exe	安装钩子	C:\Windows\system32\MSVBVM60.DLL
2011-01-07 18:52:34	C:\Users\k\AppData\Local\Temp\de.vbs	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Internet Explorer\Main\Start Page
2011-01-07 18:52:35	C:\Users\k\AppData\Local\Temp\de.vbs	修改注册表项	HKLM\SOFTWARE\Classes\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance\InitPropertyBag
2011-01-07 18:52:36	C:\Windows\System32\cmd.exe	创建进程	C:\Users\k\AppData\Local\Temp\cpa.exe
2011-01-07 18:52:37	C:\Users\k\AppData\Local\Temp\aiqi4397.exe	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2011-01-07 18:52:38	C:\Users\k\AppData\Local\Temp\de.vbs	修改注册表项	HKLM\SOFTWARE\Classes\CLSID
2011-01-07 18:52:39	C:\Users\k\AppData\Local\Temp\aiqi4397.exe	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
2011-01-07 18:52:40	C:\Users\k\AppData\Local\Temp\de.vbs	修改注册表项	HKLM\SOFTWARE\Classes\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}
2011-01-07 18:52:41	C:\Users\k\AppData\Local\Temp\aiqi4397.exe	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
2011-01-07 18:52:42	C:\Users\k\AppData\Local\Temp\de.vbs	修改注册表项	HKLM\SOFTWARE\Classes\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance
2011-01-07 18:52:43	C:\Users\k\AppData\Local\Temp\aiqi4397.exe	DNS/RPC 客户端访问	\RPC Control\DNSResolver
2011-01-07 18:52:44	C:\Users\k\AppData\Local\Temp\de.vbs	修改注册表项	HKLM\SOFTWARE\Classes\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance\InitPropertyBag\method
2011-01-07 18:52:45	C:\Users\k\AppData\Local\Temp\de.vbs	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Policies\Microsoft\MMC
2011-01-07 18:52:48	C:\Users\k\AppData\Local\Temp\de.vbs	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Policies\Microsoft\MMC\RestrictToPermittedSnapins
2011-01-07 18:52:50	C:\Users\k\AppData\Local\Temp\de.vbs	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
2011-01-07 18:52:51	C:\Users\k\AppData\Local\Temp\de.vbs	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktopCleanupWizard
2011-01-07 18:52:52	C:\Users\k\AppData\Local\Temp\aa.exe	访问内存	C:\Windows\explorer.exe
2011-01-07 18:52:59	C:\Windows\System32\cmd.exe	创建进程	C:\Users\k\AppData\Local\Temp\1018new.exe
2011-01-07 18:53:10	C:\Users\k\AppData\Local\Temp\1018new.exe	创建进程	C:\Program Files\TTPlayer\TPlayer.exe
2011-01-07 18:53:14	C:\Users\k\AppData\Local\Temp\xing.vbs	修改文件	C:\Windows\jeo.vbe
2011-01-07 18:53:16	C:\Users\k\Desktop\baidu.vbs	创建进程	C:\Windows\explorer.exe
2011-01-07 18:53:17	C:\Program Files\TTPlayer\TPlayer.exe	修改文件	C:\Windows\system32\Factory.dll
2011-01-07 18:53:18	C:\Users\k\AppData\Local\Temp\xing.vbs	访问COM接口	WINMGMTS.1
2011-01-07 18:53:21	C:\Program Files\TTPlayer\TPlayer.exe	创建进程	C:\Windows\System32\wscript.exe
2011-01-07 18:53:24	C:\Users\k\AppData\Local\Temp\xing.vbs	访问COM接口	{8BC3F05E-D86B-11D0-A075-00C04FB68820}
2011-01-07 18:53:26	C:\Program Files\TTPlayer\TPlayer.exe	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2011-01-07 18:53:28	C:\Users\k\AppData\Local\Temp\xing.vbs	访问COM接口	C:\Windows\System32\svchost.exe
2011-01-07 18:53:29	C:\Program Files\TTPlayer\TPlayer.exe	访问COM接口	Shell.Explorer.2
2011-01-07 18:53:31	C:\Program Files\TTPlayer\TPlayer.exe	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
2011-01-07 18:53:33	C:\Users\k\AppData\Local\Temp\C4PU8.vbs	访问COM接口	{8BC3F05E-D86B-11D0-A075-00C04FB68820}
2011-01-07 18:53:35	C:\Users\k\AppData\Local\Temp\xing.vbs	创建进程	C:\Windows\System32\attrib.exe
2011-01-07 18:53:36	C:\Program Files\TTPlayer\TPlayer.exe	修改注册表项	HKUS\S-1-5-21-3799767426-424094828-1398871737-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
2011-01-07 18:53:38	C:\Users\k\AppData\Local\Temp\C4PU8.vbs	访问COM接口	C:\Windows\System32\svchost.exe
2011-01-07 18:53:39	C:\Users\k\AppData\Local\Temp\xing.vbs	创建进程	C:\Windows\System32\cacls.exe
2011-01-07 18:53:40	C:\Program Files\TTPlayer\TPlayer.exe	DNS/RPC 客户端访问	\RPC Control\DNSResolver

hddu

超多动作，厉害。

星晨

BitDefender上報

2011-01-07 18:56:32	C:\Users\k\AppData\Local\Temp\aiqi4397.exe	创建进程	C:\Users\k\AppData\Local\Temp\GuaGua2010Beta2SetupGW_tg.exe
2011-01-07 18:56:41	C:\Users\k\AppData\Local\Temp\aiqi4397.exe	创建进程	C:\Users\k\AppData\Local\Temp\GuaGua2010Beta2SetupGW_tg.exe
2011-01-07 18:57:12	C:\Users\k\Desktop\baidu.vbs	创建进程	C:\Users\k\AppData\Local\Temp\9158chat_395784.exe
2011-01-07 18:57:27	C:\Users\k\AppData\Local\Temp\is-PJNPK.tmp\is-ABUFR.tmp	在线扫描发现安全程序
2011-01-07 18:57:27	C:\Users\k\AppData\Local\Temp\is-PJNPK.tmp\is-ABUFR.tmp	在线扫描发现安全程序
2011-01-07 18:58:36	C:\Program Files\Tencent\QQ\Bin\TXOC.exe	创建进程, 拦截病毒	C:\Program Files\GOSURF2\gsfbwsr.exe
2011-01-07 18:58:45	C:\Program Files\Tencent\QQ\Bin\TXOC.exe	创建进程, 拦截病毒	C:\Program Files\TTPlayer\TPlayer.exe

submit to avertlabs

zuo

2011-1-7 19:35:58    修改注册表值    阻止
进程: c:\program files\internet explorer\iexplore.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Locked
值: 0x00000001(1)
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Internet explorer\Toolbar

2011-1-7 19:35:59    修改注册表值    阻止
进程: c:\windows\system32\wscript.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Progra~1\Intern~1\IEXPLORE.EXE
值: Internet Explorer
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2011-1-7 19:35:59    创建新进程    阻止
进程: c:\windows\system32\wscript.exe
目标: c:\program files\internet explorer\iexplore.exe
命令行: "C:\Progra~1\Intern~1\IEXPLORE.EXE" http://www.xsp5.info/index/index.htm
规则: [应用程序组]所有程序规则-系统程序执行规则 -> [应用程序]* -> [子应用程序]c:\program files\internet explorer\iexplore.exe

留侯

大蜘蛛MISS，已上报！