好久没来了

蓝色牛仔裤

是我看错了。对不起啊。。。

promised

发现某人帖子改了
其实的确有那个BUG，只不过这次不是

蓝色牛仔裤

call me 牛仔裤
”某人“不好听。。

playx

运行后..

adobesvc.exe---报

spoolv.exe--未报..有可疑木马产生..上报

----------------------------------
增加键:1
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

----------------------------------
增加值:3
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\RavMon: "C:\DOCUME~1\user\LOCALS~1\Temp\RavMonD.exe"
HKLM\SYSTEM\ControlSet001\Services\kmixer\Enum\0: "SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}"
HKLM\SYSTEM\CurrentControlSet\Services\kmixer\Enum\0: "SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}"



----------------------------------
文件增加:1
----------------------------------
C:\WINDOWS\system32\RAVMY523.dll----可疑木马

----------------------------------
文件修改:6
----------------------------------
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\05262007.Log
C:\Documents and Settings\user\ntuser.dat.LOG
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log
C:\Program Files\Symantec Client Security\Symantec AntiVirus\SAVRT\0749NAV~.TMP
C:\WINDOWS\system32\config\software.LOG

solcroft

promised

原帖由 蓝色牛仔裤 于 2007-5-26 20:00 发表
call me 牛仔裤
”某人“不好听。。

现在还存在这个BUG，看PM
我想你应该会去反馈的

zxkf

卡7报了一个 另一个前摄防御拦下

detected: Trojan program Trojan-PSW.Win32.OnLineGames.oe File: D:\YB\virus\SPOOLVS.exe//FSG//RAVMY523.DLL//UPX


2007-5-26 19:56:29 C:\Program Files\Internet Explorer\IEXPLORE.EXE Attempt to run process as a child of C:\Documents and Settings\zhangxiang\Local Settings\Temp\expseny.exe (PID: 4056).
2007-5-26 19:56:29 C:\Program Files\Internet Explorer\IEXPLORE.EXE Action allowed.
2007-5-26 19:56:44 C:\WINDOWS\system32\cmd.exe Attempt to run critical application.
2007-5-26 19:56:44 C:\WINDOWS\system32\cmd.exe Action blocked.
2007-5-26 19:57:30 C:\Documents and Settings\zhangxiang\Local Settings\Temp\expseny.exe Intrusive process: C:\Documents and Settings\zhangxiang\Local Settings\Temp\expseny.exe Process ID (PID): 4056 Attempt of process intrusion: C:\Program Files\Internet Explorer\IEXPLORE.EXE Process ID (PID): 3020
2007-5-26 19:57:30 C:\Documents and Settings\zhangxiang\Local Settings\Temp\expseny.exe Attempt to terminate process
2007-5-26 19:59:12 C:\Documents and Settings\zhangxiang\Local Settings\Temp\expseny.exe Attempt to terminate process: successfully
2007-5-26 19:59:19 C:\Program Files\Internet Explorer\IEXPLORE.EXE Attempt to terminate process: successfully
2007-5-26 19:59:37 C:\Documents and Settings\zhangxiang\Local Settings\Temp\50bt.sys Rollback
2007-5-26 19:59:38 C:\DOCUME~1\ZHANGX~1\LOCALS~1\Temp\50bt.sys Rollback
2007-5-26 19:59:39 C:\DOCUME~1\ZHANGX~1\LOCALS~1\Temp\geq.dll Rollback
2007-5-26 19:57:30 C:\Documents and Settings\zhangxiang\Local Settings\Temp\expseny.exe Rollback completed

expseny.exe为adobesvc.exe生成物

bridgewr

2个微点都搞定了

欠妳緈諨

NOD32现在什么都杀不出

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.oe        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.zip/SPOOLVS.exe//FSG//RAVMY523.DLL//UPX