一个

显示全部楼层 · 发表于 2007-5-27 14:36:50

卡吧下载报毒
2007-5-27 14:34:05 URL: http://bbs.kafan.cn/attachment.php?aid=76685/SVCHOST.EXE 已检测病毒 Virus.Win32.AutoRun.x

显示全部楼层 · 发表于 2007-5-27 14:58:39

卡6
已删除: 病毒 Virus.Win32.AutoRun.x 文件: F:\00.rar\SVCHOST.EXE

显示全部楼层 · 发表于 2007-5-27 18:50:50

Processes:
PID ParentPID User Path
--------------------------------------------------
820 444 MSEOSJD88JED:Administrator C:\Documents and Settings\Administrator\桌面\00\SVCHOST.EXE

Ports:
Port PID Type Path
--------------------------------------------------

Explorer Dlls:
DLL Path Company Name File Description
--------------------------------------------------
No changes Found

IE Dlls:
DLL Path Company Name File Description
--------------------------------------------------
No changes Found

Loaded Drivers:
Driver File Company Name Description
--------------------------------------------------

Monitored RegKeys
Registry Key Value
--------------------------------------------------

Kernel31 Api Log

--------------------------------------------------
***** Installing Hooks *****
71a270df    RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\WinSock2\Parameters)
71a27cc4    RegOpenKeyExA (Protocol_Catalog9)
71a2737e    RegOpenKeyExA (000000F3)
71a2724d    RegOpenKeyExA (Catalog_Entries)
71a278ea    RegOpenKeyExA (000000000001)
71a278ea    RegOpenKeyExA (000000000002)
71a278ea    RegOpenKeyExA (000000000003)
71a278ea    RegOpenKeyExA (000000000004)
71a278ea    RegOpenKeyExA (000000000005)
71a278ea    RegOpenKeyExA (000000000006)
71a278ea    RegOpenKeyExA (000000000007)
71a278ea    RegOpenKeyExA (000000000008)
71a278ea    RegOpenKeyExA (000000000009)
71a278ea    RegOpenKeyExA (000000000010)
71a278ea    RegOpenKeyExA (000000000011)
71a278ea    RegOpenKeyExA (000000000012)
71a278ea    RegOpenKeyExA (000000000013)
71a22623    WaitForSingleObject(784,0)
71a283c6    RegOpenKeyExA (NameSpace_Catalog5)
71a2737e    RegOpenKeyExA (00000004)
71a27f5b    RegOpenKeyExA (Catalog_Entries)
71a280ef    RegOpenKeyExA (000000000001)
71a280ef    RegOpenKeyExA (000000000002)
71a280ef    RegOpenKeyExA (000000000003)
71a22623    WaitForSingleObject(77c,0)
71a11afa    RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\Winsock2\Parameters)
71a11996    GlobalAlloc()
7c80b689    ExitThread()
7339e2cd    GetCommandLineA()
733c7957    LoadLibraryA(C:\windows\system32\vb6chs.dll)=0
7340c49c    LoadLibraryA(IMM32.DLL)=76300000
7339edbc    GetVersionExA()
76bc183b    ReadProcessMemory(h=ffffffff)
76bc185a    ReadProcessMemory(h=ffffffff)
76bc1878    ReadProcessMemory(h=ffffffff)
76bc211f    ReadProcessMemory(h=ffffffff)
746826aa    GetVersionExA()
746830a7    RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\Compatibility\SVCHOST.EXE)
746830a7    RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\SystemShared\)
7468245b    CreateMutex(CTF.LBES.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)
7468245b    CreateMutex(CTF.Compart.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)
7468245b    CreateMutex(CTF.Asm.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)
7468245b    CreateMutex(CTF.Layouts.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)
7468245b    CreateMutex(CTF.TMD.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)
746830a7    RegOpenKeyExA (HKCU\Keyboard Layout\Toggle)
7468260a    RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\)
74684683    GetCurrentProcessId()=820
7468245b    CreateMutex(CTF.TimListCache.FMPDefaultS-1-5-21-1060284298-1214440339-682003330-500MUTEX.DefaultS-1-5-21-1060284298-1214440339-682003330-500)
7469d232    WaitForSingleObject(75c,1388)
746b556a    GetCurrentProcessId()=820
7339f14e    LoadLibraryA(OLEAUT32.DLL)=770f0000
769b2b33    LoadLibraryA(oleaut32.dll)=770f0000
7c816513    WaitForSingleObject(754,64)
73658f33    GetVersionExA()
73665225    GetVersionExA()
7365d4f4    LoadLibraryA(C:\windows\system32\ole32.dll)=76990000
733d65be    LoadLibraryA(IMM32.DLL)=76300000
733a0cf8    RegOpenKeyA (HKLM\SOFTWARE\Microsoft\VBA\Monitors)
77dcc449    RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\VBA\Monitors)
733aebb5    GetVersionExA()
769b6bd0    GetCurrentProcessId()=820
769b46b0    GetCurrentProcessId()=820
77154207    GlobalAlloc()
77153e70    GlobalAlloc()
77153f42    GlobalAlloc()
769b6458    GlobalAlloc()
769b6476    GlobalAlloc()
734604da    GlobalAlloc()
7340bdaf    GlobalAlloc()
7340bf5b    GlobalAlloc()
733ab7ee    LoadLibraryA(kernel32)=7c800000
733a4b2a    GetCurrentProcessId()=820
769dbd9b    GetCurrentProcessId()=820
73dc8839    LoadLibraryA(MSVCRT.DLL)=77be0000
73dc9714    GlobalAlloc()
73dc8c09    LoadLibraryA(C:\windows\system32\MFC42LOC.DLL)=61be0000
7351da01    GetVersionExA()
75e27069    GetVersionExA()
75e270cc    GetCommandLineA()
770fe457    RegOpenKeyA (HKCR\TypeLib)
77dcc449    RegOpenKeyExA (HKCR\TypeLib)
770fe4c5    RegOpenKeyA (1.0)
77dcc449    RegOpenKeyExA (1.0)
770fe395    RegOpenKeyA (0)
77dcc449    RegOpenKeyExA (0)
770fd06b    _lread(6a0,12e95c,40)
7c8353e7    ReadFile()
770fde89    _lread(6a0,12e798,4)
770fde89    _lread(6a0,12e74c,14)
770fde89    _lread(6a0,12e7c8,28)
770fde89    _lread(6a0,12e600,10)
770fde89    _lread(6a0,12e7a4,8)
770fde89    _lread(6a0,12e618,2)
770fde89    _lread(6a0,12e620,e)
770fde89    _lread(6a0,12e778,10)
733ab7ee    LoadLibraryA(advapi32.dll)=77da0000
40372f    RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon)
4032c5    RegSetValueExA (Userinit)
40372f    RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced)
77102527    LoadLibraryA(C:\windows\system32\kernel32.dll)=7c800000
403248    RegSetValueExA (ShowSuperHidden)
769b02fd    WaitForSingleObject(728,0)
769b02fd    WaitForSingleObject(720,0)
769b02fd    WaitForSingleObject(718,0)
7351ad01    WriteFile(h=6b8)
733b5c4d    CreateFileA(C:\Documents and Settings\Administrator\桌面\00\SVCHOST.EXE)
733b5c4d    CreateFileA(C:\Config.exe)
733bd93b    ReadFile()
733b653f    WriteFile(h=6a8)
7346e81b    CreateFileA(C:\Documents and Settings\Administrator\桌面\00\SVCHOST.EXE)
7346e836    CreateFileA(C:\Config.exe)
7351ad01    WriteFile(h=6b0)
733b5c4d    CreateFileA(D:\Config.exe)
733b653f    WriteFile(h=6b8)
7346e836    CreateFileA(D:\Config.exe)
733b5c4d    CreateFileA(E:\Config.exe)
733b653f    WriteFile(h=6b0)
7346e836    CreateFileA(E:\Config.exe)
733b5c4d    CreateFileA(F:\Config.exe)
7346e836    CreateFileA(F:\Config.exe)
733b5c4d    CreateFileA(G:\Config.exe)
733b5c4d    CreateFileA(H:\Config.exe)
770fd06b    _lread(6a4,12f49c,40)
770fde89    _lread(6a4,12f2d8,4)
770fde89    _lread(6a4,12f28c,14)
770fde89    _lread(6a4,12f308,28)
770fde89    _lread(6a4,12f140,10)
770fde89    _lread(6a4,12f2e4,8)
770fde89    _lread(6a4,12f158,2)
770fde89    _lread(6a4,12f160,e)
770fde89    _lread(6a4,12f2b8,10)
7351ad01    WriteFile(h=69c)
733b653f    WriteFile(h=6a0)
7351ad01    WriteFile(h=6a0)
733b653f    WriteFile(h=69c)

DirwatchData

--------------------------------------------------
WatchDir Initilized OK
Watching C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
Watching C:\windows
Watching C:\Program Files
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFEE72.tmp
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFEE72.tmp
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET1B60.tmp
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET1B60.tmp
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF2843.tmp
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF2843.tmp
Modifed: C:\windows\Debug\UserMode\userenv.log
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF4B34.tmp
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF4B34.tmp

显示全部楼层 · 发表于 2007-5-27 19:50:15

卡巴6.0
已删除: 病毒 Virus.Win32.AutoRun.x 文件: C:\Documents and Settings\LYM\桌面\00.rar/SVCHOST.EXE

显示全部楼层 · 发表于 2007-5-28 17:02:51

木马名称:未知木马
程序:
I:\TEST\070527\28\00\SVCHOST.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

[病毒样本] 一个

我这里微点提特征了