再来

显示全部楼层 · 发表于 2007-5-27 16:15:48

avast报了!

显示全部楼层 · 发表于 2007-5-27 17:31:50

咖啡又挂了

显示全部楼层 · 发表于 2007-5-27 18:46:59

Processes:
PID ParentPID User Path
--------------------------------------------------
1152 360 MSEOSJD88JED:Administrator C:\Documents and Settings\Administrator\桌面\01\svchost.exe

Ports:
Port PID Type Path
--------------------------------------------------

Explorer Dlls:
DLL Path Company Name File Description
--------------------------------------------------
No changes Found

IE Dlls:
DLL Path Company Name File Description
--------------------------------------------------
No changes Found

Loaded Drivers:
Driver File Company Name Description
--------------------------------------------------

Monitored RegKeys
Registry Key Value
--------------------------------------------------

Kernel31 Api Log

--------------------------------------------------
***** Installing Hooks *****
71a270df    RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\WinSock2\Parameters)
71a27cc4    RegOpenKeyExA (Protocol_Catalog9)
71a2737e    RegOpenKeyExA (000000F3)
71a2724d    RegOpenKeyExA (Catalog_Entries)
71a278ea    RegOpenKeyExA (000000000001)
71a278ea    RegOpenKeyExA (000000000002)
71a278ea    RegOpenKeyExA (000000000003)
71a278ea    RegOpenKeyExA (000000000004)
71a278ea    RegOpenKeyExA (000000000005)
71a278ea    RegOpenKeyExA (000000000006)
71a278ea    RegOpenKeyExA (000000000007)
71a278ea    RegOpenKeyExA (000000000008)
71a278ea    RegOpenKeyExA (000000000009)
71a278ea    RegOpenKeyExA (000000000010)
71a278ea    RegOpenKeyExA (000000000011)
71a278ea    RegOpenKeyExA (000000000012)
71a278ea    RegOpenKeyExA (000000000013)
71a22623    WaitForSingleObject(798,0)
71a283c6    RegOpenKeyExA (NameSpace_Catalog5)
71a2737e    RegOpenKeyExA (00000004)
71a27f5b    RegOpenKeyExA (Catalog_Entries)
71a280ef    RegOpenKeyExA (000000000001)
71a280ef    RegOpenKeyExA (000000000002)
71a280ef    RegOpenKeyExA (000000000003)
71a22623    WaitForSingleObject(790,0)
71a11afa    RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\Winsock2\Parameters)
71a11996    GlobalAlloc()
7c80b689    ExitThread()
40f5c8    LoadLibraryA(KERNEL32.DLL)=7c800000
40f5c8    LoadLibraryA(advapi32.dll)=77da0000
40f5c8    LoadLibraryA(shlwapi.dll)=77f40000
40f5c8    LoadLibraryA(user32.dll)=77d10000
402b53    RegOpenKeyExA (HKLM\Nop)
402038    RegOpenKeyExA (HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE)
40267c    RegOpenKeyExA (HKLM\SOFTWARE\KasperskyLab\AVP6\environment\)
40223c    CreateFileA(C:\Documents and Settings\Administrator\桌面\01\svchost.exe)
402263    ReadFile()
4022af    ReadFile()
402dea    Copy(C:\Documents and Settings\Administrator\桌面\01\svchost.exe->C:\Program Files\Internet Explorer\romdrivers.bak)
7c8283f4    WriteFile(h=79c)
401f8e    CreateFileA(C:\Program Files\Internet Explorer\romdrivers.dll)
401fb4    WriteFile(h=79c)
401fd4    WriteFile(h=79c)
15d950    LoadLibraryA(KERNEL32.DLL)=7c800000
15d950    LoadLibraryA(advapi32.dll)=77da0000
15d950    LoadLibraryA(gdi32.dll)=77ef0000
15d950    LoadLibraryA(oleaut32.dll)=770f0000
15d950    LoadLibraryA(shlwapi.dll)=77f40000
15d950    LoadLibraryA(user32.dll)=77d10000
15d950    LoadLibraryA(wininet.dll)=76680000
152ee9    RegCreateKeyExA (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks,(null))
152ef4    RegDeleteValueA ({754FB7D8-B8FE-4810-B363-A788CD060F1F})
152ef4    RegDeleteValueA ({A6011F8F-A7F8-49AA-9ADA-49127D43138F})
152ef4    RegDeleteValueA ({06A68AD9-FF56-6E73-937B-B893E72F6226})
152ef4    RegDeleteValueA ({AEB6717E-7E19-11d0-97EE-00C04FD91972})
152ef4    RegDeleteValueA ({99F1D023-7CEB-4586-80F7-BB1A98DB7602})
152ef4    RegDeleteValueA ({FEB94F5A-69F3-4645-8C2B-9E71D270AF2E})
152ef4    RegDeleteValueA ({923509F1-45CB-4EC0-BDE0-1DED35B8FD60})
152ef4    RegDeleteValueA ({42A612A4-4334-4424-4234-42261A31A236})
152ef4    RegDeleteValueA ({DE35052A-9E37-4827-A1EC-79BF400D27A4})
152ef4    RegDeleteValueA ({DD7D4640-4464-48C0-82FD-21338366D2D2})
152ef4    RegDeleteValueA ({B8A170A8-7AD3-4678-B2FE-F2D7381CC1B5})
152ef4    RegDeleteValueA ({131AB311-16F1-F13B-1E43-11A24B51AFD1})
152ef4    RegDeleteValueA ({274B93C2-A6DF-485F-8576-AB0653134A76})
152ef4    RegDeleteValueA ({1496D5ED-7A09-46D0-8C92-B8E71A4304DF})
152ef4    RegDeleteValueA ({01F6EB6F-AB5C-1FDD-6E5B-FB6EE3CC6CD6})
152ef4    RegDeleteValueA ({06E6B6B6-BE3C-6E23-6C8E-B833E2CE63B8})
152ef4    RegDeleteValueA ({BC0ACA58-6A6F-51DA-9EFE-9D20F4F621BA})
153150    RegOpenKeyExA (HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE)
154fe3    RegOpenKeyExA (HKLM\Software\Microsoft\Windows\)
402ed8    LoadLibraryA(C:\Program Files\Internet Explorer\romdrivers.dll)=150000
746826aa    GetVersionExA()
746830a7    RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\Compatibility\svchost.exe)
746830a7    RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\SystemShared\)
76bc183b    ReadProcessMemory(h=ffffffff)
76bc185a    ReadProcessMemory(h=ffffffff)
76bc1878    ReadProcessMemory(h=ffffffff)
76bc211f    ReadProcessMemory(h=ffffffff)
7468245b    CreateMutex(CTF.LBES.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)
7468245b    CreateMutex(CTF.Compart.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)
7468245b    CreateMutex(CTF.Asm.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)
7468245b    CreateMutex(CTF.Layouts.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)
7468245b    CreateMutex(CTF.TMD.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)
746830a7    RegOpenKeyExA (HKCU\Keyboard Layout\Toggle)
7468260a    RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\)
74684683    GetCurrentProcessId()=1152
7468245b    CreateMutex(CTF.TimListCache.FMPDefaultS-1-5-21-1060284298-1214440339-682003330-500MUTEX.DefaultS-1-5-21-1060284298-1214440339-682003330-500)
7469d232    WaitForSingleObject(774,1388)
746b556a    GetCurrentProcessId()=1152
7c816513    WaitForSingleObject(76c,64)
73658f33    GetVersionExA()
73665225    GetVersionExA()
7365d4f4    LoadLibraryA(C:\windows\system32\ole32.dll)=76990000
7c859c4a    GlobalAlloc()
7c859cf9    CreateMutex(DBWinMutex)
7c859e2f    WaitForSingleObject(760,ffffffff)

DirwatchData

--------------------------------------------------
WatchDir Initilized OK
Watching C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
Watching C:\windows
Watching C:\Program Files
Created: C:\windows\system32
Created: C:\windows\system32\drivers
Created: C:\windows\system32\drivers\etc
Created: C:\windows\system32\drivers\etc\hosts
Modifed: C:\windows\system32\drivers\etc\hosts
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET432F.tmp
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET432F.tmp
Modifed: C:\windows\system32
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF107E.tmp
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF107E.tmp
Modifed: C:\windows\Debug
Modifed: C:\windows\Debug\UserMode\userenv.log
Modifed: C:\windows\system32\drivers
Modifed: C:\windows\system32\drivers\etc
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF337F.tmp
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF337F.tmp

显示全部楼层 · 发表于 2007-5-27 19:51:59

卡巴6.0
已删除: 病毒 Worm.Win32.Delf.bz 文件: C:\Documents and Settings\LYM\桌面\01.rar/svchost.exe//UPX

显示全部楼层 · 发表于 2007-5-27 20:33:47

显示全部楼层 · 发表于 2007-5-28 17:01:45

蠕虫名称:Worm.Win32.Delf.apq
程序:
I:\TEST\070527\27\01\SVCHOST.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

[病毒样本] 再来

本帖子中包含更多资源

微点报已知