熊猫烧香样本 360卫士昨天晚上安全 现在报未知

小飞侠.net

7758521wang 发表于 2011-6-3 17:17
360卫士8.1版本报未知  连红伞引擎都没查出来

有没有解压？

polluxkyo

FS kill  

结果: 发现 1 个恶意软件
Win32.Worm.Fujacks.F (病毒)
D:\我的文档\桌面\熊猫烧香病毒样本.rar\GameSetup.exe

7758521wang

小飞侠.net 发表于 2011-6-3 17:54
有没有解压？

网盾报未知  没解压

xiaomaobi

mse kill

KOI9009

瑞星 Kill

网名丢失

红伞杀

hx1997

一直这么几个动作...

2011-6-3 19:41:47        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\machine\software\microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue        allowed        0.Samples Testing Mode
2011-6-3 19:41:44        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        create process        G:\windows\system32\cmd.exe        blocked        22.%windir%\system32\cmd.exe
2011-6-3 19:41:41        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Run\svcshare        allowed        0.Samples Testing Mode
2011-6-3 19:41:28        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        create process        G:\windows\system32\cmd.exe        blocked        22.%windir%\system32\cmd.exe
2011-6-3 19:41:24        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Run\svcshare        blocked        0.Samples Testing Mode
2011-6-3 19:41:16        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        create process        G:\windows\system32\cmd.exe        blocked        22.%windir%\system32\cmd.exe
2011-6-3 19:41:07        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        create process        G:\windows\system32\cmd.exe        blocked        22.%windir%\system32\cmd.exe
2011-6-3 19:40:59        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        create process        G:\windows\system32\cmd.exe        blocked        22.%windir%\system32\cmd.exe
2011-6-3 19:40:50        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        create process        G:\windows\system32\cmd.exe        blocked        22.%windir%\system32\cmd.exe
2011-6-3 19:40:40        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        create process        G:\windows\system32\cmd.exe        blocked        22.%windir%\system32\cmd.exe
2011-6-3 19:40:32        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\machine\software\microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue        allowed        0.Samples Testing Mode
2011-6-3 19:40:30        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Run\svcshare        allowed        0.Samples Testing Mode
2011-6-3 19:39:43        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect        allowed        0.Samples Testing Mode
2011-6-3 19:39:40        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet        allowed        0.Samples Testing Mode
2011-6-3 19:39:38        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName        allowed        0.Samples Testing Mode
2011-6-3 19:39:36        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass        allowed        0.Samples Testing Mode
2011-6-3 19:39:34        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect        allowed        0.Samples Testing Mode
2011-6-3 19:39:32        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet        allowed        0.Samples Testing Mode
2011-6-3 19:39:30        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName        allowed        0.Samples Testing Mode
2011-6-3 19:39:29        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass        allowed        0.Samples Testing Mode
2011-6-3 19:39:22        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings        allowed        0.Samples Testing Mode
2011-6-3 19:39:20        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\machine\system\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable        allowed        0.Samples Testing Mode
2011-6-3 19:39:18        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable        allowed        0.Samples Testing Mode
2011-6-3 19:39:16        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy        allowed        0.Samples Testing Mode
2011-6-3 19:39:13        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData        allowed        0.Samples Testing Mode
2011-6-3 19:39:10        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData        allowed        0.Samples Testing Mode
2011-6-3 19:39:07        G:\windows\System32\SVCHOST.EXE        delete value        HKEY_USERS\S-1-5-21-1491950412-2009852829-4049741679-500\Software\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities\RequestMediaCall        allowed        0.Samples Testing Mode
2011-6-3 19:39:05        G:\windows\System32\SVCHOST.EXE        set value        HKEY_USERS\S-1-5-21-1491950412-2009852829-4049741679-500\Software\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities\RequestMakeCall        allowed        0.Samples Testing Mode
2011-6-3 19:39:03        G:\windows\System32\SVCHOST.EXE        delete key        HKEY_USERS\S-1-5-21-1491950412-2009852829-4049741679-500\Software\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities\MediaModes        allowed        0.Samples Testing Mode
2011-6-3 19:39:01        G:\windows\System32\SVCHOST.EXE        delete value        HKEY_USERS\S-1-5-21-1491950412-2009852829-4049741679-500\Software\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities\RequestMediaCall        allowed        0.Samples Testing Mode
2011-6-3 19:38:59        G:\windows\System32\SVCHOST.EXE        set value        HKEY_USERS\S-1-5-21-1491950412-2009852829-4049741679-500\Software\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities\RequestMakeCall        allowed        0.Samples Testing Mode
2011-6-3 19:38:57        G:\windows\System32\SVCHOST.EXE        delete key        HKEY_USERS\S-1-5-21-1491950412-2009852829-4049741679-500\Software\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities\MediaModes        allowed        0.Samples Testing Mode
2011-6-3 19:38:54        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\machine\software\microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData        allowed        0.Samples Testing Mode
2011-6-3 19:38:43        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History        allowed        0.Samples Testing Mode
2011-6-3 19:38:41        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies        allowed        0.Samples Testing Mode
2011-6-3 19:38:38        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\machine\software\microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue        allowed        0.Samples Testing Mode
2011-6-3 19:38:35        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Run\svcshare        allowed        0.Samples Testing Mode
2011-6-3 19:38:33        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        set value        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache        allowed        0.Samples Testing Mode
2011-6-3 19:38:27        G:\Documents and Settings\Administrator.HX-C0987054243B\桌面\GameSetup.exe        create process        G:\Sandbox\HX\Virus\drive\G\windows\system32\drivers\spo0lsv.exe        allowed        0.Samples Testing Mode

sevenday

360目前已经kill

bluelily

大蜘蛛kill

daddy55

好长的网址