微点交流论坛 - 主动防御 - 可疑样本的分析，请确认是否为误报

» 游客: 注册 | 登录 | 帮助

微点交流论坛 » 主动防御 » 可疑样本的分析，请确认是否为误报

tonyzyb
新手上路

积分 2
发帖 2
注册 2010-7-8

#1 可疑样本的分析，请确认是否为误报

微点主动防御查杀截图：

此样本分析：

The following ports were open in the system:
Port Protocol Process
1033 UDP [file and pathname of the sample #1]
1056 UDP [file and pathname of the sample #1]
1065 UDP [file and pathname of the sample #1]
9666 TCP [file and pathname of the sample #1]

The following Host Names were requested from a host database:
206.137.17.89
162.27.36.40
129.66.20.5
69.25.96.2
165.215.193.8
198.182.37.60
66.238.94.253
134.121.80.36
63.201.251.38
65.82.126.65
google.com.jm
google.co.uk
rss.50jn.info
google.lk
220.131.69.104
114.42.88.245
67.164.5.52
67.164.178.140
65.49.14.10
65.49.2.17
65.49.2.13
218.160.111.3
65.99.130.67
216.2.192.32
158.57.45.8
65.102.34.104
12.110.212.2
128.143.22.119
168.215.165.186
198.176.208.44
212.189.127.131
165.243.5.15
google.com.my
google.de
rss.5h5b.info
google.be
rss.250y.info
71.34.75.26
65.49.2.27
65.49.14.11
65.49.2.12
220.136.15.105
114.45.52.152
193.67.242.1
167.191.33.10
209.87.79.232
208.86.182.143
207.130.79.7
65.51.51.2
63.148.114.90
203.139.161.37
65.206.71.18
66.30.67.85
google.vc
google.dk
rss.4sni.info
google.us
70.59.139.145
122.122.132.212
There was registered attempt to establish connection with the remote host. The connection details are:
Remote Host Port Number
220.131.69.104 443

The following Internet Connections were established:
Server Name Server Port Connect as User Connection Password
ggoogle.com 80 (null) (null)
google.co.ck 80 (null) (null)
google.com.br 80 (null) (null)
floralartbyamy.com 80 (null) (null)
221.231.141.46 443 (null) (null)
64.34.180.105 443 (null) (null)
209.221.141.69 443 (null) (null)
204.200.195.130 443 (null) (null)
58.251.63.182 443 (null) (null)
65.161.114.27 443 (null) (null)
google.se 80 (null) (null)
goolge.com 80 (null) (null)
froogle.com 80 (null) (null)
googlescholar.com 80 (null) (null)
wwwpicasa.com 80 (null) (null)
google.vc 80 (null) (null)
googlecom.com 80 (null) (null)
wwwpicassa.com 80 (null) (null)
ï¿½ 80 ï¿½ ï¿½

The following GET requests were made:
gwt/n?u=http://71.34.75.26/YmYwMmIxNDNPPVs/FfkaVmZCY7/5GzK39hdR-Y/jXCA0KQ
gwt/n?u=http://71.34.75.26/ZjZmZmI1ND/QZ2eCl5clL/BsbBBAOTjuFE/xMDZMGx/z34yYfL/uvLQ
gwt/n?u=http://127.0.0.1/YWZlYzJhNjX/CAOeaCk/n4A2-IxR/wh_ETnyVU85Fk/lHBuL
gwt/n?u=http://rcv.cxggbwkfnq.org/Y2UyOTIz%2FODSpAyG7%2F719fTPw
gwt/n?u=http://65.49.14.10/MWViMzFl/OS9Pxbvztps/_SIqP7db0l3cP/EZnGQl57/BrqZHf7/__A
gwt/n?u=http://rss.5nin.info/NWMyMzJlMjPqj/hWU19wIAd/OLoA
gwt/n?u=http://124.8.229.183/NjQ5OTExN2/F6u3oF55SW/mPafh3c2/tHD_AdT3/17Tqw4OZ8/3mgRn4yZA
gwt/n?u=http://127.0.0.1/NjAwZmFkYTQZCd/eBUTuHiz/J1d2X0Pmg/Tm5S-pB/9d8Baq8n0
gwt/n?u=http://124.8.229.183/NzU1NGRkOTWU/_n9BXZbh/eZqE4s-TQzn16/JFHln--lfT/cG_41_P3NZY8
gwt/n?u=http://127.0.0.1/ZjQwMzU3Z/DVVNxa_E1D/miZ8NFKcSO/e-QZ-1Avr/y92lXtM/6ciA3nfBA
gwt/n?u=http://65.49.2.13/ZjE4OWI3ZC83xqsg/IAvalh7eSakHz/0O1S7-6R2/NM8kQ8
gwt/n?u=http://65.49.2.12/OGIzMmUwM/mNmRqrvzDu/TfdKMBnQBalOH/KYJ2_lFtS/yRulXNEfil/0W2o0End1TQ
gwt/n?u=http://rss.39kf.info/YjY3NTg0/NDLEFuPRiH/FhFA
gwt/n?u=http://99.155.196.131/ZDc0ZWNiYWPJwizT/Y07zPWJ/OEKRKdR/Ee5tibG/LhIRcG1hA
gwt/n?u=http://127.0.0.1/ZDA5NzIx/MWGaAGouLQ/ufInMDxB/dwGfgyM/5maeXKhmvaS9/JahenrWRT/wVUg
gwt/n?u=http://65.49.14.11/Y2EzNzQ/1YTnY8X7oqt/FvD2czo6AMNY3/ly_Gl3dElBr/-gfQ
gwt/n?u=http://99.155.196.131/ZTRiY2ZhZC9vXmm/Wsa6bC93uX/_XBAeZN/cj6FVLbqEiEK/oMrdDvo
gwt/n?u=http://65.49.2.15/Y2EzNzQ/1YTnY8X7oqt/FvD2czo6AMNY3/ly_Gl3dElBr/-gfQ
gwt/n?u=http://rss.3pir.info/M2MyZWQ1Nz/QGXJzEzho

如此的样本是否具有威胁性？

※ ※ ※ 本文纯属【tonyzyb】个人意见，与【微点交流论坛】立场无关※ ※ ※

2010-8-22 20:34

Legend
超级版主

超级版主

积分 77171
发帖 70170
注册 2005-10-29

#2

感谢楼主的反馈，建议楼主直接将此样本发送到virus@micropoint.com.cn邮箱中，我们具体分析测试一下，分析之后，我们会立即给您回复。

※文章所有权归【Legend】与【东方微点论坛】共同所有，转载请注明出处！※

微点官方认证新浪微博：欢迎进入微点新浪微博
微点技术支持邮箱: support@micropoint.com.cn
给Legend发短消息

2010-8-22 20:39

tonyzyb
新手上路

积分 2
发帖 2
注册 2010-7-8

Quote:

Originally posted by Legend at 2010-8-22 20:39:
感谢楼主的反馈，建议楼主直接将此样本发送到virus@micropoint.com.cn邮箱中，我们具体分析测试一下，分析之后，我们会立即给您回复。

已发送。

※ ※ ※ 本文纯属【tonyzyb】个人意见，与【微点交流论坛】立场无关※ ※ ※

2010-8-22 20:45

Legend
超级版主

超级版主

积分 77171
发帖 70170
注册 2005-10-29

#4

关于楼主反馈的问题，virus邮箱将把分析结果回复至您的发件邮箱当中，请楼主关注我们回复的邮件。

※文章所有权归【Legend】与【东方微点论坛】共同所有，转载请注明出处！※

微点官方认证新浪微博：欢迎进入微点新浪微博
微点技术支持邮箱: support@micropoint.com.cn
给Legend发短消息

2010-8-22 20:50

论坛跳转:

可打印版本 | 推荐 | 订阅 | 收藏

[ 联系我们 - 东方微点 ] 北京东方微点信息技术有限责任公司福建东方微点信息安全有限责任公司闽ICP备05030815号