微点交流论坛

标题: 一个下载者让我的微点捕获木马及其生成物99个 [打印本页]

作者: 点饭的百度空间 时间: 2008-4-15 17:56 标题: 一个下载者让我的微点捕获木马及其生成物99个

感谢cyto让我白捡了99样本样本来自毒网xxp://boc.sbb22.com/home/index.htm

发现现在的网马很有规模,面广,品种多. 俨然就是产业化.汗啊.

文件: E:\virus\0.exe
大小: 7824 字节
修改时间: 2008年4月14日, 22:28:36
MD5: D7006A0C9840B24D74BEA5510078776B
SHA1: 07A5DA706508754323D0D6BFF8DD875EAF084B95
CRC32: FDC12A91

运行后读取自身资源在同目录下释放winboost.dll，并将该模块装载到自身进程空间中，检测\\.\KLIF判断卡巴斯基杀毒软件,释放一驱动到%tmp%，创建服务winsync32并启动后将服务删除，查找ntkrnlpa.exe中SDT以映射MDL的方式替换SSDT；为自身进程添加SeDebugPrivilege特权令牌，创建名字为50632D5C-B71B-4ba0-B012-3DC6F15C011B}的互斥体，拷贝该dll为msosiocp.dll到aystem32目录下，遍历进程查找explorer.exe，找到后打开进程申请内存后写入部分代码创建远程线程激活，ifeo如下程序，后台下载木马文件并激活。

100042C4 d32.exe...nod32kui
10004304 .exe....WinDbg.exe..RawCopy.exe.rfwProxy.exe....RegTool.exe.rfws
10004344 tub.exe.OllyICE.EXE.OllyDBG.EXE.procexp.exe.UpLive.exe..UmxPol.e
10004384 xe..UmxFwHlp.exe....UmxCfg.exe..UmxAttachment.exe...UmxAgent.exe
100043C4 ....UIHost.exe..TrojDie.kxp.Trojanwall.exe..TrojanDetector.exe..
10004404 SysSafe.exe.symlcsvc.exe....SREng.EXE...SmartUp.exe.shcfg32.exe.
10004444 scan32.exe..safelive.exe....Rsaupd.exe..RsAgent.exe.RfwMain.exe.
10004484 rfwcfg.exe..RegClean.exe....RavStub.exe.QHSET.exe...PFWLiveUpdat
100044C4 e.exe...KAV32.exe...mmqczj.exe..mcconsol.exe....MagicSet.exe....
10004504 KWatchX.exe.KWatch9x.exe....KWatch.exe..KvXP_1.kxp..KvXP.kxp....
10004544 kvwsc.exe...kvupload.exe....KVStub.kxp..KVSrvXP.exe.KVScan.kxp..
10004584 KvReport.kxp....kvolself.exe....kvol.exe....KVMonXP_1.kxp...KVMo
100045C4 nXP.kxp.KvfwMcl.exe.KvDetect.exe....KVCenter.kxp....KsLoader.exe
10004604 ....KRepair.com.KRegEx.exe..KPFWSvc.exe.KPFW32X.exe.KMFilter.exe
10004644 ....KMailMon.exe....KISLnchr.exe....KAVStart.exe....KAVSetup.exe
10004684 ....KAVPFW.exe..KAVDX.exe...KASTask.exe.KASMain.exe.KaScrScn.SCR
100046C4 ....kabaload.exe....isPwdSvc.exe....Iparmor.exe.HijackThis.exe..
10004704 FTCleanerShell.exe..FileDsty.exe....ccSvcHst.exe....CCenter.exe.
10004744 AvMonitor.exe...avgrssvc.exe....autoruns.exe....AppSvc32.exe....
10004784 AgentSvr.exe....IceSword.exe....adam.exe....iparmo.exe..360Safe.
100047C4 exe.EGHOST.exe..QQDoctor.exe....QQKav.exe...WoptiClean.exe..nod3
10004804 2krn.exe....mmsk.exe....RavMonD.exe.Ras.exe.KPfwSvc.exe.vsstat.e
10004844 xe..360safe.exe.NPFMntor.exe....webscanx.exe....avconsol.exe....
10004884 Navapw32.exe....Navapsvc.exe....safeboxTray.exe.360tray.exe.360r
100048C4 pt.exe..KPFW32.exe..KAVPF.exe...rfwsrv.exe..rfwmain.exe.safebank
10004904 .exe....360safebox.exe..FYFireWall.exe..PFW.exe.runiep.exe..avp.
10004944 exe.avp.com

微点对下载的木马通杀，一个不留，木马加生成物dll+sys一共99个：

时间处理结果木马名称木马进程名木马文件创建者
2008-04-14 23:06:33 用户取消未知木马 C:\DOCUMENTS AND SETTINGS\xx\桌面\WINBOOST.DLL
2008-04-14 23:05:33 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx40.Txx C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx3F.Txx
2008-04-14 23:05:33 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx3F.Txx C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:32 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExxORARY INTERNET FILES\CONTENT.IE5\VHAXLI51\28[1].EXE C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:32 处理成功 C:\WINDOWS\SYSTEM32\FMBIOST.DLL C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx3C.Txx
2008-04-14 23:05:32 处理成功 C:\WINDOWS\FMBIOST.EXE C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx3C.Txx
2008-04-14 23:05:32 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx3C.Txx C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:32 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExxORARY INTERNET FILES\CONTENT.IE5\NJ2C9EB2\27[1].EXE C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL

BY:unknown tycoon

[ Last edited by 点饭的百度空间 on 2008-4-15 at 18:00 ]

作者: 点饭的百度空间 时间: 2008-4-15 17:56
2008-04-14 23:05:31 处理成功 C:\WINDOWS\SYSTEM32\MSOSPING00.DLL C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx39.Txx
2008-04-14 23:05:31 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx3E.Txx C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx39.Txx
2008-04-14 23:05:31 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx3D.Txx C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx39.Txx
2008-04-14 23:05:31 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx39.Txx C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:30 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExxORARY INTERNET FILES\CONTENT.IE5\SOZD9E7H\26[1].EXE C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:30 处理成功 C:\WINDOWS\SYSTEM32\MSOSPTFS00.DLL C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx38.Txx
2008-04-14 23:05:30 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx3B.Txx C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx38.Txx
2008-04-14 23:05:30 处理成功 Trojan-PSW.Win32.OL-Game.ekd C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx41.Txx C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx3F.Txx
2008-04-14 23:05:30 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx3A.Txx C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx38.Txx
2008-04-14 23:05:29 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx38.Txx C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:29 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExxORARY INTERNET FILES\CONTENT.IE5\CRRVEKX1\25[1].EXE C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:29 处理成功 C:\WINDOWS\SYSTEM32\WINSVR32.DLL C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx37.Txx
2008-04-14 23:05:29 处理成功 C:\WINDOWS\WINSVR32.EXE C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx37.Txx
2008-04-14 23:05:28 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx37.Txx C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:28 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExxORARY INTERNET FILES\CONTENT.IE5\V79JVDGW\24[1].EXE C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:28 处理成功 C:\WINDOWS\SYSTEM32\DNDSIOC.DLL C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx36.Txx
2008-04-14 23:05:28 处理成功 C:\WINDOWS\DNDSIOC.EXE C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx36.Txx
2008-04-14 23:05:27 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx36.Txx C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:27 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExxORARY INTERNET FILES\CONTENT.IE5\Y9VGXW7I\23[1].EXE C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:27 处理成功 C:\WINDOWS\SYSTEM32\MFCHLP32.DLL C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx35.Txx
2008-04-14 23:05:27 处理成功 C:\WINDOWS\MFCHLP32.EXE C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx35.Txx
2008-04-14 23:05:26 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx35.Txx C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:26 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExxORARY INTERNET FILES\CONTENT.IE5\LW8BHLK9\22[1].EXE C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:26 处理成功 C:\WINDOWS\SYSTEM32\KVSC3.DLL C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx34.Txx
2008-04-14 23:05:25 处理成功 C:\WINDOWS\KVSC3.EXE C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx34.Txx
2008-04-14 23:05:25 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx34.Txx C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:25 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExxORARY INTERNET FILES\CONTENT.IE5\GJ7B20P9\21[1].EXE C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:25 处理成功 C:\WINDOWS\SYSTEM32\SHAPROC.DAT C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx33.Txx
2008-04-14 23:05:25 处理成功 C:\WINDOWS\SHAPROC.EXE C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx33.Txx
2008-04-14 23:05:24 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExx\Txx33.Txx C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL
2008-04-14 23:05:24 处理成功 C:\DOCUMENTS AND SETTINGS\xx\LOCAL SETTINGS\TExxORARY INTERNET FILES\CONTENT.IE5\ZVXRN5SW\20[1].EXE C:\WINDOWS\SYSTEM32\MSOSIOCP.DLL

对不起，您的帖子超过 10000 个字符的限制，请返回修改。:cool: 还有很多啊省略。

[ Last edited by 点饭的百度空间 on 2008-4-15 at 18:02 ]

作者: Legend 时间: 2008-4-15 18:15
请【点饭的百度空间】将微点的技术支持信息（微点主界面-->辅助功能-->生成技术支持信息）发送到我们support@micropoint.com.cn 邮箱，随信请附带此贴链接。

您发送完后，请通过论坛短消息将您的邮箱地址发给我，也请附带此贴链接。

作者: 点饭的百度空间 时间: 2008-4-15 18:30

Quote:

Originally posted by Legend at 2008-4-15 18:15:
请【点饭的百度空间】将微点的技术支持信息（微点主界面-->辅助功能-->生成技术支持信息）发送到我们support@micropoint.com.cn 邮箱，随信请附带此贴链接。

您发送完后，请通过论坛短消 ...

微点对下载的木马通杀，一个不留，木马加生成物dll+sys一共99个

作者: 046569 时间: 2008-4-15 22:15
估计超版是忙懵了还以为你反馈漏杀呢

作者: zheng363663 时间: 2008-4-16 10:49
他可能想要你手中的样本~~不过好像没有未知病毒啊

作者: 北極星★愛 时间: 2008-4-16 21:28
呵呵，不错，微点杀掉一切网马

作者: davidxwzhang 时间: 2008-4-18 00:29
，微点杀掉一切网马

作者: xiaoeonline 时间: 2008-4-21 18:29
:P微点就是好，呵呵支持一下！用微点我放心！

作者: sht220 时间: 2008-5-18 18:35
强力支持微点，我刚刚把诺顿2007卸掉，微点我喜欢

欢迎光临微点交流论坛 (http://bbs.micropoint.com.cn/)

bbs.micropoint.com.cn