[方案] 新autorun病毒（Kaspersky.exe)含樣本ꄠ…

看板AntiVirus (防毒)作者lcjjaff (回憶憶起回憶)時間17年前 (2008/01/07 17:11)推噓6(6推 0噓 4→)

留言10則, 5人參與討論串1/1

學校果然是隨身碟病毒風行的地方又中獎拉..... 然後去google找不到解法Orz 只好自己試看看>"< 爾且繼偽avp.exe後有一隻病毒，頂著卡車司機的名號招搖撞騙常常在論壇裡面下載卡車司機的人小心中招.... 檔名就叫做kaspersky.exe ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ autorun.inf [AutoRun] open=Kaspersky.exe shellexecute=Kaspersky.exe shell\Auto\command=Kaspersky.exe ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 機制測試：這邊可能有一點問題Orz，如果有其他高手測試後請補充測試樣本：http://kotuha.com/file/pKqkt-Kaspersky.html 樣本密碼：virus VT測試：反病毒引擎版本最後更新掃瞄結果 AhnLab-V3 - - - AntiVir - - TR/Crypt.CFI.Gen Authentium - - - Avast - - - AVG - - - BitDefender - - - CAT-QuickHeal - - - ClamAV - - - DrWeb - - - eSafe - - - eTrust-Vet - - - Ewido - - - FileAdvisor - - - Fortinet - - - F-Prot - - - F-Secure - - - Ikarus - - MalwareScope.Backdoor.Hupigon.17 Kaspersky - - - McAfee - - - Microsoft - - - NOD32v2 - - - Norman - - - Panda - - Suspicious file Prevx1 - - - Rising - - - Sophos - - - Sunbelt - - VIPRE.Suspicious Symantec - - - TheHacker - - - VBA32 - - - VirusBuster - - - Webwasher-Gateway - - Trojan.Crypt.CFI.Gen ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 檔案生成： C:\Program Files\Common Files\Microsoft Shared\MSINFO\Kaspersky.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat C:\WINDOWS\system32\_Kaspersky.exe X:\AutoRun.inf X:\Kaspersky.exe (其中X為全部磁碟) 測試過程中沒有機碼的寫入Orz 但事後掃Sreng 則在Server裡面有 [kaspersky 7.0 / kaspersky 7.0][Stopped/Auto Start] <C:\Program Files\Common Files\Microsoft Shared\MSINFO\Kaspersky.exe><N/A> 特別事情：修改其他程序記憶體那部分的機制我不是很清楚 EQ顯示: 2008-01-07 14:45:07 訪問物理記憶體操作:阻止程序路徑:C:\Program Files\Common Files\Microsoft Shared\MSINFO\Kaspersky.exe 2008-01-07 14:45:07 執行應用程序操作:允許(自動建立規則) 程序路徑:C:\Program Files\Common Files\Microsoft Shared\MSINFO\Kaspersky.exe 檔案路徑:C:\WINDOWS\system32\calc.exe 2008-01-07 14:45:17 修改其它程序記憶體操作:阻止程序路徑:C:\Program Files\Common Files\Microsoft Shared\MSINFO\Kaspersky.exe 目標程序:C:\WINDOWS\system32\calc.exe =>這邊如果一直"允許"的話，最後會出現記憶體無法寫入的錯誤視窗 2008-01-07 14:45:34 執行應用程序操作:允許(自動建立規則) 程序路徑:C:\Program Files\Common Files\Microsoft Shared\MSINFO\Kaspersky.exe 檔案路徑:C:\program files\internet explorer\IEXPLORE.EXE 2008-01-07 14:45:39 修改其它程序記憶體操作:阻止程序路徑:C:\Program Files\Common Files\Microsoft Shared\MSINFO\Kaspersky.exe 目標程序:C:\program files\internet explorer\IEXPLORE.EXE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 解法： windows的開始->"執行" 在開啟那邊輸入： sc delete kaspersky 7.0 按下確定下載OTmoveit http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe 複製下列文字 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C:\Program Files\Common Files\Microsoft Shared\MSINFO\Kaspersky.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat C:\WINDOWS\system32\_Kaspersky.exe X:\AutoRun.inf X:\Kaspersky.exe ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 執行OTMoveIt主程式在左半邊視窗按右鍵選貼上後按MoveIt! 註：X表示各磁碟代號，請自行加入 C:\AutoRun.inf C:\Kaspersky.exe D:\AutoRun.inf D:\Kaspersky.exe E:\AutoRun.inf E:\Kaspersky.exe ※ 編輯: lcjjaff 來自: 140.112.63.194 (01/07 17:13)