Chouying蠕虫与SRENG2.4日志 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛 Chouying蠕虫与SRENG2.4日志

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12 3 4

1 / 4 页

跳转页

Chouying蠕虫与SRENG2.4日志

baohe 大版主帖子:72578 注册: 2003-04-10 来自:	发表于： 2007-03-12 15:15 \| 只看楼主短消息资料字号：小中大 1楼 Chouying蠕虫与SRENG2.4日志昨天，见到一位求助者的SRENG 2.4日志中没有winlogon和services进程，非常不解。今天，观察仇鹰蠕虫时发现，中此毒后，SRENG 2.4日志的进程部分（见后）缺少winlogon、lsass和services进程。中此毒后，这是SRENG日志中唯一能看到的异常情况。仇鹰蠕虫的DLL插入winlogon和services进程；其加载项，SRENG也扫不到（见附图）。提醒诸位：如果SRENG日志中缺少必有项目时，应该引起警惕。另：SSM完全可以干掉仇鹰主体（被此毒感染的文件需用杀软收拾）。附件: 文件名:1558472007312150609.jpg 下载次数:360 文件类型:image/pjpeg 文件大小: 上传时间:2007-3-12 15:15:42 描述: 预览信息:EXIF信息 User Comment : LEAD Technologies Inc. V1.01 2007-03-21 10:53:05
baohe 大版主帖子:72578 注册: 2003-04-10 来自:	分享到：

baohe 大版主帖子:72578 注册: 2003-04-10 来自:	发表于： 2007-03-12 15:16 \| 只看楼主短消息资料字号：小中大 2楼中了仇鹰后的SRENG2.4日志（进程部分缺少winlogon、lsass和services进程信息）： 2007-03-12,14:43:34 System Repair Engineer 2.4.12.806 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能 ================================== 正在运行的进程 [PID: 616][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 680][\??\C:\windows\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 184][C:\windows\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\windows\system32\UmxSbxExw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\windows\system32\UmxSbxw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\Program Files\Internet Download Manager\IDMIECC.dll] [Internet Download Manager Corp., Tonec Inc., 1, 0, 2, 1] [C:\Program Files\Internet Download Manager\idmmkb.dll] [N/A, ] [PID: 664][C:\windows\system32\atiptaxx.exe] [ATI Technologies, Inc., 6.13.10.2531] [C:\windows\system32\UmxSbxExw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\windows\system32\UmxSbxw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\windows\system32\ATRPUIXX.ENU] [ATI Technologies, Inc., 6.13.10.2531] [C:\windows\system32\atipdsxx.dll] [ATI Technologies, Inc., 6.13.10.2531] [PID: 988][C:\windows\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\windows\system32\UmxSbxExw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\windows\system32\UmxSbxw.dll] [Computer Associates International, Inc., 6.0.1.58] [PID: 996][C:\Program Files\Tiny Firewall Pro\amon.exe] [Computer Associates International, Inc., 6.5.3.2] [C:\windows\system32\UmxSbxExw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\windows\system32\UmxSbxw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\Program Files\Tiny Firewall Pro\amonres.dll] [Computer Associates International, Inc., 6.5.1.2] [C:\Program Files\Tiny Firewall Pro\FncIDs.dll] [Computer Associates International, Inc., 6.0.0.1] [C:\Program Files\Tiny Firewall Pro\portnums.dll] [Computer Associates International, Inc., 6.0.0.1] [PID: 964][C:\Program Files\Tiny Firewall Pro\cfgtool.exe] [Computer Associates International, Inc., 6.0.0.52] [C:\windows\system32\UmxSbxExw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\windows\system32\UmxSbxw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\Program Files\Tiny Firewall Pro\cfgtoolres.dll] [Computer Associates International, Inc., 6.0.0.28] [C:\Program Files\Common Files\PFShared\Nag.dll] [Tiny Software, Inc., 6.0.1.22] [C:\Program Files\Common Files\PFShared\cfgwi.dll] [Computer Associates International, Inc., 6.0.0.127] [C:\Program Files\Common Files\PFShared\Cfgwires.dll] [Computer Associates International, Inc., 6.0.0.27] [C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\PDM.DLL] [Microsoft Corporation, 7.00.9466] [C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\2052\mdmui.dll] [Microsoft Corporation, 7.00.9466] [C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MSDBG2.DLL] [Microsoft Corporation, 7.00.9466] [C:\Program Files\Common Files\Microsoft Shared\INK\PENCHS.DLL] [Microsoft Corporation, 1.0.1038.0] [C:\Program Files\Common Files\PFShared\IfaceCtrl.dll] [Computer Associates International, Inc., 6.5.3.3] [C:\Program Files\Common Files\PFShared\SysObjExp.dll] [Computer Associates International, Inc., 6.0.0.7] [PID: 1292][C:\Program Files\Tiny Firewall Pro\tralogan.exe] [Computer Associates International, Inc., 6.0.0.17] [C:\windows\system32\UmxSbxExw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\windows\system32\UmxSbxw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\windows\system32\msxml4.dll] [Microsoft Corporation, 4.20.9818.0] [PID: 1256][C:\Program Files\Opera\Opera.exe] [Opera Software, 8679] [C:\windows\system32\UmxSbxExw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\windows\system32\UmxSbxw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\Program Files\Opera\Opera.dll] [Opera Software, 8679] [PID: 3440][C:\Program Files\SRENG\SREng.EXE] [Smallfrogs Studio, 2.4.12.806] [C:\windows\system32\UmxSbxExw.dll] [Computer Associates International, Inc., 6.0.1.58] [C:\windows\system32\UmxSbxw.dll] [Computer Associates International, Inc., 6.0.1.58] ================================== 相比之下，SRENG 2.3似乎更强些。中毒环境下仍可以扫到插入winlogon和services进程的病毒dll（图）。附件: 文件名:1558472007313100151.jpg 下载次数:294 文件类型:image/pjpeg 文件大小: 上传时间:2007-3-12 15:16:42 描述: 预览信息:EXIF信息 User Comment : LEAD Technologies Inc. V1.01
baohe 大版主帖子:72578 注册: 2003-04-10 来自:

afkp4e7 叱咤花甲狮帖子:2684 注册: 2006-12-01 来自:	发表于： 2007-03-12 15:43 \| 短消息资料字号：小中大 3楼猫老大不知Autoruns能不能扫到
afkp4e7 叱咤花甲狮帖子:2684 注册: 2006-12-01 来自:

水树雨下横据古稀狮帖子:8397 注册: 2006-07-26 来自:	发表于： 2007-03-12 16:00 \| 短消息资料字号：小中大 4楼那个新加的隐藏进程扫描似乎也是聊胜于无
水树雨下横据古稀狮帖子:8397 注册: 2006-07-26 来自:

孤独更可靠锋芒艾服狮帖子:1788 注册: 2007-01-27 来自:	发表于： 2007-03-12 16:04 \| 短消息资料字号：小中大 5楼嗯了,猫叔我也遇到和你一样的情况,不过是和你相反的 2.4的日志的进程里出现了好多的本来是已认证的dll文件.. 好长啊,有3页.. 不知道是不是新版的BUG..
孤独更可靠锋芒艾服狮帖子:1788 注册: 2007-01-27 来自:

孤独更可靠锋芒艾服狮帖子:1788 注册: 2007-01-27 来自:	发表于： 2007-03-12 16:13 \| 短消息资料字号：小中大 6楼还有,补充下,是帮别人分析的... 粘其中一段... 正在运行的进程 [PID: 572][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 640][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\CSRSRV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\basesrv.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\winsrv.dll] [Microsoft Corporation, 5.1.2600.2751 (xpsp_sp2_gdr.050831-1520)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\KERNEL32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)] [C:\WINDOWS\system32\LPK.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\USP10.dll] [Microsoft Corporation, 1.0420.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\sxs.dll] [Microsoft Corporation, 5.1.2600.3019 (xpsp_sp2_gdr.061019-0414)] [C:\WINDOWS\system32\Apphelp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 664][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\AUTHZ.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)] [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\CRYPT32.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp.050301-1521)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\MSASN1.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\NDdeApi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\PROFMAP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2976 (xpsp_sp2_gdr.060817-0106)] [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\PSAPI.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\REGAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\SETUPAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WINSTA.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WINTRUST.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\IMAGEHLP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\IMM32.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\LPK.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\USP10.dll] [Microsoft Corporation, 1.0420.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\MSGINA.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.3051 (xpsp_sp2_gdr.061219-0316)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3059 (xpsp_sp2_qfe.070104-0040)] [C:\WINDOWS\system32\COMCTL32.dll] [Microsoft Corporation, 5.82 (xpsp.060825-0040)] [C:\WINDOWS\system32\ODBC32.dll] [Microsoft Corporation, 3.525.1117.0 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\comdlg32.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\odbcint.dll] [Microsoft Corporation, 3.525.1117.0 built by: (_sqlbld)] [C:\WINDOWS\system32\SHSVCS.dll] [Microsoft Corporation, 6.00.2900.3051 (xpsp_sp2_gdr.061219-0316)] [C:\WINDOWS\system32\sfc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\sfc_os.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [C:\WINDOWS\system32\Apphelp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msctfime.ime] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WINSCARD.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WTSAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\cscdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WlNotify.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WINSPOOL.DRV] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\MPR.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)] ......其实这个进程还有一大截的dll文件没粘上来
孤独更可靠锋芒艾服狮帖子:1788 注册: 2007-01-27 来自:

taylor05771 社区嘉宾帖子:7232 注册: 2003-12-24 来自:	发表于： 2007-03-12 16:13 \| 短消息资料字号：小中大 7楼样本 zhz010266@njude.com.cn
taylor05771 社区嘉宾帖子:7232 注册: 2003-12-24 来自:

大版主

帖子:72578
注册: 2003-04-10
来自:

年度优秀版主奖

端午辟邪香囊

卡卡名人堂

就爱不长大

论坛9周年纪念

09欢乐圣诞

十周年

年度风云人物

2012我眼中的你们

茶馆劳模

瑞星金牌用户

十一周年勋章

发表于： 2007-03-12 16:18 | 只看楼主 短消息资料

字号：小中大 8楼

引用:

【afkp4e7的贴子】猫老大不知Autoruns能不能扫到
………………

扫不到。
另：中此毒后explorer（资源管理器）进程极不稳定，经常报错，自动关闭。

gototop

taylor05771 社区嘉宾帖子:7232 注册: 2003-12-24 来自:	发表于： 2007-03-12 16:21 \| 短消息资料字号：小中大 9楼比较可靠的查找方式就是注册表找值为 stubpath 然后手工判别
taylor05771 社区嘉宾帖子:7232 注册: 2003-12-24 来自:

我是来来初生襁褓狮帖子:1058 注册: 2006-09-13 来自:	发表于： 2007-03-12 16:25 \| 短消息资料字号：小中大 10楼瑞星能查吗？
我是来来初生襁褓狮帖子:1058 注册: 2006-09-13 来自:

<<上一主题|下一主题>>

12 3 4

1 / 4 页

跳转页

页面顶部

Powered by Discuz!NT