26 ответов в этой теме

[Игорь7]

Вот подробный отчет.
Время 22:16 - 22:17. Время проверки файла 43 сек.
 
Вот кусок:

Spoiler

2016-Oct-02 22:15:44.727496 [2384] [INF] [2284] [arkdll]

id: 3144, type: PsCreate (16), flags: 1 (wait: 1), cid: 1832/4004:\Device\HarddiskVolume3\Windows\explorer.exe
created process: \Device\HarddiskVolume3\Windows\explorer.exe:1832 --> \Device\HarddiskVolume3\Program Files\Sandboxie\Start.exe:6084
type: 0, reason: 0, new: 0, dbg: 0, cmd: "C:\Program Files\Sandboxie\Start.exe" default_browser
signer: C=US|ST=Virginia|L=Fairfax|O=Invincea, Inc.|CN=Invincea, Inc., timestamp: 22.09.2016 18:52:48.0000, thumbprint: 21c33f1f25cef09156e5b5d9abf3f8f836703950
hash: 4a4298e8be22ca2a1a261493b6fa17dfcba7e9f8 status: db_cert_white_list, signed, pe32, new_pe (0x900204) / signed / unknown
id: 3144 ==> undefined [1], time: 0.416466 ms

2016-Oct-02 22:15:47.539657 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:15:47.540657 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:15:49.813787 [1540] [DBG] [task_manager] New task named 'services'
2016-Oct-02 22:15:52.546943 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:15:52.546943 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:15:57.555230 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:15:57.555230 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:16:02.562516 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:16:02.562516 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:16:07.569802 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:16:07.569802 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:16:12.577089 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:16:12.577089 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:16:15.469254 [2424] [DBG] [wsc] on_uptodate, uptodate = 1
2016-Oct-02 22:16:17.584375 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:16:17.585375 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:16:19.815503 [1540] [DBG] [task_manager] New task named 'services'
2016-Oct-02 22:16:22.592662 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:16:22.592662 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:16:27.493942 [2384] [INF] [2284] [arkdll]

id: 3155, type: PsCreate (16), flags: 1 (wait: 1), cid: 548/4828:\Device\HarddiskVolume3\Windows\System32\services.exe
created process: \Device\HarddiskVolume3\Windows\System32\services.exe:548 --> \Device\HarddiskVolume3\Program Files\Sandboxie\SbieSvc.exe:4388
type: 0, reason: 1, new: 1, dbg: 0, cmd: "C:\Program Files\Sandboxie\SbieSvc.exe"
signer: C=US|ST=Virginia|L=Fairfax|O=Invincea, Inc.|CN=Invincea, Inc., timestamp: 22.09.2016 18:52:48.0000, thumbprint: 21c33f1f25cef09156e5b5d9abf3f8f836703950
hash: 01e694498d2554136a1a7bb19a58c7002e0ae477 status: db_cert_white_list, signed, pe32, new_pe (0x900204) / signed / unknown
id: 3155 ==> undefined [1], time: 42633.154948 ms

2016-Oct-02 22:16:27.599948 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:16:27.600948 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:16:28.496999 [2424] [INF] [2284] [arkdll]

id: 3171, type: PsCreate (16), flags: 1 (wait: 1), cid: 4388/3484:\Device\HarddiskVolume3\Program Files\Sandboxie\SbieSvc.exe
created process: \Device\HarddiskVolume3\Program Files\Sandboxie\SbieSvc.exe:4388 --> \Device\HarddiskVolume3\Program Files\Sandboxie\Start.exe:4968
type: 0, reason: 0, new: 0, dbg: 0, cmd: "C:\Program Files\Sandboxie\Start.exe" /env:00000000_SBIE_CURRENT_DIRECTORY="C:\Program Files\Sandboxie" /env:=Refresh "C:\Program Files\Mozilla Firefox\firefox.exe"
signer: C=US|ST=Virginia|L=Fairfax|O=Invincea, Inc.|CN=Invincea, Inc., timestamp: 22.09.2016 18:52:48.0000, thumbprint: 21c33f1f25cef09156e5b5d9abf3f8f836703950
hash: 4a4298e8be22ca2a1a261493b6fa17dfcba7e9f8 status: db_cert_white_list, signed, pe32, new_pe (0x900204) / signed / unknown
id: 3171 ==> undefined [1], time: 0.421702 ms

2016-Oct-02 22:16:32.607235 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:16:32.607235 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:16:35.465398 [2424] [INF] [2204] [arkdll]

id: 3176, type: PsDelete (17), flags: 0 (wait: 0), cid: 5240/5508:
terminated process: \Device\HarddiskVolume3\Windows\System32\sppsvc.exe:5240
hash: status: signed_microsoft, spc (0x4000800) / signed_microsoft / clean
id: 3176 ==> undefined [1], time: 0.043288 ms

2016-Oct-02 22:16:37.614521 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:16:37.614521 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:16:39.382622 [2424] [INF] [2204] [arkdll]

id: 3177, type: PsCreate (16), flags: 1 (wait: 1), cid: 548/4828:\Device\HarddiskVolume3\Windows\System32\services.exe
created process: \Device\HarddiskVolume3\Windows\System32\services.exe:548 --> \Device\HarddiskVolume3\Windows\System32\svchost.exe:4980
type: 0, reason: 1, new: 1, dbg: 0, cmd: C:\Windows\System32\svchost.exe -k WerSvcGroup
status: signed_microsoft, system_file_host, spc (0x4040800) / signed_microsoft / clean
id: 3177 ==> allowed [2], time: 0.303709 ms

2016-Oct-02 22:16:39.528630 [2424] [INF] [2204] [arkdll]

id: 3183, type: PsDelete (17), flags: 0 (wait: 0), cid: 4968/4440:
terminated process: \Device\HarddiskVolume3\Program Files\Sandboxie\Start.exe:4968
signer: C=US|ST=Virginia|L=Fairfax|O=Invincea, Inc.|CN=Invincea, Inc., timestamp: 22.09.2016 18:52:48.0000, thumbprint: 21c33f1f25cef09156e5b5d9abf3f8f836703950
hash: 4a4298e8be22ca2a1a261493b6fa17dfcba7e9f8 status: db_cert_white_list, signed, pe32, new_pe (0x900204) / signed / unknown
id: 3183 ==> undefined [1], time: 0.069120 ms

2016-Oct-02 22:16:39.551632 [2424] [INF] [2204] [arkdll]

id: 3184, type: PsDelete (17), flags: 0 (wait: 0), cid: 6084/4200:
terminated process: \Device\HarddiskVolume3\Program Files\Sandboxie\Start.exe:6084
signer: C=US|ST=Virginia|L=Fairfax|O=Invincea, Inc.|CN=Invincea, Inc., timestamp: 22.09.2016 18:52:48.0000, thumbprint: 21c33f1f25cef09156e5b5d9abf3f8f836703950
hash: 4a4298e8be22ca2a1a261493b6fa17dfcba7e9f8 status: db_cert_white_list, signed, pe32, new_pe (0x900204) / signed / unknown
id: 3184 ==> undefined [1], time: 0.098444 ms

2016-Oct-02 22:16:42.621807 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:16:42.621807 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:16:47.629094 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:16:47.629094 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:16:49.817219 [1540] [DBG] [task_manager] New task named 'services'
2016-Oct-02 22:16:52.637380 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:16:52.637380 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:16:57.644667 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:16:57.644667 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:17:02.651953 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:17:02.651953 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:17:07.659239 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:17:07.659239 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:17:11.023432 [2384] [INF] [2284] [arkdll]

id: 3173, type: PsInject (43), flags: 1 (wait: 1), cid: 4388/5568:\Device\HarddiskVolume3\Program Files\Sandboxie\SbieSvc.exe
hips: type: 18, action: ask [0]
inject: WriteMemory [1], target process: \Device\HarddiskVolume3\Program Files\Sandboxie\Start.exe:4968
signer: C=US|ST=Virginia|L=Fairfax|O=Invincea, Inc.|CN=Invincea, Inc., timestamp: 22.09.2016 18:52:48.0000, thumbprint: 21c33f1f25cef09156e5b5d9abf3f8f836703950
hash: 01e694498d2554136a1a7bb19a58c7002e0ae477 status: db_cert_white_list, signed, pe32, new_pe (0x900204) / signed / unknown
id: 3173 ==> undefined [1], time: 42524.567650 ms

2016-Oct-02 22:17:12.666526 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:17:12.666526 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:17:15.470686 [2384] [DBG] [wsc] on_uptodate, uptodate = 1
2016-Oct-02 22:17:17.673812 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:17:17.673812 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:17:19.818935 [1540] [DBG] [task_manager] New task named 'services'
2016-Oct-02 22:17:22.681099 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:17:22.681099 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:17:27.688385 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:17:27.688385 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:17:32.695671 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:17:32.695671 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:17:37.703958 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:17:37.704958 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:17:42.711244 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:17:42.711244 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:17:47.718531 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:17:47.718531 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:17:49.820651 [1540] [DBG] [task_manager] New task named 'services'
2016-Oct-02 22:17:52.725817 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:17:52.725817 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:17:57.733103 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:17:57.733103 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:18:02.740390 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:18:02.740390 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:18:07.747676 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:18:07.748676 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:18:12.755963 [2384] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:18:12.756963 [2384] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:18:15.472118 [2424] [DBG] [wsc] on_uptodate, uptodate = 1
2016-Oct-02 22:18:17.763249 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:18:17.764249 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:18:19.822367 [1540] [DBG] [task_manager] New task named 'services'
2016-Oct-02 22:18:22.771536 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:18:22.771536 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:18:27.778822 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:18:27.778822 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:18:32.786108 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:18:32.786108 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:18:37.793395 [2424] [DBG] [local-services] DrWebFwSvc is 'Running', pid: 2428
2016-Oct-02 22:18:37.793395 [2424] [DBG] [local-services] DrWebNetFilter is 'Running', pid: 2944
2016-Oct-02 22:18:39.450490 [2424] [INF] [2284] [arkdll]

id: 3186, type: PsDelete (17), flags: 0 (wait: 0), cid: 4980/5688:
terminated process: \Device\HarddiskVolume3\Windows\System32\svchost.exe:4980
hash: status: signed_microsoft, system_file_host, spc (0x4040800) / signed_microsoft / clean
id: 3186 ==> undefined [1], time: 0.172800 ms

 

Прикрепленные файлы:

•  USERPC_User_021016_223006.zip   8,05Мб   1 Скачано раз

[v.martyanov]

Я все-таки хочу проверить как быстро он сканером проверяется...

[Konstantin Yudin]

где файл то? это не проверка

[Konstantin Yudin]

было бы идеально получить трейсы с procmon и wireshark. налицо какие то проблемы с доступом к серверам сертификатов. не удивлюсь если наш роскомнадзор забанил их crl сервера.

[Konstantin Yudin]

Переработал этот кусок логики, модуль доступен в бете. Было бы замечательно проверить как себя теперь ведёт старт процессов с антивирусом.

[RomaNNN]

Костя, а это можно починить? Раздражает, что засыпает эвентами "GUIPROXY_000000001" с нами на борту.

[Konstantin Yudin]

фикс в релизе. хочется фидбека