virus _1x

yishuad

MD5: C6463FE3177EEF75736C297A2A1F288A
SHA1: 1F5ECF7025A9C57499E2E3FC22B86465211FA4CA
CRC32: 6A8AB3CD

ablhr

avast kill

蝉鸣时

ESET NOD32 - 4940（20100312）

virus.exe - Win32/TrojanDownloader.Agent.PRQ trojan

ESET NOD32 4.2在下载前就拦截了，关掉Web访问保护才下载了下来...

尤金卡巴斯基

2010/3/13 19:20:43        已删除        木马程序 Trojan-Downloader.Win32.Small.kjv        G:\Temp\Virus\virus.rar/virus.exe

jason_jiang

汗，我发重复了
衍生物：http://bbs.kafan.cn/thread-660763-1-1.html

juhone

病毒: Trojan.Downloader.Agent.AAXB (Engine A)
by gdata

XE-cj

2010-3-13 21:00:14    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\owner\my documents\virus.exe
命令行: "C:\Documents and Settings\Owner\My Documents\virus.exe"
规则: [应用程序]*

2010-3-13 21:00:19    创建文件    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat
规则: [文件]*

2010-3-13 21:00:20    创建文件    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat
规则: [文件]*

2010-3-13 21:00:22    创建文件    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: C:\Documents and Settings\Owner\Cookies\index.dat
规则: [文件组]临时目录 -> [文件]c:\documents and settings\owner\cookies

2010-3-13 21:00:23    创建文件    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: C:\Documents and Settings\Owner\Cookies\index.dat
规则: [文件组]临时目录 -> [文件]c:\documents and settings\owner\cookies

2010-3-13 21:00:24    创建文件    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat
规则: [文件]*

2010-3-13 21:00:25    创建文件    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat
规则: [文件]*

2010-3-13 21:00:44    访问网络    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: UDP [本机 : 61015] ->  [61.177.7.1 : 53 (domain)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-3-13 21:00:46    访问网络    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: TCP [本机 : 1278] ->  [222.186.33.214 : 2311]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-3-13 21:00:54    创建文件    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\SZ0JKLG5\mm[1].htm
规则: [文件]*

2010-3-13 21:00:55    访问网络    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: UDP [本机 : 50254] ->  [61.177.7.1 : 53 (domain)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-3-13 21:00:56    访问网络    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: TCP [本机 : 1279] ->  [61.160.207.191 : 9999]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-3-13 21:00:58    创建文件    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\13CD460h7j5694.exe
规则: [文件组]临时目录 -> [文件]c:\documents and settings\owner\local settings\temp; *.exe

2010-3-13 21:01:00    创建新进程    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: c:\documents and settings\owner\local settings\temp\13cd460h7j5694.exe
命令行: C:\DOCUME~1\Owner\LOCALS~1\Temp\13CD460h7j5694.exe
规则: [应用程序]*

2010-3-13 21:01:37    创建文件    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\250685gH8J968.exe
规则: [文件组]临时目录 -> [文件]c:\documents and settings\owner\local settings\temp; *.exe

2010-3-13 21:01:39    创建新进程    允许
进程: c:\documents and settings\owner\my documents\virus.exe
目标: c:\documents and settings\owner\local settings\temp\250685gh8j968.exe
命令行: C:\DOCUME~1\Owner\LOCALS~1\Temp\250685gH8J968.exe
规则: [应用程序]*

2010-3-13 21:01:41    创建文件    允许
进程: c:\documents and settings\owner\local settings\temp\250685gh8j968.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\TQ5.tmp
规则: [文件]*

2010-3-13 21:01:45    创建文件    允许
进程: c:\documents and settings\owner\local settings\temp\250685gh8j968.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\BFGJy.DRV
规则: [文件组]所有执行文件 -> [文件]*; *.drv

2010-3-13 21:01:48    创建文件    允许
进程: c:\documents and settings\owner\local settings\temp\250685gh8j968.exe
目标: C:\WINDOWS\system\BFGJy.DRV
规则: [文件组]系统执行文件 -> [文件]c:\windows\*; *.drv

2010-3-13 21:01:50    创建文件    允许
进程: c:\documents and settings\owner\local settings\temp\250685gh8j968.exe
目标: C:\WINDOWS\system32\dsound.dll.mod
规则: [文件组]特殊目录 -> [文件]c:\windows\system32

2010-3-13 21:02:02    修改文件    允许
进程: c:\documents and settings\owner\local settings\temp\250685gh8j968.exe
目标: C:\WINDOWS\system32\dsound.dll.mod
规则: [文件组]特殊目录 -> [文件]c:\windows\system32

2010-3-13 21:02:09    修改文件    阻止
进程: c:\documents and settings\owner\local settings\temp\250685gh8j968.exe
目标: C:\WINDOWS\system32\dsound.dll
规则: [文件组]特殊目录 -> [文件]c:\windows\system32

dreams521

开始在“C:\Documents and Settings\Administrator\桌面\virus.rar”中扫描
C:\Documents and Settings\Administrator\桌面\virus.rar
  [0] 存档类型: RAR
    --> virus.exe
      [检测]        包含可疑代码 HEUR/Malware