毒网区10-03-25

jason_jiang

http://bbs.kafan.cn/thread-668677-1-1.html
1x to panda

dreams521

手太快了
开始在“C:\Documents and Settings\Administrator\桌面\4x.rar”中扫描
C:\Documents and Settings\Administrator\桌面\4x.rar
  [0] 存档类型: RAR
    --> 1.exe
      [检测]        是 TR/Hijacker.Gen 特洛伊木马
    --> oc.exe
      [检测]        是 TR/Crypt.XPACK.Gen 特洛伊木马
    --> sb.exe
      [检测]        包含 BDS/Hupigon.Gen 后门程序的识别模式(有害)
    --> time.exe
      [1] 存档类型: RSRC
      [检测]        是 TR/Spy.Gen 特洛伊木马

XE-cj

解压后微点报了2个



oc.exe
2010-3-25 18:13:05    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\owner\my documents\oc.exe
命令行: "C:\Documents and Settings\Owner\My Documents\oc.exe"
规则: [应用程序]*

2010-3-25 18:13:07    设置文件隐藏属性    阻止
进程: c:\documents and settings\owner\my documents\oc.exe
目标: C:\Documents and Settings\Owner\My Documents\oc.exe
规则: [文件组]临时目录 -> [文件]c:\documents and settings\owner\my documents

2010-3-25 18:13:21    创建文件    允许
进程: c:\documents and settings\owner\my documents\oc.exe
目标: C:\WINDOWS\system32\winnec.ime
规则: [文件组]特殊目录 -> [文件]c:\windows\system32

2010-3-25 18:13:25    创建注册表项    阻止
进程: c:\documents and settings\owner\my documents\oc.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\E0210804
规则: [注册表组]系统设置 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\*

2010-3-25 18:13:29    创建注册表项    阻止
进程: c:\documents and settings\owner\my documents\oc.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\E0210804
规则: [注册表组]系统设置 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\*

2010-3-25 18:13:33    设置文件隐藏属性    阻止
进程: c:\documents and settings\owner\my documents\oc.exe
目标: C:\WINDOWS\system32\winnec.ime
规则: [文件组]特殊目录 -> [文件]c:\windows\system32




1.exe
2010-3-25 18:16:32    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\owner\my documents\1.exe
命令行: "C:\Documents and Settings\Owner\My Documents\1.exe"
规则: [应用程序]*

2010-3-25 18:16:34    创建新进程    允许
进程: c:\documents and settings\owner\my documents\1.exe
目标: c:\program files\internet explorer\iexplore.exe
命令行: "C:\program files\internet explorer\IEXPLORE.EXE"
规则: [应用程序]*

2010-3-25 18:16:39    修改其他进程的内存    阻止
进程: c:\documents and settings\owner\my documents\1.exe
目标: c:\program files\internet explorer\iexplore.exe
规则: [应用程序]*

2010-3-25 18:16:40    结束其他进程    允许
进程: c:\documents and settings\owner\my documents\1.exe
目标: c:\program files\internet explorer\iexplore.exe
规则: [应用程序]*

2010-3-25 18:16:43    创建新进程    阻止
进程: c:\documents and settings\owner\my documents\1.exe
目标: c:\windows\system32\cmd.exe
命令行: cmd /c erase /F "C:\Documents and Settings\Owner\My Documents\1.exe"
规则: [应用程序]*

ablhr

avast清空

qianyuqx

1x to 360

ray1106

miss 1



C:\Sandbox\4x\1.exe         detected: Trojan-Dropper.Delf!IK
C:\Sandbox\4x\sb.exe         detected: Backdoor.Win32.Hupigon!IK
C:\Sandbox\4x\time.exe         detected: Trojan-Dropper.Win32.Jadtre!IK

fatezero

oc.exe - Trojan-Downloader.Win32.Geral.qnz

New malicious software was found in this file. The next antivirus database update will include detection for this malware. Thank you for your help.

juhone

wd就灭了

jayavira

ess kill2个

http://bbs.kafan.cn/attachment.p ... WpoQkNjc2t4bDUrV1k=        多个威胁        连接中断 - 已隔离        通过应用程序访问 web 时检测到威胁: E:\谷歌浏览器\CHROME.EXE.
http://bbs.kafan.cn/attachment.p ... WpoQkNjc2t4bDUrV1k= > RAR > 1.exe        可能是 Win32/Injector.ATX 特洛伊木马 的变种               
http://bbs.kafan.cn/attachment.p ... WpoQkNjc2t4bDUrV1k= > RAR > time.exe        Win32/KillAV.NHP 特洛伊木马