【14be84】AVAST报壳

欠妳緈諨

promised

?         Copyright (c) 1993-2007 by VBA Ltd.           ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯图
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\...\setup.exe : is suspected of Malware.Agent.42 (paranoid heuristics)
Program execution terminated by user


Directories       : 3       Files in archives:      Files on disks:
Archives:                   - total       : 1       - total       : 19
- scanned         : 1       -  scanned    : 1       - scanned     : 19
- contain viruses : 0       -  infected   : 0       - infected    : 0
- deleted         : 0       -  suspicious : 1       - suspicious  : 1

Startup    : 19:41:51 23-06-2007
End        : 19:42:00 23-06-2007
Total time : 00:00:09
终止批处理操作吗(Y/N)?

风野胤

nod这个扫描时间应该可以告诉我们
它脱壳了

Scanning Log
NOD32 version 2348 (20070623) NT
Command line: C:\Documents and Settings\Administrator\ ?
?桌面\setup.rar
Checking CRC of NOD32.EXE: Status OK
Scanning memory: Not performed (option disabled)
Error occurred while scanning MBR sector of the 2.  ?
?physical disk. Error reading sector.
Error occurred while scanning MBR sector of the 3.  ?
?physical disk. Error reading sector.
Date: 23.6.2007  Time: 19:40:54
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and  ?
?Settings\Administrator\桌面\setup.rar
C:\Documents and Settings\Administrator\桌面\setup.rar  ?
??RAR ?setup.exe - probably unknown NewHeur_PE virus [7]
Number of scanned files: 2
Number of threats found: 1
Time of completion: 19:41:07 Total scanning time: 13 sec  ?
?(00:00:13)
Notes:
[7] File is probably infected with an unknown virus.

Whkroran

detected: Trojan program Trojan.Win32.Agent.zl        URL: http://bbs.kafan.cn/attachment.p ... atch.NSAnti//NSAnti

a256886572008

運行setup.exe，發現下列行為，被EQ-Secure RC2攔截！

2007-06-23 19:47:39    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\14be84setup\setup.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-23 19:47:39    修改文件      操作:阻止
进程路径:D:\桌面\virus\14be84setup\setup.exe
文件路径:C:\Program Files\Common Files
规则:所有程序规则->保護安全軟體->C:\Program Files\*


2007-06-23 19:47:40    运行应用程序      操作:允许(自动创建规则)
进程路径:D:\桌面\virus\14be84setup\setup.exe
文件路径:C:\windows\system32\net.exe
命令行:stop KWatchSvc


2007-06-23 19:47:43    运行应用程序      操作:允许(自动创建规则)
进程路径:D:\桌面\virus\14be84setup\setup.exe
文件路径:C:\windows\system32\sc.exe
命令行:stop KWatchSvc


2007-06-23 19:47:45    创建文件      操作:阻止
进程路径:D:\桌面\virus\14be84setup\setup.exe
文件路径:C:\Program Files\Common Files\VideoCap9.dll
规则:所有程序规则->保護安全軟體->C:\Program Files\*

1.他會運行net.exe
   stop KWatchSvc
2.他會運行sc.exe
   stop KWatchSvc
3.他會在C:\Program Files\Common Files\產生
   VideoCap9.dll

allenhippo

还有报灰鸽子的

g:\virus\sample\setup.rar:\setup.exe - Signatur 'Backdoor.Win32.Hupigon.RS' gefunden

小邪邪

咖啡报木马了

dyw1021

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\setup.rar'
C:\Documents and Settings\Administrator\桌面\setup.rar
  [0] Archive type: RAR
  --> setup.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSAnti.Gen
      [INFO]      The file was moved to '46f113b9.qua'!


End of the scan: 2007年6月23日  20:34
Used time: 00:02 min

The scan has been done completely.

      0 Scanning directories
      2 Files were scanned
      1 viruses and/or unwanted programs were found
      0 classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

hj5abc

原帖由 风野胤 于 2007-6-23 19:37 发表
nod这个扫描时间应该可以告诉我们
它脱壳了

Scanning Log
NOD32 version 2348 (20070623) NT
Command line: C:\Documents and Settings\Administrator\ ?
?桌面\setup.rar
Checking CRC of NOD32.EXE:  ...

有可能不是拖的..因为ms有一类动态启发如BD不一定需要拖.
晕.10s

Scanned disks, folders and files: F:\setup.rar
F:\setup.rar ?RAR ?setup.exe - probably unknown NewHeur_PE virus [7]

Time of completion: 20:50:53 Total scanning time: 10 sec (00:00:10)

1688388728

病毒: Trojan.Win32.Agent.zl
檔案: setup[1].rar
目錄: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MHBENDU2
處理序: GreenBrowser.exe