jotti上只有avast一家独报 MD5: 91C963

ay24

某下载者生了接近200个东东，只传一个上来玩，然后出去吃东西了。

A-Squared	Found nothing
AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found Win32:BHO-EK
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

[ 本帖最后由 ay24 于 2007-6-24 01:22 编辑 ]

mofunzone

上报完毕。。

1688388728

病毒: Win32:BHO-EK [Trj]
檔案: bindc.exe
目錄: E:\病毒库\bindc

欠妳緈諨

AVAST独报的 少见

mofunzone

推荐你去castlecops listserv看一下，看过之后，总会感慨这个世界上病毒之强大呀。。
自己google就可以了，第一项就是

Whkroran

上报

taihuxian

Virus check with AntiVirusKit
Version 17.0.7089
Virus signatures of 6/23/2007
Start time: 6/24/2007 06:31
Engine(s): Engine A (AVK 17.5601), Engine B (AVKB 17.272)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Check directory C:\Documents and Settings\Administrator\桌面\bindc
Object: ml.dll
        In archive: C:\Documents and Settings\Administrator\桌面\bindc\bindc.exe
        Status: Virus detected
        Virus: Win32:BHO-EK [Trj] (Engine B)
Object: bindc.exe
        Path: C:\Documents and Settings\Administrator\桌面\bindc
        Status: Move file into quarantine
        Virus: Win32:BHO-EK [Trj] (Engine B)
Analysis complete: 6/24/2007 06:31
    1 files checked
    1 infected files detected
    0 suspected files detected

wangjay1980

detected: Trojan program Trojan.Win32.BHO.bh        URL: http://bbs.kafan.cn/attachment.p ... xe//data.rar//1.exe

allenhippo

g:\virus\sample\bindc.exe:\1.exe - Signatur 'Win32.SuspectCrc' gefunden
g:\virus\sample\bindc.exe:\ml.dll
g:\virus\sample\bindc.exe

        3 Dateien 黚erpr黤t
          (1 Archiv mit 2 Dateien)
        1 Signatur gefunden
        0 bedenkliche Programmsequenzen gefunden
        Ben鰐igte Zeit: 0:00.172

某人回来了

a256886572008

運行1.exe，發現下列行為，被EQ-Secure RC2攔截！

2007-06-24 08:54:02    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\bindc\bindc\1.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-24 08:54:02    创建文件      操作:阻止
进程路径:D:\桌面\virus\bindc\bindc\1.exe
文件路径:C:\windows\system32\msnetres.dll
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll


2007-06-24 08:54:02    创建文件      操作:阻止
进程路径:D:\桌面\virus\bindc\bindc\1.exe
文件路径:C:\windows\system32\msnetres.dll
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll


2007-06-24 08:54:02    创建文件      操作:阻止
进程路径:D:\桌面\virus\bindc\bindc\1.exe
文件路径:C:\windows\system32\msnetres.dll
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll


2007-06-24 08:54:03    运行应用程序      操作:阻止
进程路径:D:\桌面\virus\bindc\bindc\1.exe
文件路径:C:\windows\system32\regsvr32.exe
命令行:/s D:\桌面\virus\bindc\bindc\ml.dll
规则:黑名单->防卸规则->*\regsvr32.exe

1.他會在C:\windows\system32\生成
   msnetres.dll
2.他會運行regsvr32.exe
   /s D:\桌面\virus\bindc\bindc\ml.dll