mon.exe[md5:55121]

mofunzone

只发最新，3小时前收到的，我的样本质量好，挂的多呀。。
File:           mon.exe
Status:        
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5:         551212ea95747f9f1479fe39e5fbe12d
Packers detected:        
PE_PATCH.PECOMPACT, PE_PATCH.UPOLYX, PE_PATCH.UPX, UPX
Bit9 reports:         File not found
Scanner results
Scan taken on 23 Jun 2007 18:09:17 (GMT)
A-Squared        
Found nothing
AntiVir        
Found DR/Dldr.Agent.bls.60
ArcaVir        
Found nothing
Avast        
Found nothing
AVG Antivirus        
Found nothing
BitDefender        
Found nothing
ClamAV        
Found nothing
Dr.Web        
Found nothing
F-Prot Antivirus        
Found nothing
F-Secure Anti-Virus        
Found Trojan-Downloader.Win32.Agent.bls
Fortinet        
Found nothing
Kaspersky Anti-Virus        
Found Trojan.Win32.Agent.apt, Trojan-Downloader.Win32.Agent.bls
NOD32        
Found nothing
Norman Virus Control        
Found nothing
Panda Antivirus        
Found nothing
Rising Antivirus        
Found nothing
VirusBuster        
Found nothing
VBA32        
Found Trojan-Downloader.Win32.Agent.bls

1688388728

病毒: Trojan.Win32.Agent.apt, Trojan-Downloader.Win32.Agent.bls
檔案: mon[1].rar
目錄: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\QH0FSTAQ
處理序: GreenBrowser.exe

Whkroran

deleted: Trojan program Trojan.Win32.Agent.apt        File: E:\Virus sample\mon.rar/mon.exe//data0002//PE_Patch.PECompact
deleted: Trojan program Trojan-Downloader.Win32.Agent.bls        File: E:\Virus sample\mon.rar/mon.exe//data0003//PE_Patch.Upolyx//PE_Patch.UPX//UPX

taihuxian

Virus: Trojan.Win32.Agent.apt, Trojan-Downloader.Win32.Agent.bls

Virus found while downloading Web content.

Address: bbs.kafan.cn

Nblock

Micropoint

1p1

坚决支持样本好的帖子

一派胡言

kv2007飘。

a256886572008

運行mon.exe，發現下列行為，被EQ-Secure RC2攔截！

2007-06-24 10:59:00    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\mon\mon.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-24 10:59:00    创建文件      操作:阻止
进程路径:D:\桌面\virus\mon\mon.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp\first.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-24 10:59:00    创建文件      操作:阻止
进程路径:D:\桌面\virus\mon\mon.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp\second.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-24 10:59:00    修改文件      操作:阻止
进程路径:D:\桌面\virus\mon\mon.exe
文件路径:C:\Documents and Settings
规则:所有程序规则->2.1.3组：保護部分重要的文件和文件夾->%SystemDrive%\*


2007-06-24 10:59:00    修改文件      操作:阻止
进程路径:D:\桌面\virus\mon\mon.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung
规则:所有程序规则->2.1.3组：保護部分重要的文件和文件夾->%SystemDrive%\*


2007-06-24 10:59:00    修改文件      操作:阻止
进程路径:D:\桌面\virus\mon\mon.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Local Settings
规则:所有程序规则->2.1.3组：保護部分重要的文件和文件夾->%SystemDrive%\*


2007-06-24 10:59:00    修改文件      操作:阻止
进程路径:D:\桌面\virus\mon\mon.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp
规则:所有程序规则->2.1.3组：保護部分重要的文件和文件夾->%SystemDrive%\*

1.他會在C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp\生成
   second.exe
2.他會修改C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp

promised

广告

红心王子

原帖由 一派胡言 于 2007-6-24 09:38 发表
kv2007飘。

运行以后，斧头监控干掉
不是广告