盛大样本[MD5: BC4B43 9E5CFD F4A68C 01E4BE D60FA9 F1EC5B 36D88A]

a256886572008

運行zt[1].exe，發現下列行為，被EQ-Secure RC2攔截！

2007-06-24 11:29:40    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\BC4B43virus\zt[1].exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-24 11:29:42    创建文件      操作:阻止
进程路径:D:\桌面\virus\BC4B43virus\zt[1].exe
文件路径:C:\windows\upxdnd.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-24 11:29:42    创建文件      操作:阻止
进程路径:D:\桌面\virus\BC4B43virus\zt[1].exe
文件路径:C:\windows\upxdnd.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-24 11:29:42    创建文件      操作:阻止
进程路径:D:\桌面\virus\BC4B43virus\zt[1].exe
文件路径:C:\windows\upxdnd.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-24 11:29:42    创建文件      操作:阻止
进程路径:D:\桌面\virus\BC4B43virus\zt[1].exe
文件路径:C:\windows\eadook.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-24 11:29:42    创建文件      操作:阻止
进程路径:D:\桌面\virus\BC4B43virus\zt[1].exe
文件路径:C:\windows\eadook.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-24 11:29:42    创建文件      操作:阻止
进程路径:D:\桌面\virus\BC4B43virus\zt[1].exe
文件路径:C:\windows\eadook.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-24 11:29:42    创建文件      操作:阻止
进程路径:D:\桌面\virus\BC4B43virus\zt[1].exe
文件路径:C:\windows\system32\upxdnd.dll
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll


2007-06-24 11:29:42    创建文件      操作:阻止
进程路径:D:\桌面\virus\BC4B43virus\zt[1].exe
文件路径:C:\windows\system32\ewsbmg.dll
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll

1.他會在C:\windows\生成
   upxdnd.exe
   eadook.exe
2.他會在C:\windows\system32\生成
   upxdnd.dll
   ewsbmg.dll

a256886572008

運行zx[1].exe，發現下列行為，被EQ-Secure RC2攔截！

2007-06-24 11:32:05    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\BC4B43virus\zx[1].exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-24 11:32:05    创建文件      操作:阻止
进程路径:D:\桌面\virus\BC4B43virus\zx[1].exe
文件路径:C:\windows\system32\rtmp.dll
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll

1.他會在C:\windows\system32\生成
   rtmp.dll

Giggs

盗号的木马..盛大啊盛大

欠妳緈諨

AVAST干掉6个

taihuxian

Virus: Trojan-PSW.Win32.QQRob.fu, Trojan-PSW.Win32.OnLineGames.yn, Trojan-PSW.Win32.OnLineGames.yq, Trojan-PSW.Win32.OnLineGames.es

Virus found while downloading Web content.

Address: bbs.kafan.cn

yashoo

3个

[ 本帖最后由 yashoo 于 2007-6-24 12:31 编辑 ]

promised

Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\virus.rar:<RAR>\ddx[1].exe : infected BackDoor.Rpcs
C:\ABC\virus.rar:<RAR>\jh[1].exe : infected MalwareScope.Trojan-PSW.Game.3
C:\ABC\...\my[1].exe : is suspected of Trojan-PSW.Game.26 (paranoid heuristics)
C:\ABC\virus.rar:<RAR>\wow[1].exe : infected MalwareScope.Trojan-PSW.Game.3
C:\ABC\virus.rar:<RAR>\zt[1].exe : infected MalwareScope.Trojan-PSW.Game.3
Program execution terminated by user


Directories       : 3       Files in archives:      Files on disks:
Archives:                   - total       : 7       - total       : 22
- scanned         : 1       -  scanned    : 7       - scanned     : 21
- contain viruses : 1       -  infected   : 4       - infected    : 1
- deleted         : 0       -  suspicious : 1       - suspicious  : 0

Startup    : 12:35:27 24-06-2007
End        : 12:35:32 24-06-2007
Total time : 00:00:05
终止批处理操作吗(Y/N)?

1688388728

病毒: Win32:Trojan-gen. {Other}
檔案: virus[1].rar
目錄: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MHBENDU2
處理序: GreenBrowser.exe

红心王子

斧头监控拦截四个

woai_jolin

2007/6/24 13:58:38        eAmon        file        D:\VIRUS\硬盘终结者\ZT[1].EXE        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.
2007/6/24 13:58:36        eAmon        file        D:\virus\硬盘终结者\wow[1].exe        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/24 13:58:35        eAmon        file        D:\VIRUS\硬盘终结者\MH[1].EXE        a variant of Win32/Agent.NIK trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.
2007/6/24 13:58:33        eAmon        file        D:\VIRUS\硬盘终结者\JH[1].EXE        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.
2007/6/24 13:58:31        eAmon        file        D:\VIRUS\硬盘终结者\DDX[1].EXE        a variant of Win32/PSW.QQRob.NAQ trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.