zx.exe [md5:9e86e]

显示全部楼层 · 发表于 2007-6-27 13:51:07

想看kav7行不行
File: zx.exe
Status:
INFECTED/MALWARE
MD5: 9e86ee5a48d8255abf7b3a44de1960cf
Packers detected:
NSPACK
Bit9 reports: File not found
Scanner results
Scan taken on 27 Jun 2007 05:54:17 (GMT)
A-Squared
Found nothing
AntiVir
Found HEUR/Crypted
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found Generic.Malware.SFdldg.85C07857
ClamAV
Found nothing
Dr.Web
Found MULDROP.Trojan (probable variant)
F-Prot Antivirus
Found Possibly a new variant of W32/PWStealer1!Generic
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found probably unknown NewHeur_PE (probable variant)
Norman Virus Control
Found Sandbox: W32/Malware; [ General information ]

* Accesses executable file from resource section.
* File length: 36904 bytes.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM32\wl.exe.
* Creates file C:\WINDOWS\SYSTEM32\wl.dll.

[ Changes to registry ]
* Creates key "HKLM\System\CurrentControlSet\Services\wlsystem".
* Sets value "ImagePath"="wl" in key "HKLM\System\CurrentControlSet\Services\wlsystem".
* Sets value "DisplayName"="wl network" in key "HKLM\System\CurrentControlSet\Services\wlsystem".

[ Process/window information ]
* Creates service "wlsystem (wl network)" as "wl".
* Enumerates running processes.
* Modifies other process memory.
* Creates a remote thread.
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
VirusBuster
Found Packed/NSPack
VBA32
Found MalwareScope.Trojan-PSW.Game.7

显示全部楼层 · 发表于 2007-6-27 13:52:07

C:/ABC/\zx.rar:\zx.exe - Signature 'Backdoor.Win32.PcClient.GV' found
C:/ABC/\zx.rar

      2 Files scanned
      (1 Archiv with 1 file)
      1 Signature found
      0 Suspect code-parts found
      Used time: 0:00.000

显示全部楼层 · 发表于 2007-6-27 13:53:06

咖啡报了

显示全部楼层 · 发表于 2007-6-27 14:09:17

avast pass

dr.web ：Trojan.Downloader.origin

卡巴斯基6.0：pass

显示全部楼层 · 发表于 2007-6-27 14:20:41

運行zx.exe，發現下列行為，被EQ-Secure RC3攔截！

2007-06-27 14:22:06 運行應用程序    操作:允許
進程路徑:C:\windows\Explorer.EXE
文件路徑:D:\桌面\virus\zx\zx.exe
規則:應用程序規則->系統程序->%windir%\Explorer.EXE

2007-06-27 14:22:07 修改注冊表內容    操作:阻止
進程路徑:C:\windows\system32\services.exe
注冊表路徑:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wlsystem
注冊表名稱:[Key]
規則:所有程序規則->服務_普通模式->HKEY_LOCAL_MACHINE\SYSTEM\*controlset*\Services\*

2007-06-27 14:22:10 創建文件    操作:阻止
進程路徑:D:\桌面\virus\zx\zx.exe
文件路徑:C:\windows\system32\wl.exe
規則:所有程序規則->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe

2007-06-27 14:22:10 創建文件    操作:阻止
進程路徑:D:\桌面\virus\zx\zx.exe
文件路徑:C:\windows\system32\wl.exe
規則:所有程序規則->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe

2007-06-27 14:22:10 創建文件    操作:阻止
進程路徑:D:\桌面\virus\zx\zx.exe
文件路徑:C:\windows\system32\wl.exe
規則:所有程序規則->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe

2007-06-27 14:22:10 創建文件    操作:阻止
進程路徑:D:\桌面\virus\zx\zx.exe
文件路徑:C:\windows\system32\wl.dll
規則:所有程序規則->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll

2007-06-27 14:22:10 修改其它進程內存    操作:阻止
進程路徑:D:\桌面\virus\zx\zx.exe
目標進程:C:\windows\Explorer.EXE
規則:所有程序規則->系統程序->%windir%\explorer.exe

1.他會利用services.exe修改注冊表內容
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wlsystem
[Key]
2.他會在C:\windows\system32\生成
wl.exe
3.他會在C:\windows\system32\生成
wl.dll
4.他會修改Explorer.EXE的進程內存

显示全部楼层 · 发表于 2007-6-27 14:23:14

MS 上面的M版说过了，呵呵

[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM32\wl.exe.
* Creates file C:\WINDOWS\SYSTEM32\wl.dll.

[ Changes to registry ]
* Creates key "HKLM\System\CurrentControlSet\Services\wlsystem".
* Sets value "ImagePath"="wl" in key "HKLM\System\CurrentControlSet\Services\wlsystem".
* Sets value "DisplayName"="wl network" in key "HKLM\System\CurrentControlSet\Services\wlsystem".

[ Process/window information ]
* Creates service "wlsystem (wl network)" as "wl".
* Enumerates running processes.
* Modifies other process memory.
* Creates a remote thread.

显示全部楼层 · 发表于 2007-6-27 14:24:59

蜘蛛报

显示全部楼层 · 发表于 2007-6-27 14:26:54

显示全部楼层 · 发表于 2007-6-27 14:47:58

Kaspersky Internet Security 7.0
The requested URL http://uni.kafan.cn/bbs/attachment.php?aid=93632 is infected with Trojan.Generic virus

显示全部楼层 · 发表于 2007-6-27 18:17:54

Hello,
zx.exed - Trojan-Downloader.Win32.Agent.bwh
New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.
Please quote all when answering.
--

Best regards, Denis Maslennikov

Virus analyst, Kaspersky Lab.

e-mail: newvirus@kaspersky.com

http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.

http://www.kaspersky.com/helpdesk.html - technical support.

[病毒样本] zx.exe [md5:9e86e]

本帖子中包含更多资源

回复 #5 a256886572008 的帖子

本帖子中包含更多资源