好像有问题【50ec45】

欠妳緈諨

AVAST查不到！

The EQs

Scan performed at: 2007-7-5 9:11:40
Scanning Log
NOD32 version 2379 (20070704) NT
Command line: C:\Documents and Settings\EQ2\桌面\mapi.rar
Operating memory - is OK

Date: 5.7.2007  Time: 09:11:46
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\mapi.rar
C:\Documents and Settings\EQ2\桌面\mapi.rar ?RAR ?mapi.exe - probably unknown NewHeur_PE virus [7]
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 09:11:46 Total scanning time: 0 sec (00:00:00)

Notes:
[7] File is probably infected with an unknown virus.

a256886572008

運行mapi.exe，發現下列行為，被EQ-Secure RC3攔截！

2007-07-05 09:14:01    創建文件      操作:允許
進程路徑:D:\桌面\virus\mapi\mapi.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:14:01    創建文件      操作:允許
進程路徑:D:\桌面\virus\mapi\mapi.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:14:01    創建文件      操作:允許
進程路徑:D:\桌面\virus\mapi\mapi.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:14:01    創建文件      操作:允許
進程路徑:D:\桌面\virus\mapi\mapi.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:14:01    創建文件      操作:允許
進程路徑:D:\桌面\virus\mapi\mapi.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:14:01    修改文件      操作:允許
進程路徑:D:\桌面\virus\mapi\mapi.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:14:01    創建文件      操作:允許
進程路徑:D:\桌面\virus\mapi\mapi.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:14:01    修改文件      操作:允許
進程路徑:D:\桌面\virus\mapi\mapi.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:14:01    創建文件      操作:允許
進程路徑:D:\桌面\virus\mapi\mapi.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:14:01    創建文件      操作:允許
進程路徑:D:\桌面\virus\mapi\mapi.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp\~DF4D34.tmp
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

1.他會在C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp\生成
   ~DF4D34.tmp

promised

C:\ABC\mapi.rar:\mapi.exe - Signature 'Backdoor.Win32.Rbot.bpb' found
C:\ABC\mapi.rar

        2 Files scanned
          (1 Archiv with 1 file)
        1 Signature found
        0 Suspect code-parts found
        Used time: 0:00.000

zane_xzz

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\mapi.rar'
C:\Documents and Settings\Administrator\桌面\mapi.rar
  [0] Archive type: RAR
  --> mapi.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING]   The file was ignored!

啊弥陀佛

貌似少了一个文件

yym1988520

NIS  TR PACKED 16   

foxhound

Jotti上4家报~ NOD32启发~~~~~

A-Squared	Found nothing
AntiVir	Found HEUR/Crypted
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found Trojan.VB.NHV
ClamAV	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found W32/AgoBot.U!worm
Kaspersky Anti-Virus	Found nothing
NOD32	Found probably unknown NewHeur_PE (probable variant)
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

[ 本帖最后由 foxhound 于 2007-7-5 09:45 编辑 ]

wangjay1980

Hello,

mapi.exe_ - Trojan.Win32.VB.bcf

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Dmitry Shvetsov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: mapi.zip

卡江东N