很奇怪但是比较厉害的病毒，顺便求解决方法

Nortant

ppy0606 发表于 2011-9-10 13:19
MD

一种HIPS

受教了，多谢指点！

ningz

不起眼的这个

yusup

fS杀鸟。

louis00

ESET NOD32 Antivirus
        侦测到安全威胁 ！

详细信息:         
网页:        http://bbs.kafan.cn/forum.php?mo ... DQyNTY4NHwxMDYxODE0
安全威胁：        Win32/Agent.SZI 特洛伊木马
注释:        此网页的访问已被ESET NOD32 Antivirus拦截

愛酷￠魚

好奇进来看看情况...

渲染离别

ppy0606 发表于 2011-8-21 11:09
这个 看样子是感染的

不过我实机 不好全盘允许

啊哈哈啊哈哈哈，报应啊！PPY

港岛妹妹

2011/11/18 20:42:59        HTTP 过滤器        文件        hp://bbs.kafan.cn/forum.php?mod=attachment&aid=MTM0MTcyNHxlOWY0YzU3MXwxMzIxNjIwMjM5fDYyNjE4MnwxMDYxODE0        Win32/Agent.SZI 特洛伊木马        连接中断 - 已隔离        GOV\Administrator        通过应用程序访问 web 时检测到威胁

gerald2008

建了不少文件啊

gikouhaku

还是不敢试了

天道酬勤QQ

Name Value
Size 188416
MD5 f3f047a354cd668561ca4cb2c4375ddf
SHA1 47e7cc65350e9f772df3e21ad58037cdbc71e603
SHA256 b0d36f2e6c225da720f3f8b00478524a5e75b06f1fbfa518eb5b78655522457d
Process Exited

• Keys Created
Name Last Write Time
LM\System\CurrentControlSet\Services\30a69241 2009.01.09 10:54:27.093

• Keys Changed
• Keys Deleted
• Values Created
Name Type Size Value
LM\System\CurrentControlSet\Services\30a69241\ImagePath REG_SZ 76 "\systemroot\1100129840:3478744510.exe"
LM\System\CurrentControlSet\Services\30a69241\Start REG_DWORD 4 0x3
LM\System\CurrentControlSet\Services\30a69241\Type REG_DWORD 4 0x1

• Values Changed
• Values Deleted
• Directories Created
Name Last Write Time Creation Time Last Access Time Attr
C:\WINDOWS\$NtUninstallKB23832$ 2008.08.01 08:02:28.671 2008.08.01 07:53:52.859 2008.08.01 06:19:35.703 0xc16

• Directories Changed
• Directories Deleted
• Files Created
Name Size Last Write Time Creation Time Last Access Time Attr
C:\WINDOWS\1100129840 0 2009.01.09 10:54:27.093 2009.01.09 10:54:27.078 2009.01.09 10:54:27.078 0x20

• Files Changed
• Files Deleted
Name Size Last Write Time Creation Time Last Access Time Attr
C:\TEST\sample.exe 188416 2009.01.09 10:54:20.671 2009.01.09 10:53:58.578 2009.01.09 10:53:58.578 0x20

• Directories Hidden
Name Last Write Time Creation Time Last Access Time Attr
C:\WINDOWS\$NtUninstallKB23832$\816222785 2009.01.09 10:54:27.250 2009.01.09 10:54:26.562 2009.01.09 10:54:27.250 0x816

• Files Hidden
Name Size Last Write Time Creation Time Last Access Time Attr
C:\WINDOWS\$NtUninstallKB23832$\1658420222 0 2009.01.09 10:54:26.562 2009.01.09 10:54:26.562 2009.01.09 10:54:26.562 0xc20

• Drivers Loaded
• Drivers Unloaded
• Processes Created
PId Process Name Image Name
0xfc 1100129840:3478744510.exe C:\WINDOWS\1100129840:3478744510.exe

• Processes Terminated
• Threads Created
PId Process Name TId Start Start Mem Win32 Start Win32 Start Mem
0x4 System 0xf0 0xf8a23105 MEM_FREE 0x0 MEM_FREE
0x4 System 0xf4 0xf8a23105 MEM_FREE 0x0 MEM_FREE
0xfc 1100129840:3478744510.exe 0x100 0x7c810867 MEM_IMAGE 0x400210 MEM_IMAGE
0x2a4 services.exe 0xf8 0x6d132c MEM_MAPPED 0x0 MEM_FREE
0x348 svchost.exe 0x784 0x7c810856 MEM_IMAGE 0x7c910760 MEM_IMAGE

• Modules Loaded
PId Process Name Base Size Flags Image Name
0x2a4 services.exe 0x6d0000 0x5000 0x802c4004 C:\WINDOWS\system32\CRYPTUI.dll

• Windows Api Calls
• DNS Queries
• HTTP Queries
HTTP Query Text
rjrkddjr.cn GET /stat2.php?w=134&i=ffc09248e0ac92485b5b3233c2d5fb3e&a=1 HTTP/1.1
rjrkddjr.cn GET /stat2.php?w=134&i=ffc09248e0ac92485b5b3233c2d5fb3e&a=21 HTTP/1.1
rjrkddjr.cn GET /stat2.php?w=134&i=ffc09248e0ac92485b5b3233c2d5fb3e&a=4 HTTP/1.1
rjrkddjr.cn GET /stat2.php?w=134&i=ffc09248e0ac92485b5b3233c2d5fb3e&a=5 HTTP/1.1
rjrkddjr.cn GET /stat2.php?w=134&i=ffc09248e0ac92485b5b3233c2d5fb3e&a=6 HTTP/1.1
rjrkddjr.cn GET /stat2.php?w=134&i=ffc09248e0ac92485b5b3233c2d5fb3e&a=7 HTTP/1.1
rjrkddjr.cn GET /stat2.php?w=134&i=ffc09248e0ac92485b5b3233c2d5fb3e&a=8 HTTP/1.1
rjrkddjr.cn GET /stat2.php?w=134&i=ffc09248e0ac92485b5b3233c2d5fb3e&a=23 HTTP/1.1
rjrkddjr.cn GET /stat2.php?w=134&i=ffc09248e0ac92485b5b3233c2d5fb3e&a=24 HTTP/1.1
rjrkddjr.cn GET /stat2.php?w=134&i=ffc09248e0ac92485b5b3233c2d5fb3e&a=25 HTTP/1.1
rjrkddjr.cn GET /stat2.php?w=134&i=ffc09248e0ac92485b5b3233c2d5fb3e&a=26 HTTP/1.1
rjrkddjr.cn GET /stat2.php?w=134&i=ffc09248e0ac92485b5b3233c2d5fb3e&a=27 HTTP/1.1
rjrkddjr.cn GET /stat2.php?w=134&i=ffc09248e0ac92485b5b3233c2d5fb3e&a=11 HTTP/1.1
rjrkddjr.cn GET /bad.php?w=134&fail=0&i=ffc09248e0ac92485b5b3233c2d5fb3e HTTP/1.0

• Verdict
Auto Analysis Verdict
Suspicious++

• Description
Suspicious Actions Detected
Creates files in windows system directory
Creates system services or drivers
Deletes self
Hides files from user