123[MD5:c1318ca]

显示全部楼层 · 发表于 2007-7-10 09:22:21

YIGE

显示全部楼层 · 发表于 2007-7-10 09:23:23

c:\ABC\123.zip:\123.exe - Signature 'Trojan.Delf.NEB' found
c:\ABC\123.zip

显示全部楼层 · 发表于 2007-7-10 09:23:47

Scan performed at: 2007-7-10 9:23:29
Scanning Log
NOD32 version 2388 (20070710) NT
Command line: C:\Documents and Settings\EQ2\桌面\123.zip
Operating memory - is OK

Date: 10.7.2007 Time: 09:23:35
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\123.zip
C:\Documents and Settings\EQ2\桌面\123.zip ?ZIP ?123.exe - probably a variant of Win32/Genetik trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 09:23:35 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-7-10 09:26:52

江民飘飘。[:26:]

显示全部楼层 · 发表于 2007-7-10 09:27:20

Starting the file scan:

Begin scan in 'F:\病毒样本\123.zip'
F:\病毒样本\123.zip
  [0] Archive type: ZIP
  --> 123.exe
   [DETECTION] Contains signature of the dropper DR/Delphi.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-10 10:30:25

盗QQ的

显示全部楼层 · 发表于 2007-7-10 11:10:38

運行123.exe，發現下列行為，被EQ-Secure RC4攔截！

2007-07-10 11:07:16 创建文件    操作:允许
进程路径:D:\桌面\virus\123\123.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Internet Explorer
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-10 11:07:16 创建文件    操作:允许
进程路径:D:\桌面\virus\123\123.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\Program Files
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-10 11:07:16 创建文件    操作:允许
进程路径:D:\桌面\virus\123\123.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-10 11:07:16 创建文件    操作:允许
进程路径:D:\桌面\virus\123\123.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-10 11:07:16 创建文件    操作:允许
进程路径:D:\桌面\virus\123\123.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-10 11:07:16 创建文件    操作:允许
进程路径:D:\桌面\virus\123\123.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\Program Files
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-10 11:07:16 修改文件    操作:允许
进程路径:D:\桌面\virus\123\123.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\Program Files
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-10 11:07:16 创建文件    操作:允许
进程路径:D:\桌面\virus\123\123.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Internet Explorer
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-10 11:07:16 修改文件    操作:允许
进程路径:D:\桌面\virus\123\123.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Internet Explorer
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-10 11:07:16 创建文件    操作:允许
进程路径:D:\桌面\virus\123\123.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Internet Explorer\InfoMs.sys
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-10 11:07:16 创建文件    操作:允许
进程路径:D:\桌面\virus\123\123.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Internet Explorer\InfoMs.tdm
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

1.他會在C:\Program Files\Internet Explorer\生成
InfoMs.sys
InfoMs.tdm

显示全部楼层 · 发表于 2007-7-10 11:45:47

病毒: Trojan-Spy.Win32.Delf.ps
文件: 123[1].zip
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ODE3GLQZ
进程: GreenBrowser.exe

显示全部楼层 · 发表于 2007-7-10 12:25:14

[Scan path] C:\Documents and Settings\Administrator\桌面\123.zip
>>>>C:\Documents and Settings\Administrator\桌面\123.zip\123.exe infected with Trojan.PWS.Qqshou.origin
C:\Documents and Settings\Administrator\桌面\123.zip - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 3
Infected objects found: 1
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 37 Kb/s
Scan time: 00:00:00

显示全部楼层 · 发表于 2007-7-10 12:32:35

nis2007报

[病毒样本] 123[MD5:c1318ca]

本帖子中包含更多资源

本帖子中包含更多资源