昨天的加强版,希望没让大家失望

显示全部楼层 · 发表于 2007-7-12 00:02:58

不要双击,发现昨天有人双击了,

显示全部楼层 · 发表于 2007-7-12 00:04:17

D:\Download\T3\Setup.rar:\Setup.exe - 特征码 'Backdoor.Win32.Delf.avc' 被侦测
D:\Download\T3\Setup.rar

2 个文件被扫描
(1 个压缩档和 1 个文件)
1 个病毒被侦测
0 个可疑代码段被侦测
耗时： 0:02.444

显示全部楼层 · 发表于 2007-7-12 00:04:59

睡觉去了

显示全部楼层 · 发表于 2007-7-12 00:06:06

AVK（BD）报了

显示全部楼层 · 发表于 2007-7-12 00:06:46

谢谢阿米

显示全部楼层 · 发表于 2007-7-12 00:13:58

運行Setup.exe，發現下列行為，被EQ-Secure RC4攔截！

2007-07-12 00:08:27 创建文件    操作:允许
进程路径:D:\桌面\virus\Setup\Setup.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\winlogo.exe
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-12 00:08:27 修改文件    操作:允许
进程路径:D:\桌面\virus\Setup\Setup.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\winlogo.exe
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-12 00:08:35 运行应用程序    操作:阻止
进程路径:D:\桌面\virus\Setup\Setup.exe
文件路径:C:\windows\system32\cmd.exe
命令行:/c del "D:\桌面\virus\Setup\Setup.exe"
触发规则:黑名单->防卸规则->*\cmd.exe

1.他會在C\windows\system32\生成並修改
winlogo.exe
2.他會運行C:\windows\system32\cmd.exe
/c del "D:\桌面\virus\Setup\Setup.exe"
--------------------------------
有用HIPS的，請幫忙測一下這隻毒，會動到RD嗎

我用最新的sandboxie，HIPS的RD好像無法偵測！

显示全部楼层 · 发表于 2007-7-12 00:23:15

[Scan path] D:\Z.Virus\Setup.rar
>>>D:\Z.Virus\Setup.rar\Setup.exe probably infected with DLOADER.Trojan
D:\Z.Virus\Setup.rar - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 3
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 1
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 273 Kb/s
Scan time: 00:00:01

显示全部楼层 · 发表于 2007-7-12 00:25:19

Start of the scan: 2007年7月12日  00:25

Starting the file scan:

Begin scan in 'D:\病毒测试\未解压\Setup.rar'
D:\病毒测试\未解压\Setup.rar
  [0] Archive type: RAR
  --> Setup.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Delf.avc.21.C Backdoor server programs
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-7-12 00:26:35

svchost 微点提示延迟删除垃圾小毒自己删吧

显示全部楼层 · 发表于 2007-7-12 00:45:36

NOD32提示上报!

[病毒样本] 昨天的加强版,希望没让大家失望

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源