［危险］

显示全部楼层 · 发表于 2007-7-12 16:58:23

運行virus (13).exe，發現下列行為，被EQ-Secure RC4攔截！

2007-07-12 16:52:12 创建文件    操作:允许
进程路径:D:\桌面\virus\有几个是过微点的\virus (13).exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\virus (13).exe
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-12 16:52:15 修改注册表内容    操作:阻止
进程路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\virus (13).exe
注册表路径:HKEY_CURRENT_USER\machine\SYSTEM\CurrentControlSet\Services\service
注册表名称:SbieControlCode
触发规则:所有程序规则->2.1.2组：保护系统服务和驱动，禁止更改用户权限->*\SYSTEM\CurrentControlSet*\Services

2007-07-12 16:52:16 修改注册表内容    操作:阻止
进程路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\virus (13).exe
注册表路径:HKEY_CURRENT_USER\machine\SYSTEM\CurrentControlSet\Services\service
注册表名称:SbieProcessId
触发规则:所有程序规则->2.1.2组：保护系统服务和驱动，禁止更改用户权限->*\SYSTEM\CurrentControlSet*\Services

2007-07-12 16:52:16 修改注册表内容    操作:阻止
进程路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\virus (13).exe
注册表路径:HKEY_CURRENT_USER\machine\SYSTEM\CurrentControlSet\Services\service
注册表名称:SbieCurrentState
触发规则:所有程序规则->2.1.2组：保护系统服务和驱动，禁止更改用户权限->*\SYSTEM\CurrentControlSet*\Services

2007-07-12 16:52:16 修改注册表内容    操作:阻止
进程路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\virus (13).exe
注册表路径:HKEY_CURRENT_USER\machine\SYSTEM\CurrentControlSet\Services\service
注册表名称:SbieControlsAccepted
触发规则:所有程序规则->2.1.2组：保护系统服务和驱动，禁止更改用户权限->*\SYSTEM\CurrentControlSet*\Services

2007-07-12 16:52:21 修改注册表内容    操作:阻止
进程路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\virus (13).exe
注册表路径:HKEY_CURRENT_USER\machine\SYSTEM\CurrentControlSet\Services\service
注册表名称:SbieWin32ExitCode
触发规则:所有程序规则->2.1.2组：保护系统服务和驱动，禁止更改用户权限->*\SYSTEM\CurrentControlSet*\Services

2007-07-12 16:52:21 修改注册表内容    操作:阻止
进程路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\virus (13).exe
注册表路径:HKEY_CURRENT_USER\machine\SYSTEM\CurrentControlSet\Services\service
注册表名称:SbieServiceSpecificExitCode
触发规则:所有程序规则->2.1.2组：保护系统服务和驱动，禁止更改用户权限->*\SYSTEM\CurrentControlSet*\Services

2007-07-12 16:52:21 修改注册表内容    操作:阻止
进程路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\virus (13).exe
注册表路径:HKEY_CURRENT_USER\machine\SYSTEM\CurrentControlSet\Services\service
注册表名称:SbieCheckPoint
触发规则:所有程序规则->2.1.2组：保护系统服务和驱动，禁止更改用户权限->*\SYSTEM\CurrentControlSet*\Services

2007-07-12 16:52:21 修改注册表内容    操作:阻止
进程路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\virus (13).exe
注册表路径:HKEY_CURRENT_USER\machine\SYSTEM\CurrentControlSet\Services\service
注册表名称:SbieWaitHint
触发规则:所有程序规则->2.1.2组：保护系统服务和驱动，禁止更改用户权限->*\SYSTEM\CurrentControlSet*\Services

2007-07-12 16:52:21 运行应用程序    操作:阻止
进程路径:D:\桌面\virus\有几个是过微点的\virus (13).exe
文件路径:C:\windows\system32\cmd.exe
命令行:/c  del D:\桌面\virus\有几个~1\VI702C~1.EXE > nul
触发规则:黑名单->防卸规则->*\cmd.exe

1.他會在C\windows\system32\生成
virus (13).exe
2.virus (13).exe會修改注册表内容
HKEY_CURRENT_USER\machine\SYSTEM\CurrentControlSet\Services\service
SbieControlCode
SbieProcessId
SbieCurrentState
SbieControlsAccepted
SbieWin32ExitCode
SbieServiceSpecificExitCode
SbieCheckPoint
SbieWaitHint
3.他會運行C:\windows\system32\cmd.exe
/c del D:\桌面\virus\有几个~1\VI702C~1.EXE > nul

显示全部楼层 · 发表于 2007-7-12 17:26:35

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.
http://www.bitdefender.com/vfind/?q=Trojan.Downloader.Small.DWP
http://www.bitdefender.com/vfind/?q=Trojan.PWS.OnlineGames.AUP
http://www.bitdefender.com/vfind/?q=Trojan.Agent.ABF

显示全部楼层 · 发表于 2007-7-12 17:48:57

查杀了7个

显示全部楼层 · 发表于 2007-7-12 17:59:29

不好意思看错了 - -~ 不是7个...

显示全部楼层 · 发表于 2007-7-12 18:01:24

Starting the file scan:

Begin scan in 'F:\病毒样本\有几个是过微点的.rar'
F:\病毒样本\有几个是过微点的.rar
  [0] Archive type: RAR
  --> virus (0).exe
   [DETECTION] Is the Trojan horse TR/Agent.abf.1075
  --> virus (4).exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> virus (7).exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGam.QW
  --> virus (8).exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGam.QW
  --> virus (9).exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Pakes.F Backdoor server programs
  --> virus (12).exe
   [DETECTION] Is the Trojan horse TR/Dldr.QQHe.FT.5.D
  --> virus (13).exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Pakes.F Backdoor server programs
   [INFO]    The file was deleted!

End of the scan: 2007年7月12日  18:01
Used time: 00:05 min

The scan has been done completely.

   0 Scanning directories
   19 Files were scanned
   7 viruses and/or unwanted programs were found
   0 classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   12 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-7-12 18:13:42

红伞被过了10个

显示全部楼层 · 发表于 2007-7-12 18:25:17

软件名称引擎版本
 病毒库版本
 病毒库时间
 扫描结果
 扫描完成时间
Arcavir 防病毒1.0.42007071118582007-07-11Heur.Win32.I1.74Avast 防病毒1.0.8000756-02007-07-12Win32:Onlinegames-ACS3.062AVG 防病毒7.5.47.442269.10.4/8972007-07-11Generic5.BQI2.122BitDefender 防病毒7.60825.7341747.138302007-07-12Trojan.PWS.OnlineGames.AUP3.456ClamAV N/A36412007-07-12Broken.Executable0.117F-SECURE 防病毒5.51.61002007.07.11.072007-07-11Trojan-PSW.Win32.OnLineGames.s...1.675IKARUS 防病毒N/A04:32:002007-07-12Trojan.Win32.Agent.abf1.291MKS_VIR 防病毒2.012007.07.122007-07-12Psw.Win32.AskTao.o0.644NOD32 防病毒2.70.723942007-07-11a variant of Win32/PSW.OnLineG...1.977SOPHOS 防病毒2.474.192007-07-12Mal/Packer0.129VBA32 防病毒3.12.0.220070711.20572007-07-11Trojan.PWS.Wsgame1.709VirusBuster 防病毒4.3.19:99.088.2/11.02007-07-11Trojan.DL.Loadadv.Gen.21.562冰岛杀毒3.16.152007.07.112007-07-11W32/Downloader-Sml-based!Maxim...1.032卡巴斯基防病毒5.5.102007.07.122007-07-12没有检测到病毒0.005大蜘蛛防病毒4.332007.07.122007-07-12Trojan.PWS.Wsgame5.744小红伞防病毒7.4.0.396.39.0.1382007-07-12TR/PSW.OnLineGam.QW3.201熊猫卫士9.00.002007.07.112007-07-11Trj/Lineage.DTB0.833诺曼防病毒5.90.375.902007-07-11W32/Agent.BUGB2.452赛门铁克防病毒N/A20070711.0162007-07-11Infostealer.Gampass1.324趋势防病毒8.310-10024.593.002007-07-11没有检测到病毒0.624迈克菲防病毒5.1.0050722007-07-11Generic PWS.y1.888金山毒霸2006.11.1.2402007.7.42007-07-04Win32.Troj.Agent.40962.413

显示全部楼层 · 发表于 2007-7-12 18:26:05

大家都用上中文的扫描引擎了

显示全部楼层 · 发表于 2007-7-12 18:57:49

从AVAST论坛转载的吧..

显示全部楼层 · 发表于 2007-7-12 19:12:15

原帖由 solcroft 于 2007-7-12 15:36 发表
红伞报的好几个也都是损坏文件

汗，你看仔细了，还有，你自己一定没有运行。