在过avp...[MD5: B796BD]

taihuxian

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.
http://www.bitdefender.com/vfind/?q=Dropped:Win32.Small.B

风雪

1184283110,2007-7-13 7:31:50,TrojanPSW.GamePass.ram.wfnw,木马,mygood,D:\3\新建文件夹\新建文件夹\样本.rar>>pagefile.pif,Manual scan
费尔报的。

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\样本.rar'
F:\病毒样本\样本.rar
  [0] Archive type: RAR
  --> pagefile.pif
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!

a256886572008

運行pagefile.pif，發現下列行為，被EQ-Secure RC4攔截！

2007-07-13 08:28:07    创建文件      操作:允许
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\unlmon.dll
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-13 08:28:08    创建文件      操作:允许
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\install.exe
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-13 08:28:08    创建注册表值      操作:阻止
进程路径:D:\桌面\virus\B796BD\pagefile.pif
注册表路径:HKEY_CURRENT_USER\machine\software\microsoft\Active Setup\Installed Components\{926A036A-158B-047A-E269-D148B0369C14}
注册表名称:StubPath
注册表数据:C:\windows\system32\install.exe
触发规则:所有程序规则->其他重要項_普通模式->*\SOFTWARE\Microsoft\Active Setup\Installed Components*


2007-07-13 08:28:10    创建文件      操作:允许
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\Deleteme.bat
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-13 08:28:13    运行应用程序      操作:阻止
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\windows\system32\cmd.exe
命令行:/c C:\windows\Deleteme.bat
触发规则:黑名单->防卸规则->*\cmd.exe


2007-07-13 08:28:13    创建文件      操作:允许
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\program files\autorun.inf
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-13 08:28:13    修改文件      操作:允许
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\program files\autorun.inf
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-13 08:28:13    创建文件      操作:允许
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\autorun.inf
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-13 08:28:14    创建文件      操作:允许
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\pagefile.pif
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-13 08:28:14    创建文件      操作:允许
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\D\autorun.inf
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-13 08:28:14    创建文件      操作:允许
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\D\pagefile.pif
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-13 08:28:14    修改文件      操作:允许
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\Deleteme.bat
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-13 08:28:17    运行应用程序      操作:阻止
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\windows\system32\cmd.exe
命令行:/c C:\windows\Deleteme.bat
触发规则:黑名单->防卸规则->*\cmd.exe


2007-07-13 08:28:17    创建文件      操作:允许
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\program files\autorun.inf
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-13 08:28:17    修改文件      操作:允许
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\program files\autorun.inf
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-13 08:28:23    修改文件      操作:允许
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\Deleteme.bat
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-13 08:28:23    运行应用程序      操作:阻止
进程路径:D:\桌面\virus\B796BD\pagefile.pif
文件路径:C:\windows\system32\cmd.exe
命令行:/c C:\windows\Deleteme.bat
触发规则:黑名单->防卸规则->*\cmd.exe

1.他會在C\windows\system32\生成
   unlmon.dll
   install.exe
2.他會创建注册表值
   HKEY_CURRENT_USER\machine\software\microsoft\Active Setup\Installed Components\{926A036A-158B-047A-E269-D148B0369C14}
   StubPath
   C:\windows\system32\install.exe
3.他會在C\windows\生成
   Deleteme.bat
4.他會運行C:\windows\system32\cmd.exe
   /c C:\windows\Deleteme.bat
5.他會在C\program files\生成並修改
   autorun.inf
6.他會在C\和D\生成
   autorun.inf
   pagefile.pif

tracydk

LS的,我看了      ....

jyxtay

AVAST!Win32:Small-EWG [Trj]

gl7

KAV 7(125)
detected: virus Virus.Win32.AutoRun.er        URL: http://bbs.kafan.cn/attachment.php?aid=100147//pagefile.pif//UPX

微点卫士

金山毒霸干掉了

jyxtay

AVAST!报Win32:Small-EWG [Trj]

yyg747

2007-7-14 0:07:47        URL: http://bbs.kafan.cn/attachment.php?aid=100147//pagefile.pif//UPX        已检测 病毒 'Virus.Win32.AutoRun.er'       
kis7