[MD5: 72E8F6]

显示全部楼层 · 发表于 2007-7-13 19:15:40

再次中毒...幸亏只是一个VB的小毒,在个不正规网站下载珊瑚虫QQ中的..用UE看它似乎是一个广告点击器...至于它下不下载文件就不知道了,反正VIRSCAN.ORG上面22个杀毒软件全部挂掉

显示全部楼层 · 发表于 2007-7-13 19:17:26

红伞不报

显示全部楼层 · 发表于 2007-7-13 19:20:40

KIS7 不报

显示全部楼层 · 发表于 2007-7-13 19:21:14

卡巴主防
strange behaviour

显示全部楼层 · 发表于 2007-7-13 19:22:38

AhnLab-V3	2007.7.13.0	2007.07.13	no virus found
AntiVir	7.4.0.39	2007.07.13	no virus found
Authentium	4.93.8	2007.07.13	no virus found
Avast	4.7.997.0	2007.07.12	no virus found
AVG	7.5.0.476	2007.07.12	no virus found
BitDefender	7.2	2007.07.13	no virus found
CAT-QuickHeal	9.00	2007.07.12	no virus found
ClamAV	devel-20070416	2007.07.13	no virus found
DrWeb	4.33	2007.07.13	no virus found
eSafe	7.0.15.0	2007.07.10	no virus found
eTrust-Vet	30.8.3783	2007.07.13	no virus found
Ewido	4.0	2007.07.13	no virus found
FileAdvisor	1	2007.07.13	no virus found
Fortinet	2.91.0.0	2007.07.13	no virus found
F-Prot	4.3.2.48	2007.07.13	no virus found
Ikarus	T3.1.1.8	2007.07.13	no virus found
Kaspersky	4.0.2.24	2007.07.13	no virus found
McAfee	5073	2007.07.12	no virus found
Microsoft	1.2704	2007.07.12	no virus found
NOD32v2	2396	2007.07.12	no virus found
Norman	5.80.02	2007.07.12	no virus found
Panda	9.0.0.4	2007.07.12	no virus found
Sophos	4.19.0	2007.07.06	no virus found
Sunbelt	2.2.907.0	2007.07.12	no virus found
Symantec	10	2007.07.13	no virus found
TheHacker	6.1.6.145	2007.07.12	no virus found
VBA32	3.12.0.2	2007.07.13	no virus found
VirusBuster	4.3.23:9	2007.07.12	no virus found
Webwasher-Gateway	6.0.1	2007.07.13	no virus found

显示全部楼层 · 发表于 2007-7-13 19:23:33

费尔无反应。

显示全部楼层 · 发表于 2007-7-13 19:31:34

2007-07-13 19:28:36 读取注册表内容
操作:阻止
进程路径:C:\ABC\样本\realsched.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
注册表名称:TransparentEnabled
规则:所有程序规则->其他重要项->*\Software\Policies*
2007-07-13 19:28:36 读取注册表内容
操作:阻止
进程路径:C:\ABC\样本\realsched.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
注册表名称:AppInit_DLLs
规则:所有程序规则->自动运行_普通模式->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
2007-07-13 19:28:36 读取注册表内容
操作:阻止
进程路径:C:\ABC\样本\realsched.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
注册表名称:LeakTrack
规则:所有程序规则->WinLogon->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon*
2007-07-13 19:28:37 读取注册表内容
操作:阻止
进程路径:C:\ABC\样本\realsched.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
注册表名称:EnableBalloonTips
规则:所有程序规则->资源管理器->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced*
2007-07-13 19:28:37 读取注册表内容
操作:阻止
进程路径:C:\ABC\样本\realsched.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK
注册表名称:realsched.exe
规则:所有程序规则->IE浏览器设置->*\Software\Microsoft\Internet explorer\Main\FeatureControl\*
2007-07-13 19:28:37 读取注册表内容
操作:阻止
进程路径:C:\ABC\样本\realsched.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK
注册表名称:*
规则:所有程序规则->IE浏览器设置->*\Software\Microsoft\Internet explorer\Main\FeatureControl\*
2007-07-13 19:28:40 访问物理内存
操作:阻止
进程路径:C:\ABC\样本\realsched.exe

规则:所有程序规则->*
2007-07-13 19:28:41 访问物理内存
操作:阻止
进程路径:C:\ABC\样本\realsched.exe

规则:所有程序规则->*
2007-07-13 19:28:41 访问物理内存
操作:阻止
进程路径:C:\ABC\样本\realsched.exe
由于昨天的意外事故，最近就不放行了

好像是下载者

显示全部楼层 · 发表于 2007-7-13 19:32:57

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.90.37
nvcbin.def revision 5.90.00 of 2007/05/24 17:29:41 (794383 variants)
nvcmacro.def revision 5.90.00 of 2007/05/24 17:15:53 (20339 variants)
Total number of variants: 814722
Command line: "@C:\Users\Jason\AppData\Local\Temp\~ODE575.tmp"
===================================================================================================

   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------

- Scanning drive: D:\
- Scanning system areas of drive: D:\
- Scanning files matching: D:\virus\样本.rar
      0 ms D:\virus\样本.rar
   16 ms D:\virus\样本.rar:Zone.Identifier

===================================================================================================

The scanning started: 2007/07/13 19:28:12
            ended: 2007/07/13 19:28:13
Logged on as       : Jason
on hostname       : JASON-PC

Scanning results:
Total number of files found..............................:    2
Number of files scanned..................................:    2
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    0
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    0

Copyright (c) 1993-2005 Norman ASA.

显示全部楼层 · 发表于 2007-7-13 19:33:26

原帖由 promised 于 2007-7-13 19:31 发表
2007-07-13 19:28:36 读取注册表内容
操作:阻止
进程路径:C:\ABC\样本\realsched.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
注册表名称:Transpare ...

居然能全挂.....上报AVIRA看下

显示全部楼层 · 发表于 2007-7-13 19:33:59

8楼的在用NORMAN吗???

[病毒样本] [MD5: 72E8F6]

本帖子中包含更多资源