123更新【md5:8caf97】

wangjay1980

rt

promised

C:\ABC\123\123\avp.exe
C:\ABC\123\123\ie.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现

        2 个文件被扫描
          (0 个压缩档 0 个文件)
        1 个特征码被侦测
        0 个可疑代码段被发现
        耗时: 0:00.031

1688388728

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\123[1].zip\123.exe\avp.exe - infected with Trojan.MulDrop.6952
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\123[1].zip\123.exe\ie.exe - infected with BackDoor.Pigeon.1604

Archive contains 2 infected items

FBAV

风暴胜者V2 贺岁精简网络版本
_________您的安全是我们的责任_______________
作者：Sanhuan222@163.com   TM:469428271
个人Blog：http://hi.baidu.com/迅者/



===============================================
   ___________病毒查杀结果__________________


===============================================

2007年5月17日20时4分57秒 开始查杀C:\Documents and Settings\Administrator\桌面\virus\123
****************************
您应该引起注意的文件:

-----------------------------------------


=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。


-----------------------------------------

2007年5月17日20时4分57秒收起线程…100% 查杀完毕！
扫描文件：1查杀病毒：0 风暴最近老过 不如以前了…… 还得有话

[ 本帖最后由 FBAV 于 2007-7-17 20:05 编辑 ]

The EQs

再怎么更新nod32也不杀

promised

解不了包

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/17 08:12:37 (810868 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 831209
Command line: "@C:\Users\Jason\AppData\Local\Temp\~OD7F6.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: D:\v\123.zip
     21516 ms D:\v\123.zip : 123.exe                                       Virus W32/Hupigon.gen67 ( [ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * Creating several executable files on hard-drive.
    * File length:        83456 bytes.

[ Changes to filesystem ]
    * Deletes directory C:\WINDOWS\TEMP\IXP0.TMP.
    * Creates directory C:\WINDOWS\TEMP\IXP0.TMP.
    * Creates file C:\WINDOWS\TEMP\IXP0.TMP\TMP4351$.TMP.
    * Creates file C:\WINDOWS\TEMP\IXP0.TMP\avp.exe.
    * Creates file C:\WINDOWS\TEMP\IXP0.TMP\ie.exe.
    * Deletes file C:\WINDOWS\TEMP\IXP0.TMP\ie.exe.
    * Deletes file C:\WINDOWS\TEMP\IXP0.TMP\avp.exe.
    * Deletes file C:\WINDOWS\TEMP\IXP0.TMP\TMP4351$.TMP.
    * Deletes directory C:\WINDOWS\TEMP\IXP0.TMP\.
    * Creates file C:\WINDOWS\winllogon.exe.
    * Creates file C:\WINDOWS\Deleteme.bat.

[ Changes to registry ]
    * Creates key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
    * Sets value "wextract_cleanup0"="rundll32.exe C:\WINDOWS\SYSTEM32\advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\TEMP\IXP0.TMP\"" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
    * Deletes value "wextract_cleanup0" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
    * Creates key "HKLM\System\CurrentControlSet\Services\IE_WinServerName".
    * Sets value "ImagePath"="C:\WINDOWS\winllogon.exe" in key "HKLM\System\CurrentControlSet\Services\IE_WinServerName".
    * Sets value "DisplayName"="Windows CreaterIE" in key "HKLM\System\CurrentControlSet\Services\IE_WinServerName".

[ Process/window information ]
    * Attempts to access service "IE_WinServerName".
    * Creates service "IE_WinServerName (Windows CreaterIE)" as "C:\WINDOWS\winllogon.exe".

)
        0 ms D:\v\123.zip                                                
        0 ms D:\v\123.zip:Zone.Identifier                                
- File D:\v\123.zip quarantined.

===================================================================================================

The scanning started: 2007/07/17 20:03:17
               ended: 2007/07/17 20:03:39
Logged on as        : Jason
on hostname         : JASON-PC

Scanning results:
   Total number of files found..............................:       3
   Number of files scanned..................................:       3
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       1
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       1

Copyright (c) 1993-2005 Norman ASA.

欠妳緈諨

红心王子

C:\Documents and Settings\Administrator\桌面\123.
zip>>123.exe>>ie.exe>>nspack            Trojan.DL.Win32.Agent.wvv

The EQs

Scan performed at: 2007-7-17 20:05:34
Scanning Log
NOD32 version 2402 (20070717) NT
Command line: C:\Documents and Settings\EQ2\桌面\123\123
Operating memory - is OK

Date: 17.7.2007  Time: 20:05:41
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\123\123\
C:\Documents and Settings\EQ2\桌面\123\123\ie.exe - a variant of Win32/TrojanDownloader.Delf.AXB trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 20:05:42 Total scanning time: 1 sec (00:00:01)