123继续更新【5fb6ee】

风雪

费尔过。

rasis

解包出来自己杀

b-mie.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPI.Gen
      [WARNING]   The file was ignored!

woai_jolin

ＮＯＲＭＡＮ每次都要KILL IT
===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/18 08:11:18 (811592 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 831933
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~ODD.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: F:\v\123.zip
     21484 ms F:\v\123.zip : 123.exe                                       Virus W32/Hupigon.gen67 ( [ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * Creating several executable files on hard-drive.
    * File length:        83968 bytes.

[ Changes to filesystem ]
    * Deletes directory C:\WINDOWS\TEMP\IXP0.TMP.
    * Creates directory C:\WINDOWS\TEMP\IXP0.TMP.
    * Creates file C:\WINDOWS\TEMP\IXP0.TMP\TMP4351$.TMP.
    * Creates file C:\WINDOWS\TEMP\IXP0.TMP\b-PEavp.exe.
    * Creates file C:\WINDOWS\TEMP\IXP0.TMP\b-mie.exe.
    * Deletes file C:\WINDOWS\TEMP\IXP0.TMP\b-mie.exe.
    * Deletes file C:\WINDOWS\TEMP\IXP0.TMP\b-PEavp.exe.
    * Deletes file C:\WINDOWS\TEMP\IXP0.TMP\TMP4351$.TMP.
    * Deletes directory C:\WINDOWS\TEMP\IXP0.TMP\.
    * Creates file C:\WINDOWS\winllogon.exe.
    * Creates file C:\WINDOWS\Deleteme.bat.

[ Changes to registry ]
    * Creates key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
    * Sets value "wextract_cleanup0"="rundll32.exe C:\WINDOWS\SYSTEM32\advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\TEMP\IXP0.TMP\"" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
    * Deletes value "wextract_cleanup0" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
    * Creates key "HKLM\System\CurrentControlSet\Services\IE_WinServerName".
    * Sets value "ImagePath"="C:\WINDOWS\winllogon.exe" in key "HKLM\System\CurrentControlSet\Services\IE_WinServerName".
    * Sets value "DisplayName"="Windows CreaterIE" in key "HKLM\System\CurrentControlSet\Services\IE_WinServerName".

[ Process/window information ]
    * Attempts to access service "IE_WinServerName".
    * Creates service "IE_WinServerName (Windows CreaterIE)" as "C:\WINDOWS\winllogon.exe".

)
        0 ms F:\v\123.zip                                                
       16 ms F:\v\123.zip:Zone.Identifier                                
- File F:\v\123.zip quarantined.

===================================================================================================

The scanning started: 2007/07/19 13:45:20
               ended: 2007/07/19 13:45:42
Logged on as        : Administrator
on hostname         : BE29C0E1C4C9406

Scanning results:
   Total number of files found..............................:       3
   Number of files scanned..................................:       3
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       1
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       1

Copyright (c) 1993-2005 Norman ASA.

yyg747

已检测: 病毒 Trojan.Generic (变种)        URL: http://bbs.kafan.cn/attachment.p ... ck//PE_Patch.MaskPE

woai_jolin

运行后ess kill
2007/7/19 14:28:58 eAmon file C:\fslrdr\1\USER_TEMPLATE\[_B_]TEMP[_E_]\IXP000.TMP\b-mie.exe a variant of Win32/TrojanDownloader.Delf.AXB trojan cleaned by deleting - quarantined  Event occurred on a new file created by the application: F:\v\123.exe.

[ 本帖最后由 woai_jolin 于 2007-7-19 14:30 编辑 ]

1688388728

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=102588 is infected with Trojan-Downloader.Win32.Small.ext virus

微点卫士

木马名称:Trojan-Downloader.Win32.Delf.gob

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\IXP000.TMP\B-MIE.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

tracydk

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00064277.



We received the following archive files:

File ID	Filename	Size (Byte)	Result
1110653	123.zip	54.61 KB	OK

A listing of files contained inside archives alongside their results can be found below:

File ID	Filename	Size (Byte)	Result
1110654	123.exe	82 KB	MALWARE

Please find a detailed report concerning each individual sample below:

Filename

Result

123.exe

MALWARE

The file '123.exe' has been determined to be 'MALWARE'.
Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates.

l784588

avast灭,报Win32:Delf-DNR [Trj]

liyukun97065

要过卡巴,过小红伞,还要过SSM主动防御
做病毒的好辛苦啊

玩累了,休息一下