跟新123【66cbf1】

wangjay1980

如题

promised

C:\ABC\123\123\mavp.exe - 特征码 'Generic.Botget' 被发现
C:\ABC\123\123\mpe.exe - 特征码 'Trojan-PWS.Win32.QQPass.pb' 被发现

        2 个文件被扫描
          (0 个压缩档 0 个文件)
        2 个特征码被侦测
        0 个可疑代码段被发现
        耗时: 0:00.031

woai_jolin

ESS PASS

promised

NOD32不能解包而已
但还是漏了一个

欠妳緈諨

sharkkong

KAV7猪叫了

PS 楼主打错字了，是“更新”不是“跟新”。呵呵
不过也解释的通，跟着来新的。呵呵

xiaopangmd

Antivirus                        Version                        Last Update                        Result                        AhnLab-V32007.7.20.02007.07.19no virus foundAntiVir7.4.0.442007.07.19no virus foundAuthentium4.93.82007.07.19no virus foundAvast4.7.997.02007.07.19Win32:Delf-DNRAVG7.5.0.4762007.07.19no virus foundBitDefender7.22007.07.20Trojan.Downloader.Agent.XZOCAT-QuickHeal9.002007.07.19no virus foundClamAVdevel-200704162007.07.20no virus foundDrWeb4.332007.07.19BackDoor.Pigeon.1604eSafe7.0.15.02007.07.19suspicious Trojan/WormeTrust-Vet30.8.37952007.07.19no virus foundEwido4.02007.07.19Dropper.DNFileAdvisor12007.07.20no virus foundFortinet2.91.0.02007.07.20no virus foundF-Prot4.3.2.482007.07.19no virus foundF-Secure6.70.13030.02007.07.20W32/Hupigon.gen67IkarusT3.1.1.82007.07.19no virus foundKaspersky4.0.2.242007.07.20no virus foundMcAfee50782007.07.19no virus foundMicrosoft1.27042007.07.20Trojan:Win32/Agent.gen!JNOD32v224082007.07.19no virus foundNorman5.80.022007.07.19W32/Hupigon.gen67Panda9.0.0.42007.07.19no virus foundSophos4.19.02007.07.17Mal/PackerSunbelt2.2.907.02007.07.19no virus foundSymantec102007.07.20no virus foundTheHacker6.1.7.1492007.07.18no virus foundVBA323.12.2.12007.07.19Trojan.MulDrop.6952VirusBuster4.3.26:92007.07.19no virus foundWebwasher-Gateway6.0.12007.07.20Win32.Malware.gen (suspicious)                                                 Aditional information                        File size: 57184 bytesMD5: ab840c6792728a52e3280003f31f5b40SHA1: 6fad2428e60f133662a03e394444e5419843837bnormansandbox: [ General information ]<br /> * **IMPORTANT: PLEASE SENDTHE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G.ZIP WITH PASSWORD)**.<br /> * Creating several executable fileson hard-drive.<br /> * File length: 84992 bytes.<br/><br /> [ Changes to filesystem ]<br /> * Deletesdirectory C:\WINDOWS\TEMP\IXP0.TMP.<br /> * Creates directoryC:\WINDOWS\TEMP\IXP0.TMP.<br /> * Creates fileC:\WINDOWS\TEMP\IXP0.TMP\TMP4351$.TMP.<br /> * Creates fileC:\WINDOWS\TEMP\IXP0.TMP\mavp.exe.<br /> * Creates fileC:\WINDOWS\TEMP\IXP0.TMP\mpe.exe.<br /> * Creates fileC:\WINDOWS\winllogon.exe.<br /> * Deletes fileC:\WINDOWS\TEMP\IXP0.TMP\mpe.exe.<br /> * Deletes fileC:\WINDOWS\TEMP\IXP0.TMP\mavp.exe.<br /> * Deletes fileC:\WINDOWS\TEMP\IXP0.TMP\TMP4351$.TMP.<br /> * Deletes directoryC:\WINDOWS\TEMP\IXP0.TMP\.<br /> * Creates fileC:\WINDOWS\Deleteme.bat.<br /><br /> [ Changes to registry]<br /> * Creates key\"HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\".<br />* Sets value \"wextract_cleanup0\"=\"rundll32.exeC:\WINDOWS\SYSTEM32\advpack.dll,DelNodeRunDLL32\"C:\WINDOWS\TEMP\IXP0.TMP\\"\" in key\"HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\".<br />* Deletes value \"wextract_cleanup0\" in key\"HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\".<br />* Creates key\"HKLM\System\CurrentControlSet\Services\IE_WinServerName\".<br/> * Sets value \"ImagePath\"=\"C:\WINDOWS\winllogon.exe\" in key\"HKLM\System\CurrentControlSet\Services\IE_WinServerName\".<br/> * Sets value \"DisplayName\"=\"Windows CreaterIE\" in key\"HKLM\System\CurrentControlSet\Services\IE_WinServerName\".<br/><br /> [ Process/window information ]<br /> * Attemptsto access service \"IE_WinServerName\".<br /> * Creates service\"IE_WinServerName (Windows CreaterIE)\" as\"C:\WINDOWS\winllogon.exe\".<br /><br />

微点卫士

微点没有反应,我上报

1688388728

病毒: Win32:Delf-DNR [Trj]
文件: 123[1].zip
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EGMKN5N4
进程: GreenBrowser.exe

The EQs

Scan performed at: 2007-7-20 13:04:01
Scanning Log
NOD32 version 2408 (20070719) NT
Command line: C:\Documents and Settings\EQ2\桌面\123\123
Operating memory - is OK

Date: 20.7.2007  Time: 13:04:09
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\123\123\
C:\Documents and Settings\EQ2\桌面\123\123\mpe.exe - a variant of Win32/TrojanDownloader.Delf.AXB trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 13:04:09 Total scanning time: 0 sec (00:00:00)