跟新123【66cbf1】

红心王子

C:\Documents and Settings\Administrator\桌面\123.
zip>>123.exe>>mpe.exe      Trojan.DL.Win32.Getou.b

微点卫士

双击以后会有CMD.EXE运行的,然后玩网游,会提示黑客程序在运行什么的,不能启动游戏了

残缺的唯美

为什么咖啡飘过=。=

xiaopangmd

为什么我的NOD和virustotal上都查不出？解压了也没用......

原帖由 EQ2 于 2007-7-20 13:04 发表
Scan performed at: 2007-7-20 13:04:01
Scanning Log
NOD32 version 2408 (20070719) NT
Command line: C:\Documents and Settings\EQ2\桌面\123\123
Operating memory - is OK

Date: 20.7.2007  Time: ...

The EQs

因为你没有完全解出来

woai_jolin

norman每次杀这个123系列
都是sandbox发现
===================================================================================================
NVCOD On Demand Scanner 5.80.02
NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/19 17:24:52 (812833 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 833174
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~OD70.tmp"
===================================================================================================
       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: F:\v\123.zip
     22703 ms F:\v\123.zip : 123.exe                                       Virus W32/Hupigon.gen67 ( [ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * Creating several executable files on hard-drive.
    * File length:        84992 bytes.
[ Changes to filesystem ]
    * Deletes directory C:\WINDOWS\TEMP\IXP0.TMP.
    * Creates directory C:\WINDOWS\TEMP\IXP0.TMP.
    * Creates file C:\WINDOWS\TEMP\IXP0.TMP\TMP4351$.TMP.
    * Creates file C:\WINDOWS\TEMP\IXP0.TMP\mavp.exe.
    * Creates file C:\WINDOWS\TEMP\IXP0.TMP\mpe.exe.
    * Creates file C:\WINDOWS\winllogon.exe.
    * Deletes file C:\WINDOWS\TEMP\IXP0.TMP\mpe.exe.
    * Deletes file C:\WINDOWS\TEMP\IXP0.TMP\mavp.exe.
    * Deletes file C:\WINDOWS\TEMP\IXP0.TMP\TMP4351$.TMP.
    * Deletes directory C:\WINDOWS\TEMP\IXP0.TMP\.
    * Creates file C:\WINDOWS\Deleteme.bat.
[ Changes to registry ]
    * Creates key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
    * Sets value "wextract_cleanup0"="rundll32.exe C:\WINDOWS\SYSTEM32\advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\TEMP\IXP0.TMP\"" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
    * Deletes value "wextract_cleanup0" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce".
    * Creates key "HKLM\System\CurrentControlSet\Services\IE_WinServerName".
    * Sets value "ImagePath"="C:\WINDOWS\winllogon.exe" in key "HKLM\System\CurrentControlSet\Services\IE_WinServerName".
    * Sets value "DisplayName"="Windows CreaterIE" in key "HKLM\System\CurrentControlSet\Services\IE_WinServerName".
[ Process/window information ]
    * Attempts to access service "IE_WinServerName".
    * Creates service "IE_WinServerName (Windows CreaterIE)" as "C:\WINDOWS\winllogon.exe".
)
        0 ms F:\v\123.zip                                                
        0 ms F:\v\123.zip:Zone.Identifier                                
- File F:\v\123.zip quarantined.
===================================================================================================
The scanning started: 2007/07/20 13:35:07
               ended: 2007/07/20 13:35:30
Logged on as        : Administrator
on hostname         : BE29C0E1C4C9406
Scanning results:
   Total number of files found..............................:       3
   Number of files scanned..................................:       3
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       1
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       1
Copyright (c) 1993-2005 Norman ASA.

xiaopangmd

？什么叫完全解出来？

原帖由 EQ2 于 2007-7-20 13:23 发表
因为你没有完全解出来

rasis

123.zip
  [0] Archive type: ZIP
  --> 123.exe
      [DETECTION] Contains signature of the dropper DR/Agent.V.11

hj5abc

那个123.exe实际上还是一个压缩包,可以再解压的..

hj5abc

另一个mavp.exe只是生成一个修改时间的BAT..不上报了