MD5[cf2717]

scottxzt

这东东就只有启发了.

wangjay1980

detected: virus Heur.Trojan.Generic        File: C:\Documents and Settings\Owner\×ÀÃæ\1.zip/н¨Îļþ¼Ð\1.exe

欠妳緈諨

AVAST过
Start of the scan: 2007年7月20日  23:51

Starting the file scan:

Begin scan in 'D:\病毒测试\未解压样本\新建文件夹.rar'
D:\病毒测试\未解压样本\新建文件夹.rar
  [0] Archive type: RAR
  --> н¨Îļþ¼Ð\1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING]   The file was ignored!

Giggs

Start of the scan: 2007年7月20日  23:52

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\新建文件夹.rar'
C:\Documents and Settings\Administrator\桌面\新建文件夹.rar
  [0] Archive type: RAR
  --> н¨Îļþ¼Ð\1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      A backup was created as 'ac283937.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

promised

C:\ABC\新建文件夹.rar:\新建文件夹\1.exe - 特征码 'Packer.Malware.NSAnti.H' 被发现
C:\ABC\新建文件夹.rar

taitan001

F:\新建文件夹.rar:<RAR>\新建文件夹\1.exe : infected MalwareScope.Worm.Viking.3

1688388728

程序:
E:\病毒库\新建文件夹\新建文件夹\1.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LBMURP.DLL
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\4.SYS
是否删除木马程序及其衍生物?

风雪

费尔启发。

a256886572008

運行1.exe，發現下列行為，被EQ-Secure RC4攔截！

2007-07-21 07:38:55    创建文件      操作:允许
进程路径:D:\桌面\virus\新建文件夹\新建文件夹\1.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp\lbmurp.dll
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 07:38:55    创建文件      操作:允许
进程路径:D:\桌面\virus\新建文件夹\新建文件夹\1.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp\52rxv.sys
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 07:38:58    加载驱动程序      操作:允许
进程路径:D:\桌面\virus\新建文件夹\新建文件夹\1.exe
驱动名称:52rxv.sys
触发规则:所有程序规则->*


2007-07-21 07:39:01    修改其它进程内存      操作:允许
进程路径:D:\桌面\virus\新建文件夹\新建文件夹\1.exe
目标进程:C:\Program Files\Internet Explorer\iexplore.exe
触发规则:所有程序规则->系統程序->%ProgramFiles%\Internet Explorer\IEXPLORE.EXE


2007-07-21 07:39:06    创建文件      操作:允许
进程路径:D:\桌面\virus\新建文件夹\新建文件夹\1.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Windows NT\SERVICES.EXE
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 07:39:06    创建注册表值      操作:阻止
进程路径:D:\桌面\virus\新建文件夹\新建文件夹\1.exe
注册表路径:HKEY_CURRENT_USER\machine\software\microsoft\windows nt\currentversion\winlogon
注册表名称:Userinit
注册表数据:C:\WINDOWS\system32\userinit.exe,C:\Program Files\Windows NT\SERVICES.EXE,
触发规则:所有程序规则->WinLogon->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon*


2007-07-21 07:39:06    创建文件      操作:允许
进程路径:D:\桌面\virus\新建文件夹\新建文件夹\1.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp\$$c78.tmp
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 07:39:06    创建文件      操作:允许
进程路径:D:\桌面\virus\新建文件夹\新建文件夹\1.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp\$$c78.tmp.bat
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 07:39:06    运行应用程序      操作:阻止
进程路径:D:\桌面\virus\新建文件夹\新建文件夹\1.exe
文件路径:C:\windows\system32\cmd.exe
命令行:/c C:\DOCUME~1\HungAndy\LOCALS~1\Temp\$$c78.tmp.bat
触发规则:所有程序规则->系統程序->%windir%\system32\cmd.exe


2007-07-21 07:39:09    创建文件      操作:允许
进程路径:C:\Program Files\Internet Explorer\iexplore.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\wincab.sys
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 07:39:09    运行应用程序      操作:允许
进程路径:D:\桌面\virus\新建文件夹\新建文件夹\1.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Windows NT\SERVICES.EXE
触发规则:所有程序规则->*


2007-07-21 07:39:10    修改文件      操作:允许
进程路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Windows NT\SERVICES.EXE
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp\lbmurp.dll
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 07:39:10    创建文件      操作:允许
进程路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Windows NT\SERVICES.EXE
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp\z.sys
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 07:39:12    加载驱动程序      操作:允许
进程路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Windows NT\SERVICES.EXE
驱动名称:z.sys
触发规则:所有程序规则->*


2007-07-21 07:39:14    修改其它进程内存      操作:允许
进程路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Windows NT\SERVICES.EXE
目标进程:C:\Program Files\Internet Explorer\iexplore.exe
触发规则:所有程序规则->系統程序->%ProgramFiles%\Internet Explorer\IEXPLORE.EXE


2007-07-21 07:39:17    创建文件      操作:允许
进程路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Windows NT\SERVICES.EXE
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\ACE.dll
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 07:39:18    创建文件      操作:允许
进程路径:C:\Program Files\Internet Explorer\iexplore.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\wincab.sys
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*

1.他會在C:\Documents and Settings\HungAndy\Local Settings\Temp\生成
   lbmurp.dll
   52rxv.sys
2.他會加载驱动程序
   52rxv.sys
3.他會修改iexplore.exe的进程内存
4.他會在C\Program Files\Windows NT\生成
   SERVICES.EXE
5.他會创建注册表值
   HKEY_CURRENT_USER\machine\software\microsoft\windows nt\currentversion\winlogon
   Userinit
   C:\WINDOWS\system32\userinit.exe,C:\Program Files\Windows NT\SERVICES.EXE,
6.他會在C:\Documents and Settings\HungAndy\Local Settings\Temp\生成
   $$c78.tmp
   $$c78.tmp.bat
7.他會運行C:\windows\system32\cmd.exe
   /c C:\DOCUME~1\HungAndy\LOCALS~1\Temp\$$c78.tmp.bat
8.iexplore.exe會在C\windows\system32\生成
   wincab.sys
9.他會運行C\Program Files\Windows NT\SERVICES.EXE
10.SERVICES.EXE會修改C:\Documents and Settings\HungAndy\Local Settings\Temp\lbmurp.dll
11.SERVICES.EXE會在C:\Documents and Settings\HungAndy\Local Settings\Temp\生成
    z.sys
12.SERVICES.EXE會加载驱动程序
    z.sys
13.SERVICES.EXE會修改iexplore.exe的进程内存
14.SERVICES.EXE會在C\windows\system32\生成
    ACE.dll
15.iexplore.exe會在C\windows\system32\生成
    wincab.sys

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.ru        URL: http://bbs.kafan.cn/attachment.php?aid=103212//&ETH;&Acirc;&frac12;¨&Icirc;&Auml;&frac14;&thorn;&frac14;&ETH;/1.exe