[MD5: 34BB7C 3DB97D]

tonger2003

yurius

deleted: virus Trojan.Generic (modification)        File: C:\virus\Ñù±¾.rar/Hide.exe//UPack

sb

NOD32   C:\Documents and Settings\Administrator\桌面\样本.rar ?RAR ?Hide.exe - 可能是 Win32/Genetik 木马 变种

The EQs

吐血了。。。。另外一个是QQ医生的文件。。。

1688388728

无法运行C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EGMKN5N4\样本[1].rar\Hide.exe - probably infected with DLOADER.Trojan
Archive contains an infected item

风雪

1184971219,2007-7-21 6:40:19,Heuri.Possible/Packed,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\Hide.exe,Realtime scan
费尔

a256886572008

運行Hide.exe，發現下列行為，被EQ-Secure RC4攔截！

2007-07-21 07:28:54    创建文件      操作:允许
进程路径:D:\桌面\virus\34BB7C 3DB97D\Hide.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\windows\system32\wnipsvr.exe
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 07:28:54    运行应用程序      操作:阻止
进程路径:D:\桌面\virus\34BB7C 3DB97D\Hide.exe
文件路径:C:\windows\system32\cmd.exe
命令行:/c C:\windows\system32\wnipsvr.exe -down
触发规则:所有程序规则->系統程序->%windir%\system32\cmd.exe


2007-07-21 07:28:54    创建文件      操作:允许
进程路径:D:\桌面\virus\34BB7C 3DB97D\Hide.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Hide.exe
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 07:28:54    创建文件      操作:允许
进程路径:D:\桌面\virus\34BB7C 3DB97D\Hide.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\AutoRun.inf
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 07:28:54    创建文件      操作:允许
进程路径:D:\桌面\virus\34BB7C 3DB97D\Hide.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\D\Hide.exe
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-07-21 07:28:55    创建文件      操作:允许
进程路径:D:\桌面\virus\34BB7C 3DB97D\Hide.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\D\AutoRun.inf
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*

1.他會在C\windows\system32\生成
   wnipsvr.exe
2.他會運行C:\windows\system32\cmd.exe
   /c C:\windows\system32\wnipsvr.exe -down
3.他會在C\和D\生成
   Hide.exe
   AutoRun.inf

AutoRun.inf的結構

[autorun]
open=Hide.exe

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\样本.rar'
F:\病毒样本\样本.rar
  [0] Archive type: RAR
  --> Hide.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was deleted!

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/19 17:24:52 (812833 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 833174
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~OD9.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files in the directory: F:\v\
        0 ms F:\v\Hide.exe                                                Security Risk W32/Suspicious_U.gen ()
     5469 ms F:\v\TSECUA.COM                                             
- File F:\v\Hide.exe quarantined.
- File F:\v\Hide.exe deleted.

===================================================================================================

The scanning started: 2007/07/21 09:04:15
               ended: 2007/07/21 09:04:20
Logged on as        : Administrator
on hostname         : BE29C0E1C4C9406

Scanning results:
   Total number of files found..............................:       2
   Number of files scanned..................................:       2
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       0
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       1

Copyright (c) 1993-2005 Norman ASA.

红心王子

不杀 上报