毒网 http://www.52blog.net/user6/133369/archives/2007/1121001.shtml

显示全部楼层 · 发表于 2007-7-21 14:53:55

用opera和ie都屏蔽掉了

Scanning Log
NOD32 version 2410 (20070720) NT
Command line: R:\down.zip
Checking CRC of NOD32.EXE: Status OK
Scanning memory: Not performed (option disabled)
Error occurred while scanning MBR sector of the 2.  ?
?physical disk. Error reading sector.
Error occurred while scanning MBR sector of the 3.  ?
?physical disk. Error reading sector.
Date: 21.7.2007  Time: 14:53:55
Anti-Stealth technology is enabled.
Scanned disks, folders and files: R:\down.zip
R:\down.zip ?ZIP ?down.exe - Win32/PSW.Delf.NHI trojan
Number of scanned files: 1
Number of threats found: 1
Time of completion: 14:53:55 Total scanning time: 0 sec  ?
?(00:00:00)

显示全部楼层 · 发表于 2007-7-21 14:54:56

原帖由 风野胤 于 2007-7-21 14:53 发表
用opera和ie都屏蔽掉了

Scanning Log
NOD32 version 2410 (20070720) NT
Command line: R:\down.zip
Checking CRC of NOD32.EXE: Status OK
Scanning memory: Not performed (option disabled)
...

IE都会屏蔽
千年难得一见

显示全部楼层 · 发表于 2007-7-21 14:57:33

原帖由 woai_jolin 于 2007-7-21 14:54 发表

IE都会屏蔽
千年难得一见

不是

我用的IEPro

显示全部楼层 · 发表于 2007-7-21 15:46:36

原帖由 风野胤 于 2007-7-21 14:57 发表

不是
我用的IEPro

我就说嘛
===================================================================================================
NVCOD On Demand Scanner 5.80.02
NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/19 17:24:52 (812833 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 833174
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~OD86.tmp"
===================================================================================================
   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: F:\v\down.zip
      0 ms F:\v\down.zip : down.exe                                  Trojan W32/Delf.AJHD ()
      0 ms F:\v\down.zip
      0 ms F:\v\down.zip:Zone.Identifier
- File F:\v\down.zip quarantined.
===================================================================================================
The scanning started: 2007/07/21 15:43:26
            ended: 2007/07/21 15:43:26
Logged on as       : Administrator
on hostname       : BE29C0E1C4C9406
Scanning results:
Total number of files found..............................:    3
Number of files scanned..................................:    3
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    1
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    1
Copyright (c) 1993-2005 Norman ASA.

显示全部楼层 · 发表于 2007-7-21 16:05:08

運行down.exe，發現下列行為，被EQ-Secure RC4攔截！

2007-07-21 16:00:18 创建文件    操作:允许
进程路径:D:\桌面\virus\down\down.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Internet Explorer\PLUGINS\NewTemp.bak
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*

2007-07-21 16:00:19 创建文件    操作:允许
进程路径:D:\桌面\virus\down\down.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Internet Explorer\PLUGINS\NewTemp.dll
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*

2007-07-21 16:00:19 创建文件    操作:允许
进程路径:D:\桌面\virus\down\down.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\PegeFile.pif
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*

2007-07-21 16:00:19 创建文件    操作:允许
进程路径:D:\桌面\virus\down\down.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\autorun.inf
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*

2007-07-21 16:00:19 创建文件    操作:允许
进程路径:D:\桌面\virus\down\down.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\D
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*

2007-07-21 16:00:19 创建文件    操作:允许
进程路径:D:\桌面\virus\down\down.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\D\PegeFile.pif
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*

2007-07-21 16:00:20 创建文件    操作:允许
进程路径:D:\桌面\virus\down\down.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\D\autorun.inf
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*

1.他會在C\Program Files\Internet Explorer\PLUGINS\生成
NewTemp.bak
NewTemp.dll
2.他會在C\和D\生成
PegeFile.pif
autorun.inf

autorun.inf的結構

[autorun]
open=PegeFile.pif
shellexecute=PegeFile.pif
shell\Auto\command=PegeFile.pif
shell=Auto

显示全部楼层 · 发表于 2007-7-21 16:28:03

楼上好认真啊，又见你的身影

[病毒样本] 毒网 http://www.52blog.net/user6/133369/archives/2007/1121001.shtml