C97B92恶心的东西

zane_xzz

C97B92

tracydk

xxwpk007

2007-07-26 08:26:43    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:C:\Documents and Settings\Administrator\桌面\ass.scr
命令行:/S
触发规则:应用程序规则->自动创建规则->C:\windows\Explorer.EXE


2007-07-26 08:26:43    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\ass.scr
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\svchostc.exe
触发规则:所有程序规则->防御规则->%systemdrive%\*.exe


2007-07-26 08:26:43    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\ass.scr
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\svchostc.exe
触发规则:所有程序规则->防御规则->%systemdrive%\*.exe


2007-07-26 08:26:59    运行应用程序      操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\Administrator\桌面\ass.scr
文件路径:C:\windows\system32\verclsid.exe
命令行:/C {4964DBE3-1CB3-4A19-BA9D-5B629567B457} /I {00000000-0000-0000-C000-000000000046} /X 0x401

Nblock

微点的回答

红心王子

C:\Documents and Settings\Administrator\桌面\样本
.rar>>ass.scr>>svchostc.exe>>pecompact2x
Trojan.PSW.Win32.OnlineGames.cvo

微点卫士

费尔挂,金山报

傻猪猪米走鸡

时间        模块        对象        名称        病毒        操作        用户        信息
2007-7-26 8:42:59        文件监控        文件        F:\virus\样本3\ass.scr        Win32/PSW.Maran 木马 变种        已隔离 - 已删除                应用程序试图创建新文件时发生事件: d:\Program Files\WinRAR\WinRAR.exe. 文件已移至隔离区，你可以关闭此窗口。

jimmyleo

D:\download\t3\2.rar:\ass.scr\nice.jpg
D:\download\t3\2.rar:\ass.scr\svchostc.exe - Signature 'Generic.PWStealer' found
D:\download\t3\2.rar:\ass.scr
D:\download\t3\2.rar

        4 Files scanned
          (1 Archive with 3 files)
        1 Signature found
        0 Suspect code-parts found
        Used time: 0:00.460

dragonkf

AhnLab-V3	2007.7.26.0	2007.07.25	no virus found
AntiVir	7.4.0.50	2007.07.25	TR/Delphi.Downloader.Gen
Authentium	4.93.8	2007.07.25	no virus found
Avast	4.7.997.0	2007.07.26	Win32:Trojan-gen. {Other}
AVG	7.5.0.476	2007.07.25	no virus found
BitDefender	7.2	2007.07.25	Generic.PWStealer.7F0C6854
CAT-QuickHeal	9.00	2007.07.25	no virus found
ClamAV	0.91	2007.07.26	no virus found
DrWeb	4.33	2007.07.26	Trojan.PWS.Maran
eSafe	7.0.15.0	2007.07.24	no virus found
eTrust-Vet	31.1.5004	2007.07.25	no virus found
Ewido	4.0	2007.07.25	no virus found
FileAdvisor	1	2007.07.26	no virus found
Fortinet	2.91.0.0	2007.07.25	no virus found
F-Prot	4.3.2.48	2007.07.25	no virus found
F-Secure	6.70.13030.0	2007.07.25	no virus found
Ikarus	T3.1.1.8	2007.07.25	Generic.PWStealer
Kaspersky	4.0.2.24	2007.07.26	no virus found
McAfee	5082	2007.07.25	Generic PWS
Microsoft	1.2704	2007.07.25	TrojanSpy:Win32/Maran.gen!A
NOD32v2	2421	2007.07.26	a variant of Win32/PSW.Maran
Norman	5.80.02	2007.07.25	no virus found
Panda	9.0.0.4	2007.07.24	Suspicious file
Sophos	4.19.0	2007.07.17	Mal/Maran-A
Sunbelt	2.2.907.0	2007.07.26	no virus found
Symantec	10	2007.07.26	Infostealer.Phax
TheHacker	6.1.7.153	2007.07.25	no virus found
VBA32	3.12.2.1	2007.07.24	no virus found
VirusBuster	4.3.26:9	2007.07.25	no virus found
Webwasher-Gateway	6.0.1	2007.07.26	Trojan.Delphi.Downloader.Gen

woai_jolin

FSCS PASS上报