[MD5: 901A62]

显示全部楼层 · 发表于 2007-7-31 18:27:09

微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\HIP.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\EC2BA0D6.EXE
2) C:\WINDOWS.0\SYSTEM32\D4D341E4.DLL
3) C:\WINDOWS.0\SYSTEM32\DELMEP.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\HIP.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\DELMEP.BAT
是否删除可疑程序?

显示全部楼层 · 发表于 2007-7-31 18:31:39

反病毒引擎版本最后更新扫描结果AhnLab-V32007.7.31.12007.07.31-AntiVir7.4.0.542007.07.31TR/Crypt.NSPM.GenAuthentium4.93.82007.07.30-Avast4.7.997.02007.07.30Win32:Agent-JOFAVG7.5.0.4762007.07.30-BitDefender7.22007.07.31GenPack:Generic.Popwin.64F2BF18CAT-QuickHeal9.002007.07.30(Suspicious) - DNAScanClamAV0.912007.07.31-DrWeb4.332007.07.31Trojan.Popwin.613eSafe7.0.15.02007.07.29suspicious Trojan/WormeTrust-Vet31.1.50192007.07.31-Ewido4.02007.07.30-FileAdvisor12007.07.31-Fortinet2.91.0.02007.07.31-F-Prot4.3.2.482007.07.30-F-Secure6.70.13030.02007.07.31Hupigon.gen66IkarusT3.1.1.82007.07.31Trojan-PWS.Win32.Agent.BUKaspersky4.0.2.242007.07.31Backdoor.Win32.Agent.ahjMcAfee50862007.07.30W32/Winko.worm.genMicrosoft1.27042007.07.31Backdoor:Win32/Popwin.gen!ANOD32v224292007.07.30probably a variant of Win32/Agent.NEONorman5.80.022007.07.30-Panda9.0.0.42007.07.31Suspicious filePrevx1V22007.07.31-Rising19.34.12.002007.07.31-Sophos4.19.02007.07.26Mal/EncPk-AISunbelt2.2.907.02007.07.31VIPRE.SuspiciousSymantec102007.07.31Trojan.PopwinTheHacker6.1.7.1592007.07.31-VBA323.12.2.22007.07.30suspected of Trojan-PSW.Game.63 (paranoid heuristics)VirusBuster4.3.26:92007.07.30-Webwasher-Gateway6.0.12007.07.31Trojan.Crypt.NSPM.Gen附加信息File size: 17615 bytesMD5: 0b92bfbd278eabc2229fce883f77bba5SHA1: c2acffee3e8aab1918f74bdc8e262b71cc9210bapackers: NsPackpackers: NSPack, PE_PatchSunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

显示全部楼层 · 发表于 2007-7-31 18:39:58

显示全部楼层 · 发表于 2007-7-31 19:55:09

fscs pass

显示全部楼层 · 发表于 2007-7-31 22:07:48

Virus: Backdoor.Win32.Agent.ahj

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2007-7-31 22:13:01

C：
└─WINDOWS
      └─system32
            86F0B238.EXE
            delmep.bat--------》@echo off
                                       :selfkill
                                       ping n 1 127.0.0.1 > nul
                                       del /F /Q "C:\DOCUMENTS AND SETTINGS\BLUEHEART\桌面\HIP.EXE"
                                       if exist "C:\DOCUMENTS AND SETTINGS\BLUEHEART\桌面\HIP.EXE" goto selfkill
                                       del %0

            402BA050.DLL

[病毒样本] [MD5: 901A62]

本帖子中包含更多资源

本帖子中包含更多资源