[f38935]昨天提取出来的，貌似卡巴扫描不出！

否山南斗

小红伞可以扫出来，avg扫不出来，但运行后可以检测出来。（奇怪！）

sb

卡巴7.0没有反应

jxxfcwb

AhnLab-V3 2007.7.31.1 2007.07.31 -
AntiVir 7.4.0.54 2007.07.31 -
Authentium 4.93.8 2007.07.30 -
Avast 4.7.1029.0 2007.07.31 -
AVG 7.5.0.476 2007.07.30 BackDoor.Hupigon.FKJ
BitDefender 7.2 2007.07.31 -
CAT-QuickHeal 9.00 2007.07.31 -
ClamAV 0.91 2007.07.31 -
DrWeb 4.33 2007.07.31 -
eSafe 7.0.15.0 2007.07.31 -
eTrust-Vet 31.1.5019 2007.07.31 -
Ewido 4.0 2007.07.31 -
FileAdvisor 1 2007.07.31 -
Fortinet 2.91.0.0 2007.07.31 -
F-Prot 4.3.2.48 2007.07.30 -
F-Secure 6.70.13030.0 2007.07.31 -
Ikarus T3.1.1.8 2007.07.31 Backdoor.Win32.Hupigon.cal
Kaspersky 4.0.2.24 2007.07.31 -
McAfee 5087 2007.07.31 -
Microsoft 1.2704 2007.07.31 -
NOD32v2 2429 2007.07.30 next archive volume not found
Norman 5.80.02 2007.07.31 -
Panda 9.0.0.4 2007.07.31 -
Rising 19.34.12.00 2007.07.31 -
Sophos 4.19.0 2007.07.26 -
Sunbelt 2.2.907.0 2007.07.31 -
Symantec 10 2007.07.31 -
TheHacker 6.1.7.159 2007.07.31 -
VBA32 3.12.2.2 2007.07.30 -
VirusBuster 4.3.26:9 2007.07.31 -
Webwasher-Gateway 6.0.1 2007.07.31 -

jxxfcwb

扫描结果和LZ说的相反～～～～～～～～

tracydk

xiaosdsd

卡巴主动防御报

tracydk

原帖由 否山南斗 于 2007-8-1 00:52 发表
小红伞可以扫出来，avg扫不出来，但运行后可以检测出来。（奇怪！）

内存监控

a256886572008

運行win32.exe，發現下列行為，被EQ-Secure RC4攔截！

2007-08-01 09:47:13    创建文件      操作:允许
进程路径:D:\desktop\virus\win32\win32\win32.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Common Files\Microsoft Shared\MSINFO\win32.exe
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-08-01 09:47:15    运行应用程序      操作:允许
进程路径:D:\desktop\virus\win32\win32\win32.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Common Files\Microsoft Shared\MSINFO\win32.exe
触发规则:所有程序规则->*


2007-08-01 09:47:15    创建文件      操作:允许
进程路径:D:\desktop\virus\win32\win32\win32.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*

2007-08-01 09:47:16    运行应用程序      操作:阻止
进程路径:D:\desktop\virus\win32\win32\win32.exe
文件路径:C:\windows\system32\cmd.exe
命令行:/c "C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat"
触发规则:所有程序规则->系統程序->%windir%\system32\cmd.exe


2007-08-01 09:47:17    修改文件      操作:允许
进程路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Common Files\Microsoft Shared\MSINFO\win32.exe
文件路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat
触发规则:黑名单->白名單->C:\Documents and Settings\HungAndy\Application Data\Sandbox\*


2007-08-01 09:47:18    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\HungAndy\Application Data\Sandbox\DefaultBox\drive\C\Program Files\Common Files\Microsoft Shared\MSINFO\win32.exe
文件路径:C:\windows\system32\cmd.exe
命令行:/c "C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat"
触发规则:所有程序规则->系統程序->%windir%\system32\cmd.exe

1.它會生成並運行
   C\Program Files\Common Files\Microsoft Shared\MSINFO\win32.exe
2.它會生成
   C\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat
3.它會運行C:\windows\system32\cmd.exe
   /c "C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat"
4.win32.exe會修改
   C\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat
5.win32.exe會運行C:\windows\system32\cmd.exe
   /c "C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat"

Delet.bat的結構

:try
del "C:\Program Files\Common Files\Microsoft Shared\MSINFO\win32.exe"
if exist "C:\Program Files\Common Files\Microsoft Shared\MSINFO\win32.exe" goto try
del %0

woai_jolin

fscs pass

kp2006

瑞星不报