一个，卡巴挂[MD5: 3FFEB0]

xxwpk007

RT

啊弥陀佛

微点砍掉

残缺的唯美

--> vip.exe
        [DETECTION] Contains signature of the dropper DR/Delphi.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      A backup was created as '47269549.qua'  ( QUARANTINE )
        [INFO]      The file was deleted!

a256886572008

運行vip.exe，發現下列行為，被EQ-Secure V3.4攔截！

2007-08-06 11:25:23    修改注冊表內容      操作:阻止
進程路徑:D:\desktop\virus\vip3\vip.exe
注冊表路徑:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
注冊表名稱:PendingFileRenameOperations
注冊表數據:\??\C:\DOCUME~1\HungAndy\LOCALS~1\TEMPOR~1\Content.IE5\index.dat
觸發規則:所有程序規則->系統設置_普通模式->HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Session Manager


2007-08-06 11:25:23    創建文件      操作:阻止
進程路徑:D:\desktop\virus\vip3\vip.exe
文件路徑:C:\Documents and Settings\HungAndy\Local Settings\Temp\vip.dll
觸發規則:所有程序規則->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll


2007-08-06 11:25:24    創建注冊表值      操作:阻止
進程路徑:D:\desktop\virus\vip3\vip.exe
注冊表路徑:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
注冊表名稱:{389D65CA-DBAE-4C24-AF3B-CB9E2817195A}
觸發規則:所有程序規則->資源管理器->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks*


2007-08-06 11:25:24    運行應用程序      操作:阻止
進程路徑:D:\desktop\virus\vip3\vip.exe
文件路徑:C:\windows\system32\cmd.exe
命令行:/c del /f /a "D:\desktop\virus\vip3\vip.exe"
觸發規則:所有程序規則->系統程序->%windir%\system32\cmd.exe

1.它會修改注冊表內容
   HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
   PendingFileRenameOperations
   \??\C:\DOCUME~1\HungAndy\LOCALS~1\TEMPOR~1\Content.IE5\index.dat
2.它會生成
   C:\Documents and Settings\HungAndy\Local Settings\Temp\vip.dll
3.它會創建注冊表值
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
   {389D65CA-DBAE-4C24-AF3B-CB9E2817195A}
4.它會運行C:\windows\system32\cmd.exe
   /c del /f /a "D:\desktop\virus\vip3\vip.exe"

允許生成DLL

2007-08-06 11:40:39    修改注冊表內容      操作:阻止
進程路徑:D:\desktop\virus\vip3\vip.exe
注冊表路徑:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
注冊表名稱:PendingFileRenameOperations
注冊表數據:\??\C:\DOCUME~1\HungAndy\LOCALS~1\TEMPOR~1\Content.IE5\index.dat
觸發規則:所有程序規則->系統設置_普通模式->HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Session Manager


2007-08-06 11:40:41    創建文件      操作:允許
進程路徑:D:\desktop\virus\vip3\vip.exe
文件路徑:C:\Documents and Settings\HungAndy\Local Settings\Temp\vip.dll
觸發規則:所有程序規則->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll


2007-08-06 11:40:43    修改文件      操作:允許
進程路徑:D:\desktop\virus\vip3\vip.exe
文件路徑:C:\Documents and Settings\HungAndy\Local Settings\Temp\vip.dll
觸發規則:所有程序規則->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll


2007-08-06 11:40:43    安裝全局鈎子      操作:阻止
進程路徑:D:\desktop\virus\vip3\vip.exe
文件路徑:C:\DOCUME~1\HungAndy\LOCALS~1\Temp\vip.dll
觸發規則:所有程序規則->*

[ 本帖最后由 a256886572008 于 2007-8-6 11:44 编辑 ]

promised

谀哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪姆
?            VirusBlokAda (Console scanner)             ?
?Vba32 Windows/CL 3.12.2.2 / 2007.08.04 19:37 (Vba32.W) ?
?         Copyright (c) 1993-2007 by VBA Ltd.           ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯图
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Computer: PROMISED-CE046A
System: Windows XP
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /sfx /af+ /fd+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Program settings:
/r=susp.rpt /ha=3 /collect_suspects /nc /sfx /af+ /fd+ /ar+ /qu+ /ml+ /rw+

*:
C:\
C:\ABC\vip.rar:<RAR>\vip.exe : is suspected of Backdoor.Hupigon.5 (paranoid heuristics)
Program execution terminated by user


Directories       : 4       Files in archives:      Files on disks:
Archives:                   - total       : 2       - total       : 23   
- scanned         : 2       -  scanned    : 2       - scanned     : 22   
- contain viruses : 0       -  infected   : 0       - infected    : 0     
- deleted         : 0       -  suspicious : 1       - suspicious  : 1     

Startup    : 11:32:35 06-08-2007
End        : 11:32:40 06-08-2007
Total time : 00:00:05

红心王子

packers: UPX

报出来的并不多

VBA32又再乱报了

AhnLab-V3	2007.8.3.0	2007.08.03	-
AntiVir	7.4.0.57	2007.08.05	DR/Delphi.Gen
Authentium	4.93.8	2007.08.03	-
Avast	4.7.1029.0	2007.08.06	Win32:Cardspy-C
AVG	7.5.0.476	2007.08.05	-
BitDefender	7.2	2007.08.06	Generic.PWStealer.3A5982A9
CAT-QuickHeal	9.00	2007.08.04	-
ClamAV	0.91	2007.08.06	-
DrWeb	4.33	2007.08.05	-
eSafe	7.0.15.0	2007.07.31	suspicious Trojan/Worm
eTrust-Vet	31.1.5032	2007.08.04	-
Ewido	4.0	2007.08.05	-
FileAdvisor	1	2007.08.06	-
Fortinet	2.91.0.0	2007.08.06	-
F-Prot	4.3.2.48	2007.08.03	-
F-Secure	6.70.13030.0	2007.08.06	-
Ikarus	T3.1.1.8	2007.08.05	-
Kaspersky	4.0.2.24	2007.08.06	-
McAfee	5090	2007.08.03	-
Microsoft	1.2704	2007.08.06	-
NOD32v2	2438	2007.08.05	-
Norman	5.80.02	2007.08.03	-
Panda	9.0.0.4	2007.08.05	Suspicious file
Prevx1	V2	2007.08.06	-
Rising	19.34.40.00	2007.08.03	-
Sophos	4.19.0	2007.08.01	Mal/Heuri-E
Sunbelt	2.2.907.0	2007.08.04	-
Symantec	10	2007.08.06	Infostealer.Gampass
TheHacker	6.1.7.162	2007.08.04	-
VBA32	3.12.2.2	2007.08.04	suspected of Backdoor.Hupigon.5 (paranoid heuristics)
VirusBuster	4.3.26:9	2007.08.05	-
Webwasher-Gateway	6.0.1	2007.08.05	Trojan.Delphi.Gen

woai_jolin

onecare pass

绅博周幸

Win32:Cardspy-C [Trj]

woai_jolin

nod32 pass

taihuxian

Malicious code found in file C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\G65SMH11\vip[1].rar.
Infection: Trojan-Downloader.Win32.Delf.bnj
Action: none.