faa0ac，这次俄国全军覆没！

dxzx

江民报

king6808

AhnLab-V3 2007.8.22.0 2007.08.24 -
AntiVir 7.4.1.63 2007.08.23 TR/Agent.OCI
Authentium 4.93.8 2007.08.23 -
Avast 4.7.1029.0 2007.08.24 Win32:Agent-KCP
AVG 7.5.0.484 2007.08.23 Agent.FJY
BitDefender 7.2 2007.08.24 GenPack:Generic.Popwin.E89513D4
CAT-QuickHeal 9.00 2007.08.23 (Suspicious) - DNAScan
ClamAV 0.91 2007.08.24 Trojan.Popwin-81
DrWeb 4.33 2007.08.23 -
eSafe 7.0.15.0 2007.08.23 Win32.Popwin
eTrust-Vet 31.1.5083 2007.08.24 -
Ewido 4.0 2007.08.23 Backdoor.Agent.ari
FileAdvisor 1 2007.08.24 -
Fortinet 2.91.0.0 2007.08.24 W32/Winko.A!tr
F-Prot 4.3.2.48 2007.08.23 -
F-Secure 6.70.13030.0 2007.08.24 Hupigon.gen66
Ikarus T3.1.1.12 2007.08.24 Virus.Win32.Agent.KCP
Kaspersky 4.0.2.24 2007.08.24 -
McAfee 5104 2007.08.23 W32/Winko.worm.gen
Microsoft 1.2803 2007.08.24 Backdoor:Win32/Popwin.gen!A
NOD32v2 2481 2007.08.24 probably a variant of Win32/Agent.NEO
Norman 5.80.02 2007.08.23 -
Panda 9.0.0.4 2007.08.24 Generic Malware

我是小菜鸟

卡吧到现在还保持沉默。。。。。。。。。。。

wangjay1980

卡巴认为没问题

woai_jolin

AA.exe : INFECTED with W32/Malware (Signature: Hupigon.gen66)


[ DetectionInfo ]
    * Sandbox name: W32/Malware
    * Signature name: Hupigon.gen66
    * Compressed: YES

[ General information ]
    * Drops files in %WINSYS% folder.
    * Creating several executable files on hard-drive.
    * File length:        17961 bytes.
    * MD5 hash: faa0acbf2087851d25314f76e425a713.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\SYSTEM32\D0C88136.EXE.
    * Creates file C:\WINDOWS\SYSTEM32\delme.bat.
    * Creates file C:\WINDOWS\SYSTEM32\694533E8.DLL.

[ Changes to registry ]
    * Creates key "HKLM\System\CurrentControlSet\Services\70979D08".
    * Sets value "ImagePath"="C:\WINDOWS\SYSTEM32\D0C88136.EXE -p" in
key "HKLM\System\CurrentControlSet\Services\70979D08".
    * Sets value "DisplayName"="70979D08" in key
"HKLM\System\CurrentControlSet\Services\70979D08".
    * Sets value "Description"="694533E8" in key
"HKLM\System\CurrentControlSet\Services\70979D08".
    * Creates key
"HKCU\Software\SYSTEM\CurrentControlSet\Services\70979D08".
    * Sets value "Description"="694533E8" in key
"HKCU\Software\SYSTEM\CurrentControlSet\Services\70979D08".
    * Sets value "DisplayName"="70979D08" in key
"HKCU\Software\SYSTEM\CurrentControlSet\Services\70979D08".
    * Sets value "ErrorControl"="
" in key
"HKLM\System\CurrentControlSet\Services\70979D08".
    * Sets value "ImagePath"="C:\WINDOWS\SYSTEM32\D0C88136.EXE -p" in
key "HKCU\Software\SYSTEM\CurrentControlSet\Services\70979D08".
    * Sets value "ObjectName"="LocalSystem" in key
"HKLM\System\CurrentControlSet\Services\70979D08".
    * Sets value "ObjectName"="LocalSystem" in key
"HKCU\Software\SYSTEM\CurrentControlSet\Services\70979D08".
    * Sets value "Start"="" in key
"HKLM\System\CurrentControlSet\Services\70979D08".
    * Sets value "Type"="" in key
"HKLM\System\CurrentControlSet\Services\70979D08".

[ Process/window information ]
    * Enumerates running processes.
    * Attempts to access service "70979D08".
    * Creates service "70979D08 (70979D08)" as
"C:\WINDOWS\SYSTEM32\D0C88136.EXE -p".
    * Enumerates running processes several parses....

[ Signature Scanning ]
    * C:\WINDOWS\SYSTEM32\D0C88136.EXE (17961 bytes) : no signature
detection.
    * C:\WINDOWS\SYSTEM32\delme.bat (95 bytes) : no signature
detection.
    * C:\WINDOWS\SYSTEM32\694533E8.DLL (40960 bytes) : no signature
detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information
source only.
这还叫没问题

[ 本帖最后由 woai_jolin 于 2007-8-24 16:38 编辑 ]

wangjay1980

经过偶的努力，终于杀了

deleted: Trojan program Backdoor.Win32.Agent.ahj        File: C:\Documents and Settings\Owner\×ÀÃæ\AA.rar/AA.exe

saga3721

大概这就是免杀造成的被其他杀软通杀

zwl2828

C:\Users\Administrator\Desktop\AA.rar » RAR » AA.exe - probably a variant of Win32/Agent.NEO trojan

沸沸

2007-8-24 18:08:50        文件: C:\Documents and Settings\Administrator\桌面\AA.exe        已损毁       
2007-8-24 18:08:50        文件: C:\Documents and Settings\Administrator\桌面\AA.exe        正常        已扫描

今取现在

卡7  下载时就被拦截