一个U盘里的毒。

完美孤儿

在U盘里找到的。病毒的图标像个文件夹。容易使人迷惑而中毒

[ 本帖最后由 完美孤儿 于 2007-10-14 08:03 编辑 ]

红心王子

2007-10-14        8:49:42        1192322982        Administrator        2344        Sign of "Win32:Agent-CWU [Wrm]" has been found in "D:\Downloads\毒[1].part1.rar\AUTORUN.EXE\[UPX]\[Embedded#07ef0]" file.

残缺的唯美

Malicious code found in file C:\Users\Administrator\Desktop\毒\AUTORUN.EXE.
Infection: Worm.Win32.Agent.o
Action: The file was deleted.

孤独更可靠

哈哈

这病毒我看了

会查找excel和word文档往外发送

破坏隐藏文件，内存映射，U盘感染

appinit_dlls加载

promised

C:\ABC\毒\AUTORUN.EXE - 特征码 'Trojan-PWS.Win32.OnLineGames.wp' 被发现
C:\ABC\毒\DESKTOP.INI

        2 文件被扫描
          (0 压缩档 0 文件)
        1 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.031

woai_jolin

2007-10-14 11:11:43    运行应用程序      操作:允许
进程路径:C:\WINDOWS\Explorer.EXE
文件路径:G:\V\AUTORUN.EXE
触发规则:黑名单->禁止执行程序的目录->G:\V\*


2007-10-14 11:11:43    修改文件      操作:阻止
进程路径:G:\V\AUTORUN.EXE
文件路径:G:\V\AUTORUN.EXE
触发规则:所有程序规则->全局设置_可执行文件1_普通模式->*.exe


2007-10-14 11:11:44    修改其它进程内存      操作:阻止
进程路径:G:\V\AUTORUN.EXE
目标进程:C:\WINDOWS\Explorer.EXE
触发规则:所有程序规则->系统程序_白名单->%windir%\explorer.exe


2007-10-14 11:11:45    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E871FD28-3317-43BA-AA03-403FFDEB9E70}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:11:46    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E871FD28-3317-43BA-AA03-403FFDEB9E70}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:11:48    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{814B227D-0171-4B55-B52F-98A68C0DCF84}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:11:48    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{814B227D-0171-4B55-B52F-98A68C0DCF84}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:11:52    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{266836EE-DBC0-42E6-8D63-44CB37064DE9}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:11:52    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{266836EE-DBC0-42E6-8D63-44CB37064DE9}
注册表名称:[Key]
触发规则:应用程序规则->自动创建规则->G:\V\AUTORUN.EXE->HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{266836EE-DBC0-42E6-8D63-44CB37064DE9}


2007-10-14 11:11:55    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D1390A0B-0109-49DD-82D6-68AD660089C6}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:11:55    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D1390A0B-0109-49DD-82D6-68AD660089C6}
注册表名称:[Key]
触发规则:应用程序规则->自动创建规则->G:\V\AUTORUN.EXE->HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D1390A0B-0109-49DD-82D6-68AD660089C6}


2007-10-14 11:11:57    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{86DCA863-8AAE-4B84-8111-2177BD99EA86}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:11:57    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{86DCA863-8AAE-4B84-8111-2177BD99EA86}
注册表名称:[Key]
触发规则:应用程序规则->自动创建规则->G:\V\AUTORUN.EXE->HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{86DCA863-8AAE-4B84-8111-2177BD99EA86}


2007-10-14 11:12:01    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{742F42D4-9EC1-4ECF-BE2D-F86A58F93F5D}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:12:01    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{742F42D4-9EC1-4ECF-BE2D-F86A58F93F5D}
注册表名称:[Key]
触发规则:应用程序规则->自动创建规则->G:\V\AUTORUN.EXE->HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{742F42D4-9EC1-4ECF-BE2D-F86A58F93F5D}


2007-10-14 11:12:04    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E5B0ADA1-E1DA-475B-A052-1DDE7C22DDC1}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:12:04    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E5B0ADA1-E1DA-475B-A052-1DDE7C22DDC1}
注册表名称:[Key]
触发规则:应用程序规则->自动创建规则->G:\V\AUTORUN.EXE->HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E5B0ADA1-E1DA-475B-A052-1DDE7C22DDC1}


2007-10-14 11:12:06    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{245F80C0-B36E-44AB-B3B5-D3C3D2AA7980}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:12:06    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{245F80C0-B36E-44AB-B3B5-D3C3D2AA7980}
注册表名称:[Key]
触发规则:应用程序规则->自动创建规则->G:\V\AUTORUN.EXE->HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{245F80C0-B36E-44AB-B3B5-D3C3D2AA7980}


2007-10-14 11:12:09    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{670792C7-2656-439A-8345-0656C08A6C4B}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:12:09    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{670792C7-2656-439A-8345-0656C08A6C4B}
注册表名称:[Key]
触发规则:应用程序规则->自动创建规则->G:\V\AUTORUN.EXE->HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{670792C7-2656-439A-8345-0656C08A6C4B}


2007-10-14 11:12:12    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0404AF0-2596-47DE-A113-0FD88C9E1113}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:12:12    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0404AF0-2596-47DE-A113-0FD88C9E1113}
注册表名称:[Key]
触发规则:应用程序规则->自动创建规则->G:\V\AUTORUN.EXE->HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0404AF0-2596-47DE-A113-0FD88C9E1113}


2007-10-14 11:12:15    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E9F6C0CD-F915-4F95-AD18-1CF22E32DF77}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:12:15    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E9F6C0CD-F915-4F95-AD18-1CF22E32DF77}
注册表名称:[Key]
触发规则:应用程序规则->自动创建规则->G:\V\AUTORUN.EXE->HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E9F6C0CD-F915-4F95-AD18-1CF22E32DF77}


2007-10-14 11:12:17    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1BF8A65A-5902-448C-A27F-B53417C89F4C}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:12:17    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1BF8A65A-5902-448C-A27F-B53417C89F4C}
注册表名称:[Key]
触发规则:应用程序规则->自动创建规则->G:\V\AUTORUN.EXE->HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1BF8A65A-5902-448C-A27F-B53417C89F4C}


2007-10-14 11:12:19    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B70F0FC3-5BAE-447B-9015-3166A5F3BB74}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:12:21    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B70F0FC3-5BAE-447B-9015-3166A5F3BB74}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-14 11:12:27    创建注册表值      操作:阻止
进程路径:G:\V\AUTORUN.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EB0C343B-1772-440C-A886-98ACAC92670A}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*

woai_jolin

Scanning Log
Version of virus signature database: 2590 (20071012)
Date: 14.10.2007  Time: 11:13:09
Scanned disks, folders and files: G:\V\AUTORUN.EXE;G:\V\DESKTOP.INI
G:\V\AUTORUN.EXE - Win32/Agent.NAR worm - cleaned by deleting (after the next restart) - quarantined [1,2]
G:\V\DESKTOP.INI - is OK
Number of scanned objects: 2
Number of threats found: 1
Time of completion: 11:13:14  Total scanning time: 5 sec (00:00:05)
Notes:
[1] Object has been deleted as it only contained the virus body.
[2] Object is in use (open or running). A system restart is required for the cleaning to complete.

woai_jolin

狂改注册表

Nblock

微点主动防御

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\毒'
C:\Users\morgan\Documents\毒\
  AUTORUN.EXE
      [DETECTION] Contains detection pattern of the worm WORM/Agent.O.2
      [INFO]      The file was deleted!
  DESKTOP.INI