某软件捆绑的[F7104C 7BFB87]

promised

C:\ABC\virus.rar:\s.exe - 特征码 'Packed.Win32.Klone.af' 被发现
C:\ABC\virus.rar:\Swz16.dll - 特征码 'Trojan-Spy.Win32.Delf.uc' 被发现
C:\ABC\virus.rar

woai_jolin

2007-10-14 11:27:27    运行应用程序      操作:允许
进程路径:C:\WINDOWS\Explorer.EXE
文件路径:G:\V\s.exe
触发规则:黑名单->禁止执行程序的目录->G:\V\*


2007-10-14 11:27:28    创建文件      操作:允许(自动创建规则)
进程路径:G:\V\s.exe
文件路径:C:\Windows\System32\Swz90.dll


2007-10-14 11:27:28    修改其它进程内存      操作:允许(自动创建规则)
进程路径:G:\V\s.exe
目标进程:C:\WINDOWS\system32\winlogon.exe


2007-10-14 11:27:28    创建远程线程      操作:允许(自动创建规则)
进程路径:G:\V\s.exe
目标进程:C:\WINDOWS\system32\winlogon.exe


2007-10-14 11:27:29    创建文件      操作:允许(自动创建规则)
进程路径:G:\V\s.exe
文件路径:C:\Windows\System32\Swz47.bat


2007-10-14 11:27:29    创建注册表值      操作:允许(自动创建规则)
进程路径:C:\WINDOWS\system32\winlogon.exe
注册表路径:HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TrkWks
注册表名称:[Key]


2007-10-14 11:27:30    运行应用程序      操作:允许(自动创建规则)
进程路径:G:\V\s.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c C:\Windows\System32\Swz47.bat G:\V\s.exe


2007-10-14 11:27:30    创建注册表值      操作:允许(自动创建规则)
进程路径:C:\WINDOWS\system32\winlogon.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TrkWks
注册表名称:Asynchronous


2007-10-14 11:27:31    删除文件      操作:允许(自动创建规则)
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:G:\V\s.exe


2007-10-14 11:27:31    创建注册表值      操作:允许(自动创建规则)
进程路径:C:\WINDOWS\system32\winlogon.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TrkWks
注册表名称:Impersonate


2007-10-14 11:27:32    创建注册表值      操作:允许(自动创建规则)
进程路径:C:\WINDOWS\system32\winlogon.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TrkWks
注册表名称:DllName
注册表数据:C:\WINDOWS\system32\trkwkssw.dll


2007-10-14 11:27:36    创建注册表值      操作:阻止
进程路径:C:\WINDOWS\system32\winlogon.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TrkWks
注册表名称:Startup
注册表数据:IESetup
触发规则:所有程序规则->WinLogon->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon*

woai_jolin

Scanning Log
Version of virus signature database: 2590 (20071012)
Date: 14.10.2007  Time: 11:28:07
Scanned disks, folders and files: G:\V\Swz16.dll
G:\V\Swz16.dll - Win32/Hupigon.NFN trojan - cleaned by deleting - quarantined [1]
Number of scanned objects: 1
Number of threats found: 1
Time of completion: 11:28:09  Total scanning time: 2 sec (00:00:02)
Notes:
[1] Object has been deleted as it only contained the virus body.

a256886572008

樓上為何要用"學習模式"

wangjay1980

detected: Trojan program Trojan-Spy.Win32.Delf.uc        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/Swz16.dll

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\virus.rar'
C:\Users\morgan\Documents\
  virus.rar
  virus.rar:Zone.Identifier
    [0] Archive type: RAR
    --> s.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> Swz16.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S.EXE
是否删除木马程序及其衍生物?

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 533
Paranoia Database - 10451
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\s.exe - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\Swz16.dll - Infected Win32.Trojan-PSW.Delf.2

2 Files scanned
1 Infected files found
0 Suspected files found
0 Files cured
1 Files deleted

kkgh

AVG Anti-Spyware - 扫描报告
---------------------------------------------------------

+ 创建时间:        14:21:11 2007-10-14

+ 扫描结果:       



C:\Documents and Settings\zh\桌面\virus.rar/Swz16.dll -> Logger.Delf.uc : 未进行操作.

IllusionWing

...1

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.3.2
HC0.rlb = 2.9.1
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\s.exe 检测到 Packed.Unknown.Modified
检测到了 1 个未知的恶意程序，请上报。
任务 扫描 完成。共耗费的时间：0-00-00 00:00:00:0160，共扫描的文件数量：2，共扫描到的威胁数量：1，威胁率：50%，扫描速率： 12.5 文件/秒，扫描速度： 1759.38 千字节/秒，共扫描了 281.5 千字节。