帮忙分析下～～

coolpeople

改系统时间 卡吧挂之～～～   病毒产生什么东东了 谢谢～～

无敌敏敏

Start of the scan: 2007年11月3日  20:37

Starting the file scan:

Begin scan in 'E:\Test.rar'
E:\Test.rar
  [0] Archive type: RAR
  --> most[1].exe
      [DETECTION] Is the Trojan horse TR/Agent.12556.1
      [INFO]      The file was deleted!

chenrui19930

谁有主防的看看

coolpeople

卡吧什么时候能防改系统时间 啊  啊  ～～～ 有FD和HIPS的帮帮忙～～

qigang

RX20.16.52未查杀。

zerosu6652

7.0的新测试版？

scottxzt

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\MOST[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\EB3FC60C.EXE
2) C:\WINDOWS\SYSTEM32\E5046A58.DLL
是否删除木马程序及其衍生物?

SONGBOWEN

卡巴6：
已检测: 病毒 Virus.Win32.AutoRun.zn        文件: C:\Documents and Settings\Administrator\桌面\most[1].exe//PE_Patch//UPack

小红伞：
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\most[1].exe'
C:\Documents and Settings\Administrator\桌面\most[1].exe
      [DETECTION] Is the Trojan horse TR/Agent.12556.1
      [WARNING]   The file was ignored!


BD2008：
Remaining issues:Object Name Threat Name Final Status
C:\Documents and Settings\Administrator\桌面\most[1].exe Generic.Malware.SBdldspg.66308E40 Infected

一会发SandBox的

SONGBOWEN

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

&#26700 : Not detected by Sandbox (Signature: W32/Zlob.ARRD)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: W32/Zlob.ARRD
    * Compressed: YES

[ General information ]
    * **Locates window "½ðɽ¶¾°Ô [class #32770]" on desktop.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\SYSTEM32\del.bat.

[ Changes to registry ]
    * Creates key "HKLM\System\CurrentControlSet\Services\FC5B1166".
    * Sets value "ImagePath"="C:\WINDOWS\SYSTEM32\16BF120E.EXE -k" in key "HKLM\System\CurrentControlSet\Services\FC5B1166".
    * Sets value "DisplayName"="FC5B1166" in key "HKLM\System\CurrentControlSet\Services\FC5B1166".
    * Sets value "Description"="C9C972BA" in key "HKLM\System\CurrentControlSet\Services\FC5B1166".
    * Creates key "HKCU\Software\SYSTEM\CurrentControlSet\Services\FC5B1166".
    * Sets value "Description"="C9C972BA" in key "HKCU\Software\SYSTEM\CurrentControlSet\Services\FC5B1166".
    * Sets value "DisplayName"="FC5B1166" in key "HKCU\Software\SYSTEM\CurrentControlSet\Services\FC5B1166".
    * Sets value "ErrorControl"="
" in key "HKLM\System\CurrentControlSet\Services\FC5B1166".
    * Sets value "ImagePath"="C:\WINDOWS\SYSTEM32\16BF120E.EXE -k" in key "HKCU\Software\SYSTEM\CurrentControlSet\Services\FC5B1166".
    * Sets value "ObjectName"="LocalSystem" in key "HKLM\System\CurrentControlSet\Services\FC5B1166".
    * Sets value "ObjectName"="LocalSystem" in key "HKCU\Software\SYSTEM\CurrentControlSet\Services\FC5B1166".
    * Sets value "Start"="" in key "HKLM\System\CurrentControlSet\Services\FC5B1166".
    * Sets value "Type"="" in key "HKLM\System\CurrentControlSet\Services\FC5B1166".

[ Process/window information ]
    * Enumerates running processes.
    * Attempts to access service "FC5B1166".
    * Creates service "FC5B1166 (FC5B1166)" as "C:\WINDOWS\SYSTEM32\16BF120E.EXE -k".

[ Signature Scanning ]
    * C:\WINDOWS\SYSTEM32\del.bat (97 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

coolpeople

原帖由 scottxzt 于 2007-11-3 20:45 发表
程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\MOST[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\EB3FC60C.EXE
2) C:\WINDOWS\SYSTEM32\E5046A58.DLL
是否删除木马程序及其衍生物?

这东东 在俺机子上在没这2个生成的东东