小狗木马

Nblock

微点杀

Found Sandbox: W32/Agent.CXFR.dropper; [ General information ]

* Accesses executable file from resource section.
* File length: 49152 bytes.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\system32\drivers\pcihdd.sys.
* Deletes file C:\WINDOWS\system32\drivers\pcihdd.sys.

[ Changes to registry ]
* Creates key "HKLM\System\CurrentControlSet\Services\PciHdd".
* Sets value "ImagePath"="C:\WINDOWS\system32\drivers\pcihdd.sys" in key "HKLM\System\CurrentControlSet\Services\PciHdd".
* Sets value "DisplayName"="PciHdd" in key "HKLM\System\CurrentControlSet\Services\PciHdd".

[ Process/window information ]
* Creates service "PciHdd (PciHdd)" as "C:\WINDOWS\system32\drivers\pcihdd.sys".
* Attempts to access service "PciHdd".

[ Signature Scanning ]
* C:\WINDOWS\system32\drivers\pcihdd.sys (6768 bytes) : W32/Agent.CXFR.

[ 本帖最后由 Nblock 于 2007-11-11 14:43 编辑 ]

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\BIG.rar'
C:\Users\morgan\Documents\
  BIG.rar
    [0] Archive type: RAR
    --> BIG.EXE
        [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!
Begin scan in 'C:\Users\morgan\Documents\big1.rar'
C:\Users\morgan\Documents\
  big1.rar
    [0] Archive type: RAR
    --> big1.exe
        [1] Archive type: RAR SFX (self extracting)
        --> runppc.exe
        --> ppc.exe
            [DETECTION] Contains detection pattern of the dropper DR/Agent.318861
            [WARNING]   Infected files in archives cannot be repaired!
          [2] Archive type: RAR SFX (self extracting)
          --> wpcap.dll
          --> npptools.dll
          --> drivers\npf.sys
          --> PVC.exe
              [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
              [WARNING]   Infected files in archives cannot be repaired!
          --> Packet.dll
          --> WanPacket.dll
          --> runpvc.exe
        [INFO]      The file was deleted!


End of the scan: 2007年11月10日  22:39
Used time: 00:06 min

The scan has been done completely.

      0 Scanning directories
     13 Files were scanned
      3 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      2 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     10 Files not concerned
      4 Archives were scanned
      3 Warnings
      0 Notes

woai_jolin

Scan Log
Version of virus signature database: 2652 (20071111)
Date: 2007-11-11  Time: 14:43:09
Scanned disks, folders and files: G:\V\BIG.rar;G:\V\big1.rar;G:\V\桌面.rar
G:\V\BIG.rar » RAR » BIG.EXE - a variant of Win32/Agent.NLW trojan - was a part of the deleted object
G:\V\big1.rar » RAR » big1.exe » RAR » runppc.exe - is OK
G:\V\big1.rar » RAR » big1.exe » RAR » ppc.exe » RAR » wpcap.dll - is OK
G:\V\big1.rar » RAR » big1.exe » RAR » ppc.exe » RAR » npptools.dll - is OK
G:\V\big1.rar » RAR » big1.exe » RAR » ppc.exe » RAR » drivers\npf.sys - is OK
G:\V\big1.rar » RAR » big1.exe » RAR » ppc.exe » RAR » PVC.exe - is OK
G:\V\big1.rar » RAR » big1.exe » RAR » ppc.exe » RAR » Packet.dll - is OK
G:\V\big1.rar » RAR » big1.exe » RAR » ppc.exe » RAR » WanPacket.dll - is OK
G:\V\big1.rar » RAR » big1.exe » RAR » ppc.exe » RAR » runpvc.exe - is OK
G:\V\big1.rar:Zone.Identifier - is OK
G:\V\桌面.rar » RAR
G:\V\桌面.rar:Zone.Identifier - is OK
Number of scanned objects: 12
Number of threats found: 1
Time of completion: 14:43:11  Total scanning time: 2 sec (00:00:02)

tracydk

微点卫士

[:26:]

big1 PASS

宇宙广博

残缺的唯美

咖啡全杀  最后1个带密码

a256886572008

yclidong

扫描进行于：2007-11-11 16:18:21
扫描日志
NOD32版本 2652 (20071111) NT
命令行： C:\Documents and Settings\Administrator\桌面\BIG.rar C:\Documents and Settings\Administrator\桌面\big1.rar C:\Documents and Settings\Administrator\桌面\桌面.rar

日期： 11.11.2007  时间：16:18:23
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Administrator\桌面\BIG.rar; C:\Documents and Settings\Administrator\桌面\big1.rar; C:\Documents and Settings\Administrator\桌面\桌面.rar
C:\Documents and Settings\Administrator\桌面\BIG.rar >>RAR >>BIG.EXE - Win32/Agent.NLW 木马的变种
已扫描的文件数目：9
已发现的病毒数目：1
完成时间： 16:18:24 总扫描时间：1 秒 (00:00:01)

qigang

桌面那包密码是多少？？