机房产物。。。

Redevil

RT

Technical Details
Analysis Number	1
Parent ID	0
Process ID	1780
Filename	C:\file.exe
Filesize	19005 bytes
MD5	4d9143a18b691b517815edf5e89f8f76
Start Reason	AnalysisTarget
Termination Reason	NormalTermination
Start Time	00:00.094
Stop Time	00:05.188
DLL-Handling	Loaded DLLs
Filesystem	New Files C:\WINDOWS\system32\del.bat Opened Files \\.\PIPE\lsarpc \SystemRoot\AppPatch\sysmain.sdb \SystemRoot\AppPatch\systest.sdb \Device\NamedPipe\ShimViewer C:\WINDOWS\system32\del.bat Chronological order Get File Attributes: C:\WINDOWS\SYSTEM32\702AF42.EXE Flags: (SECURITY_ANONYMOUS) Get File Attributes: C:\WINDOWS\ Flags: (SECURITY_ANONYMOUS) Open File: \\.\PIPE\lsarpc (OPEN_EXISTING) Create File: C:\WINDOWS\system32\del.bat Open File: \SystemRoot\AppPatch\sysmain.sdb (OPEN_EXISTING) Open File: \SystemRoot\AppPatch\systest.sdb (OPEN_EXISTING) Open File: \Device\NamedPipe\ShimViewer (OPEN_EXISTING) Open File: C:\WINDOWS\system32\del.bat () Find File: del.bat
Registry	Changes HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "DisplayName" = 577B2F0B HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\577B2F0B "DisplayName" = 577B2F0B HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "Description" = 37AFE3 HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\577B2F0B "Description" = 37AFE3 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "ErrorControl" = [REG_DWORD, value: 00000001] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "ImagePath" = C:\WINDOWS\system32\702AF42.EXE -k HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\577B2F0B "ImagePath" = C:\WINDOWS\system32\702AF42.EXE -k HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "ObjectName" = LocalSystem HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\577B2F0B "ObjectName" = LocalSystem HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "Start" = [REG_DWORD, value: 00000002] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\577B2F0B "Type" = [REG_DWORD, value: 00000010] Reads HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter "Installed"
Process Management	Creates Process - Filename () CommandLine: (C:\WINDOWS\system32\del.bat) As User: () Creation Flags: () Kill Process - Filename () CommandLine: () Target PID: (1780) As User: () Creation Flags: () Enum Processes Open Process - Filename (C:\WINDOWS\Explorer.EXE) Target PID: (1452)
Service Management	Open Service Manager - Name: "SCM"
System Info	Get System Directory
Window	Find Window - Class Name (#32770) Window Name (½ðɽ¶¾°Ô) Enum Windows
Analysis Number	2
Parent ID	0
Process ID	712
Filename
Filesize	-1 bytes
MD5
Start Reason	SCM
Termination Reason	Unknown
Start Time	00:04.578
Stop Time	00:00.000
Analysis Number	3
Parent ID	0
Process ID	712
Filename
Filesize	-1 bytes
MD5
Start Reason	SCM
Termination Reason	Unknown
Start Time	00:04.609
Stop Time	00:00.000
The following process was started by process: 1
Analysis Number	4
Parent ID	1
Process ID	1376
Filename	C:\WINDOWS\system32\del.bat
Filesize	388608 bytes
MD5	eeb024f2c81f0d55936fb825d21a91d6
Start Reason	CreateProcess
Termination Reason	NormalTermination
Start Time	00:04.922
Stop Time	00:05.922
DLL-Handling	Loaded DLLs
Filesystem	Opened Files C:\WINDOWS\system32\del.bat Deleted Files C:\file.exe C:\WINDOWS\system32\del.bat Chronological order Get File Attributes: C:\ Flags: (SECURITY_ANONYMOUS) Find File: C:\ Find File: C:\WINDOWS\system32\del.bat Open File: C:\WINDOWS\system32\del.bat (OPEN_EXISTING) Get File Attributes: C:\FILE.EXE Flags: (SECURITY_ANONYMOUS) Find File: C:\FILE.EXE Delete File: C:\file.exe Get File Attributes: C:\WINDOWS\system32\del.bat Flags: (SECURITY_ANONYMOUS) Get File Attributes: C:\WINDOWS\system32 Flags: (SECURITY_ANONYMOUS) Delete File: C:\WINDOWS\system32\del.bat
Registry	Reads HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "DisableUNCCheck" HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "EnableExtensions" HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "DelayedExpansion" HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "DefaultColor" HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "CompletionChar" HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "PathCompletionChar" HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor "AutoRun" HKEY_CURRENT_USER\Software\Microsoft\Command Processor "DisableUNCCheck" HKEY_CURRENT_USER\Software\Microsoft\Command Processor "EnableExtensions" HKEY_CURRENT_USER\Software\Microsoft\Command Processor "DelayedExpansion" HKEY_CURRENT_USER\Software\Microsoft\Command Processor "DefaultColor" HKEY_CURRENT_USER\Software\Microsoft\Command Processor "CompletionChar" HKEY_CURRENT_USER\Software\Microsoft\Command Processor "PathCompletionChar" HKEY_CURRENT_USER\Software\Microsoft\Command Processor "AutoRun"
Process Management	Kill Process - Filename () CommandLine: () Target PID: (1376) As User: () Creation Flags: ()

Redevil

反病毒引擎	版本	最后更新	扫描结果
AhnLab-V3	2007.11.23.0	2007.11.22	-
AntiVir	7.6.0.34	2007.11.22	TR/Crypt.NSPM.Gen
Authentium	4.93.8	2007.11.21	-
Avast	4.7.1074.0	2007.11.22	Win32:AutoRun-IC
AVG	7.5.0.503	2007.11.22	Downloader.Generic6.VCR
BitDefender	7.2	2007.11.23	Win32.Worm.Winko.I
CAT-QuickHeal	9.00	2007.11.22	-
ClamAV	0.91.2	2007.11.23	-
DrWeb	4.44.0.09170	2007.11.22	Trojan.Popwin.679
eSafe	7.0.15.0	2007.11.21	suspicious Trojan/Worm
eTrust-Vet	31.3.5316	2007.11.22	-
Ewido	4.0	2007.11.22	-
FileAdvisor	1	2007.11.23	-
Fortinet	3.14.0.0	2007.11.23	-
F-Prot	4.4.2.54	2007.11.22	W32/Injector.A.gen!Eldorado
F-Secure	6.70.13030.0	2007.11.23	-
Ikarus	T3.1.1.12	2007.11.23	Trojan-PWS.Win32.Agent.BU
Kaspersky	7.0.0.125	2007.11.21	-
McAfee	5169	2007.11.22	New Poly Win32
Microsoft	1.3007	2007.11.23	VirTool:Win32/Obfuscator.A
NOD32v2	2679	2007.11.22	Win32/TrojanDownloader.Flux
Norman	5.80.02	2007.11.22	-
Panda	9.0.0.4	2007.11.23	Suspicious file

Graybird

Starting the file scan:

Begin scan in 'E:\auto.rar'
E:\auto.rar
  [0] Archive type: RAR
  --> auto.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!

SONGBOWEN

Begin scan in 'C:\Documents and Settings\Administrator\桌面\auto.rar'
C:\Documents and Settings\Administrator\桌面\auto.rar
  [0] Archive type: RAR
  --> auto.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING]   The file was ignored!

又报壳？！……
我恶心了……
KIS7过
2007-11-23 11:01:18        文件: C:\Documents and Settings\Administrator\桌面\auto.rar/auto.exe//#        正常        已扫描

tonger2003

啊弥陀佛

微点砍掉

Roboon

Roboon：程序:
D:\我的文档\桌面\AUTO.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\1730B18.EXE
2) C:\WINDOWS\SYSTEM32\3957BDED.DLL
是否删除木马程序及其衍生物?

wangjay1980

来挂主防吧

扫描一会杀

[ 本帖最后由 wangjay1980 于 2007-11-23 11:31 编辑 ]

傻猪猪米走鸡

D:\firefox download\auto.rar ?RAR ?auto.exe - Win32/TrojanDownloader.Flux 特洛伊木马 的变种

wu19934718

费尔，杀一木马