看图标应该是鸽子

The EQs

今天去抓了很多，先发一个上来让大家尝尝看

cy6266812

红伞报

Start of the scan: 2007年12月31日星期一  11:34

Starting the file scan:

Begin scan in 'F:\迅雷和浏览器下载\1.zip'
F:\迅雷和浏览器下载\1.zip
  [0] Archive type: ZIP
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年12月31日星期一  11:34
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
      2 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

yangpizhi

FP还是没报
-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.2
Virus signature file from: 2007-12-31, 5:54

Scan name: 12.31
Path to scan: C:\样本 yangpizhi\12.31\|

Thorough scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2007-12-31, 11:34:28
---------------------------------------------------------------------

[Clean]        Boot sector on drive F:
[Clean]        Boot sector on drive E:
[Clean]        Boot sector on drive D:
[Clean]        Boot sector on drive C:
[Clean]        Master Boot Record on disk 0
[Clean]        C:\样本 yangpizhi\12.31\1.zip->1.exe->(NSPack)->(PE_Patch)
[Clean]        C:\样本 yangpizhi\12.31\1.zip

---------------------------------------------------------------------
Scan ended:        2007-12-31, 11:34:41
Duration:        0:00:12

Scan result:

Scanned files:                 6
Infected objects:         0
Disinfected objects:         0
Quarantined files:         0
---------------------------------------------------------------------

Guace

病毒名称  Backdoor/Agent.akft
病毒类型  后门
危险级别  ★★
影响平台  Win 9X/ME/NT/2000/XP/2003
描述






这是一个『后门』病毒。

yjwfdc

2007-12-31 11:46:52    创建文件      操作:阻止
进程路径:F:\n收集\看图标应该是鸽子\2.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice46.exe
触发规则:所有程序规则->全局设置_可执行文件1_普通模式->%SystemDrive%\*.exe


2007-12-31 11:46:52    创建文件      操作:阻止
进程路径:F:\n收集\看图标应该是鸽子\2.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice46.exe
触发规则:所有程序规则->全局设置_可执行文件1_普通模式->%SystemDrive%\*.exe


2007-12-31 11:46:52    创建文件      操作:阻止
进程路径:F:\n收集\看图标应该是鸽子\2.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice46.exe
触发规则:所有程序规则->全局设置_可执行文件1_普通模式->%SystemDrive%\*.exe


2007-12-31 11:46:53    创建注册表值      操作:阻止
进程路径:C:\WINDOWS\system32\services.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Windows_rejoice46
注册表名称:[Key]
触发规则:所有程序规则->服务_普通模式->HKEY_LOCAL_MACHINE\SYSTEM\*controlset*\Services\*


2007-12-31 11:46:53    创建文件      操作:阻止
进程路径:F:\n收集\看图标应该是鸽子\2.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat
触发规则:所有程序规则->全局设置_可执行文件1->%SystemDrive%\*.bat


2007-12-31 11:46:56    修改其它进程内存      操作:阻止
进程路径:C:\WINDOWS\system32\drwtsn32.exe
目标进程:F:\n收集\看图标应该是鸽子\2.exe
触发规则:所有程序规则->*


2007-12-31 11:47:27    修改其它进程内存      操作:阻止
进程路径:C:\WINDOWS\system32\drwtsn32.exe
目标进程:F:\n收集\看图标应该是鸽子\2.exe
触发规则:所有程序规则->*

woai_jolin

1.exe : INFECTED with W32/Hupigon.gen67 (Signature: W32/Hupigon.gen67)


[ DetectionInfo ]
    * Sandbox name: W32/Hupigon.gen67
    * Signature name: W32/Hupigon.gen67
    * Compressed: YES
    * TLS hooks: YES
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * File length:       281146 bytes.
    * MD5 hash: 21f0948f622ee78ce6caeadc6a08ec8a.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

jehovah_king

Detected        http://bbs.kafan.cn/attachment.php?aid=176808/1.exe        Unknown threat Heur.Trojan.Generic

moonsilver

rs pass

qigang

Rising20.24.60不吃鸽子肉。

醉一生爱妍

江民KKKK