3个

显示全部楼层 · 发表于 2008-2-4 10:54:52

winhex.exe的日志

20:17:43 : 创建隐藏窗体成功20:17:43 : 复制 Loader 至 system32 目录成功20:17:43 : 没有检测到 avp.exe 卡巴斯基进程，无需加载 bypass 驱动20:17:43 : 准备安装 DelayLoad20:17:43 : DelayLoad 注册表键值安装完毕20:17:43 : 创建服务端 DLL 成功20:17:43 : 加载服务端 DLL 成功20:17:43 : LoadLibrary成功，等待Loader启动主函数20:17:43 : 创建工作线程成功，选择注入进程：svchost.exe20:17:43 : Loader 通知 DLL 注入 svchost.exe20:17:43 : 提升进程权限成功20:17:43 : 开始创建远程线程失败20:17:49 : Loader 自删除

显示全部楼层 · 发表于 2008-2-4 11:04:05

detected: Trojan program Backdoor.Win32.Visel.ah File: C:\Documents and Settings\Owner\×ÀÃæ\drive.rar/WinHex.exe

显示全部楼层 · 发表于 2008-2-4 11:05:08

Starting the file scan:

Begin scan in 'E:\drive.rar'
E:\drive.rar
  [0] Archive type: RAR
  --> WiNHeX32.dll
   [DETECTION] Is the Trojan horse TR/Agent.135168.11
  --> WinHex.exe
   [DETECTION] Is the Trojan horse TR/Agent.119512
   [WARNING] The file was ignored!

The file 'laf0.exe' has been determined to be 'UNDER ANALYSIS'.

上报~

显示全部楼层 · 发表于 2008-2-4 11:06:30

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\drive.rar'
C:\Documents and Settings\Administrator\My Documents\
  drive.rar
  drive.rar:Zone.Identifier
[0] Archive type: RAR
--> laf0.exe
--> WiNHeX32.dll
      [DETECTION] Is the Trojan horse TR/Agent.135168.11
      [WARNING] Infected files in archives cannot be repaired!
--> WinHex.exe
      [DETECTION] Is the Trojan horse TR/Agent.119512
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

End of the scan: 2008年2月3日  19:06
Used time: 00:06 min

The scan has been done completely.

   0 Scanning directories
   5 Files were scanned
   2 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   1 Archives were scanned
   3 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-4 11:07:19

不报的laf0.exe貌似是个尸体，没动作

显示全部楼层 · 发表于 2008-2-4 11:19:23

C:\DOCUMENTS AND SETTINGS\77\LOCAL SETTINGS\TEMP\TWIEX3\WINHEX.EXE Backdoor.Agent.yjr.eutd 后门还未处理
C:\Documents and Settings\77\My Documents\drive(1).rar>>laf0.exe>>emb-3.exe Hoax.Renos.asb.dbuq 病毒还未处理
C:\Documents and Settings\77\My Documents\drive(1).rar>>WinHex.exe Backdoor.Agent.yjr.eutd 后门还未处理

显示全部楼层 · 发表于 2008-2-4 11:20:31

ESET 1
C:\Documents and Settings\GUNDAM\桌面\drive.rar » RAR » WinHex.exe - a variant of Win32/Agent.ADW trojan

显示全部楼层 · 发表于 2008-2-4 11:22:51

信息 2008-02-04  11:22:10 您此次查毒共查出1个病毒以及危险代码
信息 2008-02-04  11:22:10 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件7个
信息 2008-02-04  11:22:10 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-02-04  11:22:10 C:\Users\挪威的冬天\Desktop\drive.rar\WiNHeX32.dll Win32.Hack.Agent.135168 跳过，未处理

显示全部楼层 · 发表于 2008-2-4 11:36:08

费尔
卡巴

显示全部楼层 · 发表于 2008-2-4 11:38:07

avast 2

[病毒样本] 3个

本帖子中包含更多资源

本帖子中包含更多资源