磁碟机新变种 7F3537

wjzdw

瑞星也不认识   冒险运行  N多个提示后   提示恶意代码  干掉了~~

病毒名称: Malicious Code(恶意代码)
时间: 2008-02-13 10:19:49
活动的进程:  C:\WINDOWS\SYSTEM32\COM\LSASS.EXE;
创建的文件: C:\WINDOWS\SYSTEM32\COM\LSASS.EXE; C:\WINDOWS\SYSTEM32\COM\SMSS.EXE; C:\WINDOWS\SYSTEM32\COM\NETCFG.000; C:\WINDOWS\SYSTEM32\COM\NETCFG.DLL; C:\WINDOWS\SYSTEM32\COM\~;

[ 本帖最后由 wjzdw 于 2008-2-13 10:28 编辑 ]

kkgh

微点干掉

电影结束了

.......
NOD32怎么又G 了...
饿...
不是X开头的....
上报试试...

jimmyleo

prevx很有潜力

hj5abc

不知它是启发 还是沙盘 反正知道它很NB.

IllusionWing

是很有潜力。。扔给他一个死的样本居然说是malware....UG主程序也在他那儿变成了无恶不做的大坏蛋....http://www.prevx.com/filenames/2 ... 0/UGUARDUU.EXE.html

woai_jolin

prevx界面很华丽

挪威的冬天

信息        2008-02-13  12:38:05        您此次查毒共查出0个病毒以及危险代码                       
信息        2008-02-13  12:38:05        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件3个                       
信息        2008-02-13  12:38:05        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
信息        2008-02-13  12:38:05        金山毒霸主程序启动查毒过程，查毒方式：命令行查毒

sharkkong

嘿嘿，不要忘记卡巴还有主防哦
2008-2-13 13:21:44        进程 C:\Program Files\Sandboxie\Start.exe （PID: 3476）: 可疑操作，试图创建系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\windows nt\currentversion\winlogon  值:Shell  数据:x)。
2008-2-13 13:21:47        进程 C:\Program Files\Sandboxie\Start.exe （PID: 3476）: 试图创建系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\windows nt\currentversion\winlogon  值:Shell  数据:x)被允许。
2008-2-13 13:22:37        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 可疑操作，试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL  值:  数据:)。
2008-2-13 13:22:47        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL  值:  数据:)被允许。
2008-2-13 13:22:47        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 可疑操作，试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI  值:  数据:)。
2008-2-13 13:22:50        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI  值:  数据:)被允许。
2008-2-13 13:22:50        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 可疑操作，试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS  值:  数据:)。
2008-2-13 13:22:52        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS  值:  数据:)被允许。
2008-2-13 13:22:52        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 可疑操作，试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents  值:  数据:)。
2008-2-13 13:22:53        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents  值:  数据:)被允许。
2008-2-13 13:22:53        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 可疑操作，试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced  值:ShowSuperHidden  数据:0x00000000 (0))。
2008-2-13 13:22:55        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced  值:ShowSuperHidden  数据:0x00000000 (0))被允许。
2008-2-13 13:22:55        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 可疑操作，试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer  值:NoDriveTypeAutoRun  数据:0x00000091 (145))。
2008-2-13 13:22:58        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer  值:NoDriveTypeAutoRun  数据:0x00000091 (145))被允许。
2008-2-13 13:22:58        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 可疑操作，试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden  值:Type  数据:72 00 61 00 64 00 69 00 6f 00 00 00 6f 00 78 00 00 00 00 00 62 00 00 00 6f 00 00 00 78 00 00 00 00 00 00 00 57 00 69 00 6e 00 52 00 41 00 52 00 5c 00 57 00 69 00 6e 00 52 00 41 00 52 00 2e 00 65 00 78 00 65 00 22 00 20 00 22 00 25 00 31 00 22 00 00 00 52 00 00 00 41 00 00 00 52 00 00 00 5c 00 00 00 57 00 00 00 69 00 00 00 6e 00 00 00 52 00 00 00 41 00 00 00 52 00 00 00 2e 00 00 00 65 00 00 00 78 00 00 00 65 00 00 00 22 00 00 00 20 00 00 00 22 00 00 00 25 00 00 00 31 00 00 00 22 00 00 00 00 00 00 00 52 00 00 00 45 00 00 00 2e 00 00 00 45 00 00 00 58 00 00 00 45 00 00 00 22 00 00 00 20 00 00 00 25 00 00 00 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)。
2008-2-13 13:23:04        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden  值:Type  数据:72 00 61 00 64 00 69 00 6f 00 00 00 6f 00 78 00 00 00 00 00 62 00 00 00 6f 00 00 00 78 00 00 00 00 00 00 00 57 00 69 00 6e 00 52 00 41 00 52 00 5c 00 57 00 69 00 6e 00 52 00 41 00 52 00 2e 00 65 00 78 00 65 00 22 00 20 00 22 00 25 00 31 00 22 00 00 00 52 00 00 00 41 00 00 00 52 00 00 00 5c 00 00 00 57 00 00 00 69 00 00 00 6e 00 00 00 52 00 00 00 41 00 00 00 52 00 00 00 2e 00 00 00 65 00 00 00 78 00 00 00 65 00 00 00 22 00 00 00 20 00 00 00 22 00 00 00 25 00 00 00 31 00 00 00 22 00 00 00 00 00 00 00 52 00 00 00 45 00 00 00 2e 00 00 00 45 00 00 00 58 00 00 00 45 00 00 00 22 00 00 00 20 00 00 00 25 00 00 00 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)被允许。
2008-2-13 13:23:04        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 可疑操作，试图删除计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C749DF39-AADA-4507-A1CB-21EA09151AE3}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer  值:  数据:)。
2008-2-13 13:23:06        进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX03.906\Setup.exe （PID: 760）: 试图删除计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C749DF39-AADA-4507-A1CB-21EA09151AE3}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer  值:  数据:)被允许。
2008-2-13 13:23:10        进程  （PID 760） 试图访问卡巴斯基反病毒软件进程（PID 1924），该操作已被自我保护功能阻止，您不需要采取任何动作。
2008-2-13 13:23:10        进程  （PID 760） 试图访问卡巴斯基反病毒软件进程（PID 852），该操作已被自我保护功能阻止，您不需要采取任何动作。
2008-2-13 13:23:18        文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\netcfg.dll//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。
2008-2-13 13:23:18        已检测到安全威胁，建议您立即进行处理。
2008-2-13 13:23:31        文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\smss.exe: 检测到病毒
“Virus.Win32.Xorer.dt”。
2008-2-13 13:23:33        文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\netcfg.dll//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。
2008-2-13 13:23:33        文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\netcfg.000//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。
2008-2-13 13:23:38        文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\smss.exe: 已删除。
2008-2-13 13:23:39        文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\netcfg.dll: 已删除。
2008-2-13 13:23:39        文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\netcfg.dll 无法删除。
2008-2-13 13:23:42        文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\netcfg.000: 已删除。

挪威的冬天

生成物查杀日志

病毒        2008-02-13  13:53:12        病毒在文件D:\Sandbox\挪威的冬天\__Delete_VirusTest_01C86E04B7C1E7F9\drive\C\Windows\system32\com\smss.exe中        Win32.Troj.VcingDrop.le.40960        处理成功（操作：删除）       
病毒        2008-02-13  13:53:12        病毒在文件D:\Sandbox\挪威的冬天\__Delete_VirusTest_01C86E04B7C1E7F9\drive\C\Windows\system32\dnsq.dll中        Win32.Troj.VcingKeepT.d.23552        处理成功（操作：删除）       
病毒        2008-02-13  13:52:56        病毒在文件D:\Sandbox\挪威的冬天\VirusTest\drive\C\Windows\system32\com\netcfg.000中        Win32.Troj.NetvfgT.e.45056        处理成功（操作：删除）       
病毒        2008-02-13  13:52:53        病毒在文件D:\Sandbox\挪威的冬天\VirusTest\drive\C\Windows\system32\com\netcfg.dll中        Win32.Troj.NetvfgT.e.45056        处理成功（操作：删除）       
病毒        2008-02-13  13:52:51        病毒在文件D:\Sandbox\挪威的冬天\VirusTest\drive\C\Windows\system32\com\smss.exe中        Win32.Troj.VcingDrop.le.40960        拦截成功（文件被禁止访问）       
病毒        2008-02-13  13:52:46        病毒在文件D:\Sandbox\挪威的冬天\VirusTest\drive\C\NetApi000.sys中        Win32.VcingDrv.d.4096        处理成功（操作：删除）