网马1个

显示全部楼层 · 发表于 2008-5-8 15:39:38

http://www.kingzoo.com/tools/greysign/aaa.exe

显示全部楼层 · 发表于 2008-5-8 15:40:57

Starting the file scan:

Begin scan in 'E:\AV\aaa.exe'
E:\AV\aaa.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    The file was moved to '4883af70.qua'!

显示全部楼层 · 发表于 2008-5-8 15:43:50

EAV

显示全部楼层 · 发表于 2008-5-8 15:46:35

金山 0

显示全部楼层 · 发表于 2008-5-8 15:53:06

发现文件， C:\Documents and Settings\Administrator\My Documents\aaa.exe，已感染 W32/Hupigon.A.gen!Eldorado

显示全部楼层 · 发表于 2008-5-8 16:39:29

The file 'aaa.exe' has been determined to be 'MALWARE'. Our analysts named the threat BDS/Hupigon.alu.69. The term "BDS/" denotes a Backdoor-Server program. Backdoor-Server programs are used to spy out, modify or delete data.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Crypted.

显示全部楼层 · 发表于 2008-5-8 16:45:10

瑞星监控 Backdoor.Win32.Gpigeon.aep

显示全部楼层 · 发表于 2008-5-8 16:56:32

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\AAA.EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\AAA.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM\SYSTEM.INI
是否删除木马程序及其衍生物?

程序:
C:\WINDOWS\SYSTEM\SYSTEM.INI
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?

显示全部楼层 · 发表于 2008-5-8 17:00:07

卡巴2009tr537没反应

显示全部楼层 · 发表于 2008-5-8 18:24:26

中标了，SEP没反应，后来它把系统时间改为1986-4-26了。

[已鉴定] 网马1个