又5个过伞的！

欠妳緈諨

上个月给一个MM机子上装了C伞，今天过去，在WINDOWS目录下捞到的，还有几个不小心被我删除了，这是幸存的

Joker

2.3.4没有运行起来，。5自己出错。。

1的产物红伞kill。。

Filename	Result
1.exe	MALWARE

The file '1.exe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Drop.Hijacker.A.The term "TR/" denotes a trojan horse that is able to spy out data, toviolate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

Filename	Result
2.exe	DAMAGED FILE (UNKNOWN)

The file '2.exe' has been determined to be 'DAMAGED FILE (UNKNOWN)'.In particular this means that this file is damaged and notworking properly. We could not find any malicious content. However theheuristic detection module may still detect this particular file eventhough it is damaged. In that case we will not adjust and removedetection for this damaged file.

Filename	Result
3.exe	MALWARE

The file '3.exe' has been determined to be 'MALWARE'.
Our analysts named the threat RKit/Agent.4608.1.The term „RKIT/“ denotes a piece of software that uses cloakingtechniques to hide itself from view. Therefore it has to be categorizedas potentially malicious.Detection will be added to our virus definition file (VDF) with one of the next updates.

Filename	Result
4.exe	MALWARE

The file '4.exe' has been determined to be 'MALWARE'.
Our analysts named the threat RKit/Agent.4608.2.The term „RKIT/“ denotes a piece of software that uses cloakingtechniques to hide itself from view. Therefore it has to be categorizedas potentially malicious.Detection will be added to our virus definition file (VDF) with one of the next updates.

Filename	Result
5.exe	DAMAGED FILE (MALWARE)

The file '5.exe' has been determined to be 'DAMAGED FILE (MALWARE)'.In particular this means that this file is damaged and notworking properly. Nevertheless we were able to determine that itcontains malicious code fragments.
Please note that you will receive an email which will contain theresults shown above. In case the final outcome of the analysis is notyet finished for all files the notification will be sent once ready.

[ 本帖最后由 Joker 于 2008-6-14 13:25 编辑 ]

kiki

SSm日志（free版）

－－－－－－－－－－1.exe－－－－－－－－－－－－－－－－
2008-6-14 13:28:13        C:\WINDOWS\system32\cmd.exe        程序关闭       

       
2008-6-14 13:28:08        C:\Documents and Settings\Administrator\桌面

\1.exe        程序关闭               
2008-6-14 13:28:06        C:\Documents and Settings\Administrator\桌面

\1.exe        创建进程        C:\WINDOWS\system32\cmd.exe        已允许
服务:\\Oij15        添加        Oij15        已停止                2008-6-14 13:27:58

－－－－－－－－－－－－－－－－－－5.exe－－－－－－－－－－－－

2008-6-14 13:30:07        C:\WINDOWS\system32\drwtsn32.exe        程序关

闭               
2008-6-14 13:30:07        C:\Documents and Settings\Administrator\桌面

\5.exe        程序关闭               
2008-6-14 13:30:06        C:\WINDOWS\system32\drwtsn32.exe        挂起线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:30:05        C:\WINDOWS\system32\drwtsn32.exe        打开线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:30:04        C:\WINDOWS\system32\drwtsn32.exe        终止进

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:30:02        C:\WINDOWS\system32\drwtsn32.exe        挂起线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:30:01        C:\WINDOWS\system32\drwtsn32.exe        挂起线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:56        C:\WINDOWS\system32\drwtsn32.exe        挂起线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:55        C:\WINDOWS\system32\drwtsn32.exe        挂起线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:54        C:\WINDOWS\system32\drwtsn32.exe        挂起线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:54        C:\WINDOWS\system32\drwtsn32.exe        挂起线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:53        C:\WINDOWS\system32\drwtsn32.exe        打开线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:52        C:\WINDOWS\system32\drwtsn32.exe        打开线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:51        C:\WINDOWS\system32\drwtsn32.exe        打开线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:51        C:\WINDOWS\system32\drwtsn32.exe        打开线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:50        C:\WINDOWS\system32\drwtsn32.exe        打开线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:49        C:\WINDOWS\system32\drwtsn32.exe        打开线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:48        C:\WINDOWS\system32\drwtsn32.exe        打开线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:46        C:\WINDOWS\system32\drwtsn32.exe        打开线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:45        C:\WINDOWS\system32\drwtsn32.exe        打开线

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:44        C:\WINDOWS\system32\drwtsn32.exe        创建远

程线程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:42        C:\WINDOWS\system32\drwtsn32.exe        写入虚

拟内存        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:39        C:\WINDOWS\system32\drwtsn32.exe        更改内

存属性        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:36        C:\WINDOWS\system32\drwtsn32.exe        调试进

程        C:\Documents and Settings\Administrator\桌面\5.exe        已允许
2008-6-14 13:29:28        C:\Documents and Settings\Administrator\桌面

\5.exe        创建进程        C:\WINDOWS\system32\drwtsn32.exe        已允许

[ 本帖最后由 kiki 于 2008-6-14 13:32 编辑 ]

欠妳緈諨

AVIRA的效率 赞一个

aerbeisi

C:\test\5.rar ?RAR ?1.exe - a variant of Win32/Wigon 木马

hahacomcn

原帖由 kiki 于 2008-6-14 13:25 发表
SSm日志（free版）

－－－－－－－－－－1.exe－－－－－－－－－－－－－－－－
2008-6-14 13:28:13        C:\WINDOWS\system32\cmd.exe        程序关闭        

        
2008-6-14 13:28:08        C:\Documents and Settings\Administrato ...

今天不是双休日么？

zwl2828

过伞的多了起来

kiki

今天不是双休日么？

小红伞双修日好像不上班吧

maxutao

难道现在做免杀，除了过卡巴，红伞也渐渐成为热门目标了

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： RootKit.Win32.Agent.bca  

用户来源：互联网

软件版本：20.48.50

费尔全杀