hellboy

cfans

C:\Documents and Settings\admin\桌面\样本\HellBoy(20080620.3).zip > ZIP > HellBoy/HellBoyMain.exe - 未查明的 NewHeur_PE 病毒

C:\Documents and Settings\admin\桌面\样本\HellBoy(20080620.3).zip > ZIP > HellBoy/HellBoySYS.dat - 可能是 Win32/TrojanClicker.Agent.NCS 特洛伊木马 的变种

C:\Documents and Settings\admin\桌面\样本\HellBoy(20080620.3).zip > ZIP > HellBoy/beep.sys - 可能是 Win32/TrojanClicker.Agent.NCS 特洛伊木马 的变种

md5对比
26BB65BF8BCC9611ECBDC3454114DD63 HellBoyMain.exe
5DB7BE84C7B5B129CF9769D3675C2367 HellBoyDll.dat
FF4D9AFBAAB94D3C668ED1ACC152C211 HellBoySYS.dat
FF4D9AFBAAB94D3C668ED1ACC152C211 beep.sys

SREng日志表现：
不完整

服务
[网络服务 / Network Services][Stopped/Auto Start]
<C:\WINDOWS\HellBoy\HellBoyMain.exe><N/A>

或者

[网络服务 / Network Services][Running/Auto Start]
<C:\WINDOWS\HellBoy\HellBoyMain.exe><N/A>

正在运行的进程
[PID: 976 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
    [C:\WINDOWS\HellBoy\HellBoyDLL.dat] [N/A, ]

1.删除
c:\windows\hellboy\hellboydll.dat
c:\windows\hellboy\HellBoySYS.dat
c:\windows\hellboy\hellboymain.exe

2. 启动项目 －－ 服务 －－ Win32服务应用程序之如下项删除：
[网络服务 / Network Services]    <C:\WINDOWS\HellBoy\HellBoyMain.exe>

3.使用批处理脚本恢复可能被替换的Beep.sys

4.升级杀毒软件，扫描C盘;使用第三方安全工具检查系统漏洞，打全补丁。



[ 本帖最后由 cfans 于 2008-6-22 13:31 编辑 ]

changing

点开附件显示如下：
Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.
Requested URL:         http://bbs.kafan.cn/attachment.p ... 96&t=1214111541
Information:         Is the Trojan horse TR/Spy.Gen
Generated by AntiVir WebGuard 8.0.13.0, AVE 8.1.0.59, VDF 7.0.4.233

被FF给拦截了？？？

dannyxinyi

小A木有检测出来哎。。。
AVK也是

蜘蛛检测出来了

cgk508

红伞P

IllusionWing

3.

xiaoxi1981

试试

觅寒枚

LS的处女帖

fireworld

病毒        2008-06-24  09:18:23        C:\HellBoy.rar\HellBoy\HellBoyMain.exe        Win32.Troj.Unknown.33792        跳过，未处理       
病毒        2008-06-24  09:18:23        C:\HellBoy.rar\HellBoy\HellBoyDll.dat        Win32.Troj.Agent.ks.57344        跳过，未处理

woai_jolin

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

HellBoyMain.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS
    * Compressed: YES
    * TLS hooks: NO
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * Decompressing UPX3.
    * File length:        29184 bytes.
    * MD5 hash: 26bb65bf8bcc9611ecbdc3454114dd63.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

flying_wind

我用kis7.0...點擊下載就提示病毒了....