游戏泡霸网(变了)

hzyw

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.


Information:  Is the TR/Dldr.Agent.jkkg Trojan

浪滔天

卡巴 8.0.0.454

整体运行




解压后逐个运行






yy.exe  在临时文件夹下生成个 dll 文件后就没动静了。

reizhi

BD08 MISS

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Undef.dru

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.59.02

流清泉

变了

维生素B2

卡巴 杀了

zane_xzz

卡巴和BD都报了三个不同的

卡巴

扫描系统区域...
扫描所选择的目录和文件...
对象: gameSetup.exe ha_80046.exe
  在压缩档案里: F:\gameSetup.rar
状态: 已发现病毒
  病毒: Trojan-Downloader.Win32.Agent.acye (AVP引擎)
对象: gameSetup.exe pv0063.exe
  在压缩档案里: F:\gameSetup.rar
状态: 已发现病毒
  病毒: Trojan.Win32.Obfuscated.vaz (AVP引擎)
对象: gameSetup.exe/yy.exe data0003
  在压缩档案里: F:\gameSetup.rar
状态: 已发现病毒
  病毒: Trojan-Downloader.Win32.Delf.mpl (AVP引擎)

BD

扫描系统区域...
扫描所选择的目录和文件...
对象: gameSetup.exe=>(RAR Sfx o) ha_80046.exe
  在压缩档案里: F:\gameSetup.rar
状态: 已发现病毒
  病毒: Backdoor.Farfli.AH (Avast/BD引擎)
对象: gameSetup.exe=>(RAR Sfx o) pv0063.exe
  在压缩档案里: F:\gameSetup.rar
状态: 已发现病毒
  病毒: Trojan.Generic.601587 (Avast/BD引擎)
对象: gameSetup.exe=>(RAR Sfx o)=>yy.exe=>(NSIS o) lzma_nsis0002
  在压缩档案里: F:\gameSetup.rar
状态: 已发现病毒
  病毒: Trojan.Generic.662130 (Avast/BD引擎)

v_ww

ess3.0报3个
E:\Sandbox\wei\virus\user\current\桌面\gameSetup.rar > RAR > gameSetup.exe > RAR > ha_80046.exe - 可能是 Win32/TrojanDownloader.QQHelper.NHD 特洛伊木马 的变种
E:\Sandbox\wei\virus\user\current\桌面\gameSetup.rar > RAR > gameSetup.exe > RAR > pv0063.exe - Win32/TrojanDownloader.Adload.NFC 特洛伊木马 的变种
E:\Sandbox\wei\virus\user\current\桌面\gameSetup.rar > RAR > gameSetup.exe > RAR > yy.exe > NSIS > scvhost.exe - 可能是 Win32/TrojanDownloader.Delf.ATB 特洛伊木马 的变种

御擎

早就出了

tanlimo

已发现的更改   文件系统     已创建的文件夹  :     2     已删除的文件夹  :     0     已创建的文件    :    18     已删除的文件    :     0     已修改的文件    :     0     大小               : 2.49 MB   注册表     已创建的键      :    43     已删除的键      :     0     已创建的值      :    70     已删除的值      :     0     已修改的值      :     1     大小               : 3.92 KB 日志文件名称   C:\Documents and Settings\orz\Local Settings\Application Data\Martau\Total Uninstall 4\MonitoredApps\game63.tun 文件系统详细信息 [查看: 全部详细信息] (选定) --------------------------     (+)(文件夹) C:\Documents and Settings\All Users\Application Data\t        (+)(文件) a1796.dat = 2008-9-25 11:19, 279 字节, A        (+)(文件) b1796.dat = 2008-9-25 11:19, 243 字节, A        (+)(文件) k1796.dat = 2008-9-25 11:19, 5435 字节, A        (+)(文件) p1796.dat = 2008-9-25 11:19, 34466 字节, A        (+)(文件) r1796.dat = 2008-9-25 11:19, 4422 字节, A     (+)(文件夹) C:\Documents and Settings\All Users\Application Data\t\ad     (文件夹) C:\WINDOWS        (+)(文件) efba.txt = 2008-9-24 16:16, 114688 字节, RA        (+)(文件) efce.exe = 2008-9-24 16:17, 53248 字节, RA        (+)(文件) ffde.bmp = 2008-9-24 16:17, 679936 字节, RA     (文件夹) C:\WINDOWS\Downloaded Program Files        (+)(文件) 782ac.dll = 2008-9-25 11:20, 794624 字节, R     (文件夹) C:\WINDOWS\system32        (+)(文件) 076 = 2008-9-25 11:19, 68 字节, A        (+)(文件) 13-49-864 = 2008-9-25 11:19, 30 字节, A        (+)(文件) 2fg3.dll = 2008-9-24 16:17, 53248 字节, R        (+)(文件) -3-49-864 = 2008-9-25 11:19, 8 字节, A        (+)(文件) 3ff2.exe = 2008-9-24 16:16, 114688 字节, R        (+)(文件) 9fh2.dll = 2008-9-24 16:17, 679936 字节, R        (+)(文件) mwP1HZ.dll = 2004-8-17 12:00, 45056 字节, A     (文件夹) C:\WINDOWS\system32\drivers        (+)(文件) hvjpq.sys = 2004-8-17 12:00, 28096 字节, A     (文件夹) C:\WINDOWS\Tasks        (+)(文件) 782ac.job = 2008-9-25 11:20, 246 字节, A 注册表详细信息 [查看: 全部详细信息] (选定) -------------------------     (+)(注册表键) HKEY_LOCAL_MACHINE\SECURITY\Policy\Accounts\S-1-5-21-507921405-746137067-1957994488-1003        (+)(注册表值) (默认) = REG_BINARY, (0 字节数据)     (+)(注册表键) HKEY_LOCAL_MACHINE\SECURITY\Policy\Accounts\S-1-5-21-507921405-746137067-1957994488-1003\ActSysAc        (+)(注册表值) (默认) = REG_NONE, ....     (+)(注册表键) HKEY_LOCAL_MACHINE\SECURITY\Policy\Accounts\S-1-5-21-507921405-746137067-1957994488-1003\SecDesc        (+)(注册表值) (默认) = REG_NONE, ....H...X.............4..................... ... ............................... ... ...............     (+)(注册表键) HKEY_LOCAL_MACHINE\SECURITY\Policy\Accounts\S-1-5-21-507921405-746137067-1957994488-1003\Sid        (+)(注册表值) (默认) = REG_NONE, .............CF..%y,...t....     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A65132E7-A446-4730-A8B6-104C01EAAE16}        (+)(注册表值) (默认) = REG_SZ, "Invoke Class"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A65132E7-A446-4730-A8B6-104C01EAAE16}\InprocServer32        (+)(注册表值) (默认) = REG_SZ, "C:\WINDOWS\system32\2fg3.dll"        (+)(注册表值) ThreadingModel = REG_SZ, "Apartment"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A65132E7-A446-4730-A8B6-104C01EAAE16}\ProgID        (+)(注册表值) (默认) = REG_SZ, "IEHpr.Invoke.1"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A65132E7-A446-4730-A8B6-104C01EAAE16}\Programmable     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A65132E7-A446-4730-A8B6-104C01EAAE16}\TypeLib        (+)(注册表值) (默认) = REG_SZ, "{AE808C8F-88EB-473b-B6AA-FBC3BE807751}"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A65132E7-A446-4730-A8B6-104C01EAAE16}\VersionIndependentProgID        (+)(注册表值) (默认) = REG_SZ, "IEHpr.Invoke"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHpr.Invoke        (+)(注册表值) (默认) = REG_SZ, "Invoke Class"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHpr.Invoke\CLSID        (+)(注册表值) (默认) = REG_SZ, "{A65132E7-A446-4730-A8B6-104C01EAAE16}"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHpr.Invoke\CurVer        (+)(注册表值) (默认) = REG_SZ, "IEHpr.Invoke.1"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHpr.Invoke.1        (+)(注册表值) (默认) = REG_SZ, "Invoke Class"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHpr.Invoke.1\CLSID        (+)(注册表值) (默认) = REG_SZ, "{A65132E7-A446-4730-A8B6-104C01EAAE16}"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F5185C7-F09C-4C25-A9D1-2E1648EE4850}        (+)(注册表值) (默认) = REG_SZ, "IInvoke"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F5185C7-F09C-4C25-A9D1-2E1648EE4850}\ProxyStubClsid        (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F5185C7-F09C-4C25-A9D1-2E1648EE4850}\ProxyStubClsid32        (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F5185C7-F09C-4C25-A9D1-2E1648EE4850}\TypeLib        (+)(注册表值) (默认) = REG_SZ, "{AE808C8F-88EB-473B-B6AA-FBC3BE807751}"        (+)(注册表值) Version = REG_SZ, "1.0"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AE808C8F-88EB-473B-B6AA-FBC3BE807751}     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AE808C8F-88EB-473B-B6AA-FBC3BE807751}\1.0        (+)(注册表值) (默认) = REG_SZ, "Flash ocx 2.0 Type Library"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AE808C8F-88EB-473B-B6AA-FBC3BE807751}\1.0\0     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AE808C8F-88EB-473B-B6AA-FBC3BE807751}\1.0\0\win32        (+)(注册表值) (默认) = REG_SZ, "C:\WINDOWS\system32\2fg3.dll"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AE808C8F-88EB-473B-B6AA-FBC3BE807751}\1.0\FLAGS        (+)(注册表值) (默认) = REG_SZ, "0"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AE808C8F-88EB-473B-B6AA-FBC3BE807751}\1.0\HELPDIR        (+)(注册表值) (默认) = REG_SZ, "C:\WINDOWS\system32\"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A65132E7-A446-4730-A8B6-104C01EAAE16}     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\gtqnFHj        (+)(注册表值) dvaitc = REG_BINARY, J.96O.        (+)(注册表值) idtfj = REG_BINARY, *.R..6        (+)(注册表值) proaljl = REG_DWORD, 329194135        (+)(注册表值) uyad = REG_DWORD, -1336351747     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run        (+)(注册表值) 782b = REG_SZ, "rundll32 "C:\WINDOWS\Downlo~1\782b.dll",Run"     (+)(注册表键) HKEY_LOCAL_MACHINE\SOFTWARE\MSAD        (+)(注册表值) miniTM = REG_SZ, "1222341616"     (+)(注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HVJPQ        (+)(注册表值) NextInstance = REG_DWORD, 1     (+)(注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HVJPQ\0000        (+)(注册表值) Class = REG_SZ, "LegacyDriver"        (+)(注册表值) ClassGUID = REG_SZ, "{8ECC055D-047F-11D1-A537-0000F8753ED1}"        (+)(注册表值) ConfigFlags = REG_DWORD, 0        (+)(注册表值) DeviceDesc = REG_SZ, "hvjpq"        (+)(注册表值) Legacy = REG_DWORD, 1        (+)(注册表值) Service = REG_SZ, "hvjpq"     (+)(注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HVJPQ\0000\Control        (+)(注册表值) *NewlyCreated* = REG_DWORD, 0        (+)(注册表值) ActiveService = REG_SZ, "hvjpq"     (+)(注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSCSEVS        (+)(注册表值) NextInstance = REG_DWORD, 1     (+)(注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSCSEVS\0000        (+)(注册表值) Class = REG_SZ, "LegacyDriver"        (+)(注册表值) ClassGUID = REG_SZ, "{8ECC055D-047F-11D1-A537-0000F8753ED1}"        (+)(注册表值) ConfigFlags = REG_DWORD, 0        (+)(注册表值) DeviceDesc = REG_SZ, "MSCSevs"        (+)(注册表值) Legacy = REG_DWORD, 1        (+)(注册表值) Service = REG_SZ, "MSCSevs"     (+)(注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSCSEVS\0000\Control        (+)(注册表值) *NewlyCreated* = REG_DWORD, 0        (+)(注册表值) ActiveService = REG_SZ, "MSCSevs"     (注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application        (*)(注册表值) Sources         REG_MULTI_SZ, "WSH WMIAdapter WmdmPmSN WinMgmt Winlogon Windows Product Activation Windows 3.1 Migration WebClient VSS VBRuntime Userinit Userenv Tlntsvr SysmonLog Starter SpoolerCtrs Software Restriction Policies Software Installation SecurityCenter SclgNtfy SceSrv SceCli safrslv SAFrdms Remote Assistance PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Offline Files Oakley ntbackup MSSQLSERVER/MSDE MsiInstaller MSDTC Client MSDTC mnmsrvc Microsoft H.323 Telephony Service Provider LoadPerf HelpSvc Folder Redirection File Deployment EventSystem ESENT DrWatson DiskQuota crypt32 COM+ COM Ci Chkdsk AutoEnrollment Autochk Application Management Application Hang Application Error Application " ==> REG_MULTI_SZ, "MSCSevs WSH WMIAdapter WmdmPmSN WinMgmt Winlogon Windows Product Activation Windows 3.1 Migration WebClient VSS VBRuntime Userinit Userenv Tlntsvr SysmonLog Starter SpoolerCtrs Software Restriction Policies Software Installation SecurityCenter SclgNtfy SceSrv SceCli safrslv SAFrdms Remote Assistance PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Offline Files Oakley ntbackup MSSQLSERVER/MSDE MsiInstaller MSDTC Client MSDTC mnmsrvc Microsoft H.323 Telephony Service Provider LoadPerf HelpSvc Folder Redirection File Deployment EventSystem ESENT DrWatson DiskQuota crypt32 COM+ COM Ci Chkdsk AutoEnrollment Autochk Application Management Application Hang Application Error Application "     (+)(注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSCSevs        (+)(注册表值) EventMessageFile = REG_EXPAND_SZ, "C:\WINDOWS\system32\3ff2.exe"        (+)(注册表值) TypesSupported = REG_DWORD, 7     (+)(注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hvjpq        (+)(注册表值) DisplayName = REG_SZ, "hvjpq"        (+)(注册表值) ErrorControl = REG_DWORD, 1        (+)(注册表值) ImagePath = REG_EXPAND_SZ, "system32\drivers\hvjpq.sys"        (+)(注册表值) Start = REG_DWORD, 0        (+)(注册表值) Type = REG_DWORD, 1     (+)(注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hvjpq\Enum        (+)(注册表值) 0 = REG_SZ, "Root\LEGACY_HVJPQ\0000"        (+)(注册表值) Count = REG_DWORD, 1        (+)(注册表值) NextInstance = REG_DWORD, 1     (+)(注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hvjpq\Security        (+)(注册表值) Security = REG_BINARY, ................0.................................`......................................... ... ....................................... ...#...........................     (+)(注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSCSevs        (+)(注册表值) Description = REG_SZ, "MSCSevs"        (+)(注册表值) DisplayName = REG_SZ, "MSCSevs"        (+)(注册表值) ErrorControl = REG_DWORD, 1        (+)(注册表值) ImagePath = REG_EXPAND_SZ, "C:\WINDOWS\system32\3ff2.exe"        (+)(注册表值) ObjectName = REG_SZ, "LocalSystem"        (+)(注册表值) Start = REG_DWORD, 2        (+)(注册表值) Type = REG_DWORD, 272     (+)(注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSCSevs\Enum        (+)(注册表值) 0 = REG_SZ, "Root\LEGACY_MSCSEVS\0000"        (+)(注册表值) Count = REG_DWORD, 1        (+)(注册表值) NextInstance = REG_DWORD, 1     (+)(注册表键) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSCSevs\Security        (+)(注册表值) Security = REG_BINARY, ................0.................................`......................................... ... ....................................... ...#...........................