hi.exe

Ｕｓｇｅｔ

a-squared	4.0.0.32	20090408050206	2009-04-08	-	2.362
AntiVir	7.9.0.138	7.1.3.27	2009-04-07	TR/Crypt.XDR.Gen	1.969
Authentium	5.1.1	200904071727	2009-04-07	W32/Heuristic-400!Eldorado (Heuristic)	1.108
AVAST!	3.0.1	090407-0	2009-04-07	-	0.911
AVG	7.5.52.442	270.11.46/2046	2009-04-07	-	2.054
BitDefender	7.81008.2834189	7.24662	2009-04-08	BehavesLike:Trojan.ShellHook	2.677
CA (VET)	9.0.0.143	31.6.6442	2009-04-07	-	6.909
ClamAV	0.95	9210	2009-04-07	-	0.010
Comodo	3.8	1102	2009-04-07	-	0.545
CP Secure	1.1.0.715	2009.04.08	2009-04-08	-	8.002
Dr.Web	4.44.0.9170	2009.04.07	2009-04-07	BACKDOOR.Trojan	4.341
F-Prot	4.4.4.56	20090407	2009-04-07	Possible W32/Heuristic-400!Eldorado (not disinfectable)	1.100
F-Secure	5.51.6100	2009.04.08.01	2009-04-08	-	0.080
GData	19.4466/19.292	20090408	2009-04-08	-	3.520
Ikarus	T3.1.01.49	2009.04.07.72541	2009-04-07	-	2.901
Microsoft	1.4502	2009.04.07	2009-04-07	TrojanDropper:Win32/Malf.gen	4.698
mks_vir	2.01	2009.04.07	2009-04-07	-	2.705
Norman	6.00.06	6.00.00	2009-04-03	-	8.006
nProtect	20090407.03	3428322	2009-04-07	BehavesLike:Trojan.ShellHook	4.547
Quick Heal	10.00	2009.04.07	2009-04-07	-	1.080
Sophos	2.85.0	4.40	2009-04-08	Mal/Dropper-O	2.120
Sunbelt	5079	5079	2009-04-06	-	8.651
The Hacker	6.3.4.0	v00303	2009-04-06	-	0.550
VBA32	3.12.10.2	20090406.1414	2009-04-06	-	2.024
ViRobot	20090406	2009.04.06	2009-04-06	-	0.399
VirusBuster	4.5.11.10	10.102.36/1220037	2009-04-07	-	1.500
卡巴斯基	5.5.10	2009.04.07	2009-04-07	-	0.071
安博士V3	2009.04.07.01	2009.04.07	2009-04-07	-	0.634
安天	2.0.18	20090407.2283465	2009-04-07	-	0.123
江民杀毒	11.0.706	2009.04.07	2009-04-07	-	1.892
熊猫卫士	9.05.01	2009.04.06	2009-04-06	Suspicious file	1.768
瑞星	20.0	21.23.40.00	2009-04-03	-	0.801
赛门铁克	1.3.0.24	20090407.003	2009-04-07	-	0.047
趋势科技	8.700-1004	5.944.02	2009-04-03	-	0.031
迈克菲	5.3.00	5577	2009-04-07	New Malware.ab	2.716
金山毒霸	2009.2.5.15	2009.4.7.21	2009-04-07	-	0.617
飞塔	2.81-3.117	10.258	2009-04-07	-	0.175

Sebastian

D:\kafan\hi.rar/hi[1].exe         已检测: BehavesLike!IK

左手

2009-04-08 09:34:07    创建文件      操作:阻止并结束进程
进程路径:E:\virus\hi[1].exe
文件路径:C:\WINDOWS\system32\hi[1].exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe


2009-04-08 09:34:07    创建文件      操作:阻止并结束进程
进程路径:E:\virus\hi[1].exe
文件路径:C:\WINDOWS\system32\hi[1].exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe

尤金卡巴斯基

To KL

kingsheet

过卡巴

smallyou93

释放文件：
%sys32dir%\hi[1].exe
%sys32dir%\bmo7khg8.dll

写入注册表：
[HKEY_CLASSES_ROOT\CLSID\{CB4369B6-F362-4e68-8786-0895D86C9D7A}]

[HKEY_CLASSES_ROOT\CLSID\{CB4369B6-F362-4e68-8786-0895D86C9D7A}\InProcServer32]
@="bmo7khg8.dll"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{CB4369B6-F362-4e68-8786-0895D86C9D7A}"="bmo7khg8.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="bmo7khg8.dll"

调出cmd删除自身及%sys32dir%\hi[1].exe

Palkia

to js

BING126

McAfee kill

ledled

to VB