3X

SUZAKU

第一个文件是被360“云”出来的
第二个是GDNBS检测全盘出来的！
请大家看看有没有问题啦!

悠柚

Begin scan in 'D:\TDDownload\恶意插件.rar'
D:\TDDownload\恶意插件.rar
  [0] Archive type: RAR
    --> Winlans.exe
      [1] Archive type: RSRC
      [DETECTION] Is the TR/Dropper.Gen Trojan

悠柚

名称：
      Rootkit.Win32.Agent.dvo
文件：
      D:\TDDOWNLOAD\2E65BBF4.DAT 是后门程序，是否要删除此文件？
mpav miss two
D:\TDDownload\Win32s.dll    Trojan.StartPage.mnd.rgox.dll    木马    还未处理
D:\TDDownload\Winlans.exe>>emb-1.exe    Trojan.StartPage.mnc.pgts    木马    还未处理
D:\TDDownload\Winlans.exe>>emb-2.dll    Trojan.StartPage.mnd.rgox.dll    木马    还未处理

BING126

McAfee 报了1个。。
第一个     NO
第二个    Generic.dx!jy

Sebastian

Dear Sir or Madam,


Thank you for your recent inquiry.

We could not find a virus in the attachment you have sent us.
This is a false positive. We will take out the pattern recognition in one of our next updates.

We thank you for your assistance.

Attachment(s) you sent:

恶意插件.rar
--
Freundliche Grüsse / Best regards
Avira GmbH

zwl2828

To MMPC.

jochelliu

• Description
Suspicious Actions Detected
Creates files in windows system directory
Injects code into other processes
Registers dynamic link libraries

• Keys Created
Name Last Write Time
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED} 2009.01.12 14:48:03.812
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED}\Implemented Categories 2009.01.12 14:48:03.812
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} 2009.01.12 14:48:03.812
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED}\InprocServer32 2009.01.12 14:48:03.578
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED}\ProgID 2009.01.12 14:48:03.578
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED}\Programmable 2009.01.12 14:48:03.812
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED}\TypeLib 2009.01.12 14:48:03.578
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED}\VERSION 2009.01.12 14:48:03.578
LM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2009.01.12 14:48:08.265
LM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3040520-7987-45B9-8314-9458C41F6FED} 2009.01.12 14:48:08.265

• Values Created
Name Type Size Value
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED}\ REG_SZ 24 "???1.Win32"
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED}\InprocServer32\ REG_SZ 62 "C:\WINDOWS\system32\Win32s.dll"
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED}\InprocServer32\ThreadingModel REG_SZ 20 "Apartment"
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED}\ProgID\ REG_SZ 24 "???1.Win32"
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED}\TypeLib\ REG_SZ 78 "{1FCAD6CE-5811-4BFA-8127-77C456089958}"
LM\Software\Classes\ClsId\{A3040520-7987-45B9-8314-9458C41F6FED}\VERSION\ REG_SZ 8 "1.0"

• Files Created
Name Size Last Write Time Creation Time Last Access Time Attr
C:\WINDOWS\system32\Nservies.exe 184428 2009.01.12 14:48:01.281 2009.01.12 14:48:01.281 2009.01.12 14:48:01.281 0x20
C:\WINDOWS\system32\Win32s.dll 36864 2009.01.12 14:48:00.562 2009.01.12 14:48:00.562 2009.01.12 14:48:00.562 0x20

• Files Changed
Name Size Last Write Time Creation Time Last Access Time Attr
C:\WINDOWS\system32\config\software 8912896/8912896 2009.01.12 13:45:17.156/2009.01.12 14:48:03.546 2008.07.31 16:55:51.593/2008.07.31 16:55:51.593 2009.01.12 13:45:17.156/2009.01.12 13:45:17.156 0x20/0x20

• Threads Created
PId Process Name TId Start Start Mem Win32 Start Win32 Start Mem
0x344 svchost.exe 0x170 0x7c810856 MEM_IMAGE 0x7c910760 MEM_IMAGE

• Verdict
Auto Analysis Verdict
Rated as Suspicious

llzy3575

生成一个

1. 2009-06-19 22:26:14        文件保护(删除文件)     操作:阻止
   
2. 进程路径:C:\WINDOWS\System32\cmd.exe
   
3. 文件路径:C:\EQSandBox\C\WINDOWS\system32\NSERVIES.RAR
   
4. 2009-06-19 22:26:14        文件保护(删除文件)     操作:阻止
   
5. 进程路径:C:\WINDOWS\System32\cmd.exe
   
6. 文件路径:C:\EQSandBox\C\WINDOWS\system32\NSERVIES.EXE
   
7. 2009-06-19 22:26:14        文件保护(删除文件)     操作:阻止
   
8. 进程路径:C:\WINDOWS\System32\cmd.exe
   
9. 文件路径:C:\EQSandBox\C\WINDOWS\system32\NSERVIES.EXE
   
10. 2009-06-19 22:24:00        文件保护(删除文件)     操作:阻止
    
11. 进程路径:C:\Documents and Settings\Administrator\桌面\恶意插件1\Winlans.exe
    
12. 文件路径:C:\EQSandBox\C\Documents and Settings\Administrator\Local Settings\Temp\~DF7647.tmp

复制代码

[ 本帖最后由 llzy3575 于 2009-6-19 22:31 编辑 ]

kingmuro

已检测：木马程序 Rootkit.Win32.Agent.lgc        文件：D:\My Documents\桌面\test\恶意插件\2e65bbf4.dat

sam.to

TO KL