1x

幸福的猪猪

to kaspersky kill。（病毒样本运行之后，kaba 报毒）


Hello,

New malicious software was found in the attached file. Its detection will be included in the next update.
Thank you for your help.

Trojan.Win32.Agent.cryu



to KV kill。

[ 本帖最后由 幸福的猪猪 于 2009-7-27 13:56 编辑 ]

Palkia

昨天上报的今日还在分析中。。。

相思引

The file 'C:\Documents and Settings\Administrator\桌面\1.rar'
contained a virus or unwanted program 'TR/Crypt.XPACK.Gen' [trojan]
Action(s) taken:
The file was moved to '4adeeea4.qua'!

449201079

小A    MISS  

zhr5898

E:\1.rar>>time.exe        Trojan.Cap972621.hvlw        木马        还未处理

qwe12301

你指的是瑞星的，还是金山的？？

xyao

2009-7-27 10:55:29    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\administrator\my documents\1\time.exe
命令行: "C:\Documents and Settings\Administrator\My Documents\1\time.exe"
规则: [应用程序]*

2009-7-27 10:55:34    创建文件    阻止
进程: c:\documents and settings\administrator\my documents\1\time.exe
目标: C:\WINDOWS\system32\ro.dll
规则: [文件组]特殊目录 -> [文件]c:\windows\system32

2009-7-27 10:55:43    创建注册表项    阻止
进程: c:\documents and settings\administrator\my documents\1\time.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000006
规则: [注册表组]服务相关 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\*

2009-7-27 10:55:48    创建注册表项    阻止
进程: c:\documents and settings\administrator\my documents\1\time.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000006
规则: [注册表组]服务相关 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\*

2009-7-27 10:55:53    创建文件    允许
进程: c:\documents and settings\administrator\my documents\1\time.exe
目标: C:\Documents and Settings\Administrator\My Documents\1\99028del.bat
规则: [文件组]所有执行文件 -> [文件]*; *.bat

2009-7-27 10:56:05    创建新进程    阻止
进程: c:\documents and settings\administrator\my documents\1\time.exe
目标: c:\windows\system32\cmd.exe
命令行: cmd /c "C:\Documents and Settings\Administrator\My Documents\1\99028del.bat"
规则: [应用程序]*

wh0929

用kis2010扫描怎么不报？？但在virscan.org里扫描卡巴是找到病毒的呀，为什么会这样？