是在网吧，登陆游戏一直掉线！（附报告）

菜鸟练飞

文件名RichStart.exe，地下城的！看看是否有问题……用扫描网扫描的！

a-squared	4.5.0.24	2009.09.29	-
AhnLab-V3	5.0.0.2	2009.09.29	-
AntiVir	7.9.1.27	2009.09.29	-
Antiy-AVL	2.0.3.7	2009.09.29	-
Authentium	5.1.2.4	2009.09.29	W32/Nuj.A.gen!Eldorado
Avast	4.8.1351.0	2009.09.28	-
AVG	8.5.0.412	2009.09.29	-
BitDefender	7.2	2009.09.29	-
CAT-QuickHeal	10.00	2009.09.29	-
ClamAV	0.94.1	2009.09.29	-
Comodo	2467	2009.09.29	-
DrWeb	5.0.0.12182	2009.09.29	Win32.HLLW.Autoruner.4360
eSafe	7.0.17.0	2009.09.24	-
eTrust-Vet	31.6.6767	2009.09.29	-
F-Prot	4.5.1.85	2009.09.28	W32/Nuj.A.gen!Eldorado
F-Secure	8.0.14470.0	2009.09.29	-
Fortinet	3.120.0.0	2009.09.29	-
GData	19	2009.09.29	-
Ikarus	T3.1.1.72.0	2009.09.29	Trojan.Win32.FlyStudio
Jiangmin	11.0.800	2009.09.27	-
K7AntiVirus	7.10.855	2009.09.26	-
Kaspersky	7.0.0.125	2009.09.29	-
McAfee	5755	2009.09.28	-
McAfee+Artemis	5755	2009.09.28	-
McAfee-GW-Edition	6.8.5	2009.09.29	-
Microsoft	1.5005	2009.09.23	Backdoor:Win32/FlyAgent.F
NOD32	4465	2009.09.28	-
Norman	6.01.09	2009.09.28	-
nProtect	2009.1.8.0	2009.09.28	-
Panda	10.0.2.2	2009.09.28	-
PCTools	4.4.2.0	2009.09.28	-
Prevx	3.0	2009.09.29	-
Rising	21.49.11.00	2009.09.29	-
Sophos	4.45.0	2009.09.29	Mal/EncPk-GF
Sunbelt	3.2.1858.2	2009.09.29	-
Symantec	1.4.4.12	2009.09.29	-
TheHacker	6.5.0.2.021	2009.09.28	-
TrendMicro	8.500.0.1002	2009.09.29	-
VBA32	3.12.10.11	2009.09.29	Trojan-Dropper.Win32.Flystud.ko
ViRobot	2009.9.29.1961	2009.09.29	-
VirusBuster	4.6.5.0	2009.09.28	-

附加信息

File size: 2264417 bytes

MD5...: 02cd3b14b8eba056211abdbde12c8bd3

SHA1..: 11d28d8ad5bb51d4f5387ea9278f2b770fd3fd9a

SHA256: 19532b8469d1e7f2770b14cb466f51200ad84a733f2f4d08ff861892a50428ac

ssdeep: 49152:z/1JrPtdYHajqd1F1yUO2RuY6t6sPs4gIl+SsYyGnf9vNPQmBPZ3kW2:T1 J7tqTd16J2CMaCIlCYhjxPP2

PEiD..: -

PEInfo: -

RDS...: NSRL Reference Data Set -

pdfid.: -

trid..: RAR Archive (83.3%) REALbasic Project (16.6%)

sigcheck: publisher....: n/a copyright....: n/a product......: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments.....: n/a signers......: - signing date.: - verified.....: Unsigned

packers (Kaspersky): PE-Crypt.CF, PE-Crypt.CF, PE-Crypt.CF, PE-Crypt.CF, PE-Crypt.CF, PE-Crypt.CF, PE_Patch

packers (Authentium): PE-Crypt.CF

packers (F-Prot): PE-Crypt.CF

[ 本帖最后由 菜鸟练飞 于 2009-9-29 16:32 编辑 ]

hddu

2009-09-29 16:44:05    安装全局钩子      操作:阻止并结束进程
进程路径:E:\RichStart[1]\RichStart.exe
文件路径:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\Hide.dll
钩子类型:WH_GETMESSAGE
触发规则:所有程序规则->安装全局钩子->*\Temp\*.dll

[ 本帖最后由 hddu 于 2009-9-29 16:48 编辑 ]

sam.to

看图标便想到是毒

to kl,ll,antivir,mcafee,eset

The file 'RichStart.ex2e' has been determined to be 'UNDER ANALYSIS'.

http://sample.nod32.com.hk/index ... 1d2fee81f34be2c1d91

[ 本帖最后由 sam.to 于 2009-9-29 16:55 编辑 ]

菜鸟练飞

全局钩子？刚在百度里搜了下概念……记录键盘什么的！也就是这个网吧有问题的吧……刚重启了还是一直这样！以前我朋友在网吧也跟我这个情形，一直掉线！他还以为是他的QQ号的问题，我今天总算也遇到了……

菜鸟练飞

好黑暗啊……郁闷！这个网吧有问题……不过游戏里东西应该丢不了的，密保卡在手机里的！我朋友就丢过好几次了……

sam.to

The file 'RichStart.ex2e' has been determined to be 'MALWARE'. Our analysts named the threat BDS/FlyAgent.F.222. The term "BDS/" denotes a Backdoor-Server program. Backdoor-Server programs are used to spy out, modify or delete data.Detection is added to our virus definition file (VDF) starting with version 7.01.06.53.

sam.to

Trojan-Downloader.Win32.FlyStudio.gu. Thank you for your help.