winamp.exe

尤金卡巴斯基

a-squared	4.5.0.24	2009.10.06	-
AhnLab-V3	5.0.0.2	2009.10.06	-
AntiVir	7.9.1.33	2009.10.06	TR/Crypt.ZPACK.Gen
Antiy-AVL	2.0.3.7	2009.10.05	-
Authentium	5.1.2.4	2009.10.06	-
Avast	4.8.1351.0	2009.10.06	-
AVG	8.5.0.420	2009.10.04	-
BitDefender	7.2	2009.10.06	-
CAT-QuickHeal	10.00	2009.10.06	(Suspicious) - DNAScan
ClamAV	0.94.1	2009.10.05	-
Comodo	2524	2009.10.06	-
DrWeb	5.0.0.12182	2009.10.06	-
eSafe	7.0.17.0	2009.10.05	-
eTrust-Vet	35.1.7053	2009.10.06	-
F-Prot	4.5.1.85	2009.10.05	-
F-Secure	8.0.14470.0	2009.10.06	-
Fortinet	3.120.0.0	2009.10.06	-
GData	19	2009.10.06	-
Ikarus	T3.1.1.72.0	2009.10.06	-
Jiangmin	11.0.800	2009.10.06	-
K7AntiVirus	7.10.862	2009.10.05	-
Kaspersky	7.0.0.125	2009.10.06	-
McAfee	5762	2009.10.05	-
McAfee+Artemis	5762	2009.10.05	-
McAfee-GW-Edition	6.8.5	2009.10.06	Trojan.Crypt.ZPACK.Gen
Microsoft	1.5101	2009.10.06	TrojanDropper:Win32/Preald.B
NOD32	4483	2009.10.06	-
Norman	6.01.09	2009.10.05	-
nProtect	2009.1.8.0	2009.10.06	-
Panda	10.0.2.2	2009.10.05	-
PCTools	4.4.2.0	2009.10.05	-
Prevx	3.0	2009.10.06	High Risk Cloaked Malware
Rising	21.49.22.00	2009.09.30	-
Sophos	4.45.0	2009.10.06	-
Sunbelt	3.2.1858.2	2009.10.05	-
Symantec	1.4.4.12	2009.10.06	-
TheHacker	6.5.0.2.031	2009.10.05	-
TrendMicro	8.950.0.1094	2009.10.06	-
VBA32	3.12.10.11	2009.10.05	-
ViRobot	2009.10.6.1972	2009.10.06	-
VirusBuster	4.6.5.0	2009.10.05	-

To KL

z2665

comodo miss，to
http://camas.comodo.com/cgi-bin/ ... 4e2842577a7a4237110

Palkia

RS20091006214805609969

Ayer

MD没有任何拦截动作，估计不是病毒。

mimimi

mcafee 8.7 网络高启发报特洛伊

xyao

ris2010

2009-10-6 22:37:45    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\administrator\my documents\winamp.exe
命令行: "C:\Documents and Settings\Administrator\My Documents\winamp.exe"
规则: [应用程序]*

2009-10-6 22:37:50    创建文件    允许
进程: c:\documents and settings\administrator\my documents\winamp.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\winamp.exe
规则: [文件组]临时目录 -> [文件]c:\documents and settings\administrator\local settings\temp; *.exe

2009-10-6 22:38:02    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\administrator\my documents\winamp.exe
命令行: "C:\Documents and Settings\Administrator\My Documents\winamp.exe"
规则: [应用程序]*

2009-10-6 22:38:07    修改文件    允许
进程: c:\documents and settings\administrator\my documents\winamp.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\winamp.exe
规则: [文件组]临时目录 -> [文件]c:\documents and settings\administrator\local settings\temp; *.exe

2009-10-6 22:38:10    创建新进程    允许
进程: c:\documents and settings\administrator\my documents\winamp.exe
目标: c:\documents and settings\administrator\local settings\temp\winamp.exe
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winamp.exe"
规则: [应用程序]*

2009-10-6 22:38:13    创建新进程    允许
进程: c:\documents and settings\administrator\my documents\winamp.exe
目标: c:\documents and settings\administrator\local settings\temp\d.tmp
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmp"
规则: [应用程序]*

2009-10-6 22:38:18    访问网络    允许
进程: c:\documents and settings\administrator\local settings\temp\d.tmp
目标: TCP [本机 : 1743] ->  [195.2.253.236 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2009-10-6 22:38:19    访问网络    允许
进程: c:\documents and settings\administrator\local settings\temp\d.tmp
目标: TCP [本机 : 1742] ->  [195.2.253.236 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2009-10-6 22:38:20    访问网络    允许
进程: c:\documents and settings\administrator\local settings\temp\d.tmp
目标: TCP [本机 : 1744] ->  [195.2.253.236 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2009-10-6 22:38:27    创建文件    允许
进程: c:\documents and settings\administrator\local settings\temp\d.tmp
目标: c:\cgcxo.exe
规则: [文件组]全局FD -> [文件]?:\; *.exe

2009-10-6 22:38:29    创建文件    允许
进程: c:\documents and settings\administrator\local settings\temp\d.tmp
目标: c:\siyfiejh.exe
规则: [文件组]全局FD -> [文件]?:\; *.exe

[ 本帖最后由 xyao 于 2009-10-6 22:41 编辑 ]

isis0322

avg miss

fengtaks

wap版看起来比较费眼神，呵呵~预留to VB

尤金卡巴斯基

winamp.exe - Trojan.Win32.Vilsel.huq

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

winxp0286

运行后..NOD报了..晕..


ESET NOD32 AntiVirus(TM) 4.0.467.0