[病毒样本] 1x

显示全部楼层 · 发表于 2009-11-17 21:01:37

The file ''wueuclt.exe has been determined to be 'MALWARE'. Our analysts named the threat TR/Agent.471040. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

显示全部楼层 · 发表于 2009-11-17 21:05:59

McAfee miss

显示全部楼层 · 发表于 2009-11-17 21:29:19

kv主防报危险

显示全部楼层 · 发表于 2009-11-17 22:04:38

To KL

显示全部楼层 · 发表于 2009-11-17 23:11:40

to Sophos & ESET
Sophos
*NOTE: Please quote [#1444323] in the subject line of any further correspondence related to this query.

显示全部楼层 · 发表于 2009-11-18 10:00:32

IK Trojan-Dropper.Agent (Sig-Id:34067273)

·注册表项

  Key Name
     Watch subtree
     Notify Filter
     Count

  HKLM\
SOFTWARE\
CLASSES\
CLSID

     1
     Key Change,Value Change
     1

  HKLM\
Software\
Classes

     1
     Key Change,Value Change
     3

  HKLM\
Software\
Classes\
CLSID

     1
     Key Change,Value Change
     2

  HKLM\
Software\
Microsoft\
COM3

     1
     Key Change,Value Change
     6

  HKLM\
Software\
Microsoft\
Tracing\
RASAPI32

     0
     Attributes Change,Value Change,Security  Descriptor Change
     3

  HKLM\
System\
CurrentControlSet\
Services\
WinSock2\
Parameters\
NameSpace_Catalog5

     0
     Key Change
     1

  HKLM\
System\
CurrentControlSet\
Services\
WinSock2\
Parameters\
Protocol_Catalog9

     0
     Key Change
     1

  HKU

     1
     Key Change,Value Change
     5

  HKU\
S
     1
     5
     21


·文件删除
C:\Documents andSettings\Administrator\Local Settings\Temporary InternetFiles\Content.IE5\WDUF49AN\RemindSet[1].xml
C:\Documents andSettings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WDUF49AN\fankong[1].shtml

·文件创建
C:\Documents andSettings\Administrator\Local Settings\Temporary InternetFiles\Content.IE5\GPURSX23\pixviewer[1].swf
C:\Documents andSettings\Administrator\Local Settings\Temporary InternetFiles\Content.IE5\ODM3O1U3\fankong[1].htm
C:\Documents and Settings\Administrator\LocalSettings\Temporary Internet Files\Content.IE5\WDUF49AN\RemindSet[1].xml
C:\Documents andSettings\Administrator\Local Settings\Temporary InternetFiles\Content.IE5\WDUF49AN\fankong[1].shtml

·文件修改
C:\Documents andSettings\Administrator\Local Settings\Temporary InternetFiles\Content.IE5\GPURSX23\pixviewer[1].swf
C:\Documents andSettings\Administrator\Local Settings\Temporary InternetFiles\Content.IE5\ODM3O1U3\fankong[1].htm
C:\Documents andSettings\Administrator\Local Settings\Temporary InternetFiles\Content.IE5\WDUF49AN\RemindSet[1].xml
C:\Documents andSettings\Administrator\Local Settings\Temporary InternetFiles\Content.IE5\WDUF49AN\fankong[1].shtml
Ip
MountPointManager
PIPE\lsarpc
\Device\Afd\AsyncConnectHlp
\Device\Afd\Endpoint
\Device\Ip
\Device\NetBT_Tcpip_{1AD45B38-4060-4F73-BB1E-A0439A2D97EB}
\Device\RasAcd
\Device\Tcp

[ 本帖最后由 fengtaks 于 2009-11-18 22:30 编辑 ]

显示全部楼层 · 发表于 2009-11-18 12:10:47

neutralized by IKARUS

[病毒样本] 1x

本帖子中包含更多资源