转一只

solcroft

foxhound

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=76946 is infected with Trojan.Win32.Agent.ahp virus

aoyang

转的样本，没理由不杀

欠妳緈諨

AVAST  MISS

Giggs

Start of the scan: 2007年5月27日  23:38

Starting the file scan:

Begin scan in 'E:\下载\codec.zip'
E:\下载\codec.zip
  [0] Archive type: ZIP
  --> codec.exe
      [DETECTION] Is the Trojan horse TR/Agent.ahp.4
      [INFO]      A backup was created as '46bda662.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: 2007年5月27日  23:38
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
      2 Files were scanned
      1 viruses and/or unwanted programs were found
      0 classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

jlennon

Processes:
PID        ParentPID        User        Path       
--------------------------------------------------
2332        2172        MSEOSJD88JED:Administrator        C:\Documents and Settings\Administrator\桌面\codec\codec.exe       

Ports:
Port        PID        Type        Path       
--------------------------------------------------

Explorer Dlls:
DLL Path        Company Name        File Description       
--------------------------------------------------
No changes Found                       

IE Dlls:
DLL Path        Company Name        File Description       
--------------------------------------------------
No changes Found                       

Loaded Drivers:
Driver File        Company Name        Description       
--------------------------------------------------

Monitored RegKeys
Registry Key        Value       
--------------------------------------------------

Kernel31 Api Log
       
--------------------------------------------------
***** Installing Hooks *****       
71a270df     RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\WinSock2\Parameters)       
71a27cc4     RegOpenKeyExA (Protocol_Catalog9)       
71a2737e     RegOpenKeyExA (000000F3)       
71a2724d     RegOpenKeyExA (Catalog_Entries)       
71a278ea     RegOpenKeyExA (000000000001)       
71a278ea     RegOpenKeyExA (000000000002)       
71a278ea     RegOpenKeyExA (000000000003)       
71a278ea     RegOpenKeyExA (000000000004)       
71a278ea     RegOpenKeyExA (000000000005)       
71a278ea     RegOpenKeyExA (000000000006)       
71a278ea     RegOpenKeyExA (000000000007)       
71a278ea     RegOpenKeyExA (000000000008)       
71a278ea     RegOpenKeyExA (000000000009)       
71a278ea     RegOpenKeyExA (000000000010)       
71a278ea     RegOpenKeyExA (000000000011)       
71a278ea     RegOpenKeyExA (000000000012)       
71a278ea     RegOpenKeyExA (000000000013)       
71a22623     WaitForSingleObject(7a0,0)       
71a283c6     RegOpenKeyExA (NameSpace_Catalog5)       
71a2737e     RegOpenKeyExA (00000004)       
71a27f5b     RegOpenKeyExA (Catalog_Entries)       
71a280ef     RegOpenKeyExA (000000000001)       
71a280ef     RegOpenKeyExA (000000000002)       
71a280ef     RegOpenKeyExA (000000000003)       
71a22623     WaitForSingleObject(798,0)       
71a11afa     RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\Winsock2\Parameters)       
71a11996     GlobalAlloc()       
7c80b689     ExitThread()       
433395     LoadLibraryA(KERNEL32.DLL)=7c800000       
433591     LoadLibraryA(WININET.dll)=76680000       
433591     LoadLibraryA(SHLWAPI.dll)=77f40000       
433591     LoadLibraryA(KERNEL32.dll)=7c800000       
433591     LoadLibraryA(ADVAPI32.dll)=77da0000       
766cc271     RegSetValueExA (PrivacyAdvanced)       
7668a2d2     LoadLibraryA(urlmon.dll)=75c60000       
77f48b26     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\)       
77f48b26     RegOpenKeyExA (HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\)       
77f48b70     RegOpenKeyExA (HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\)       
77f512c0     RegOpenKeyExA (Ranges\)       
77dc97ae     LoadLibraryA(Secur32.dll)=77fc0000       
77f48b26     RegOpenKeyExA (HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\)       
77f48b70     RegOpenKeyExA (HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\)       
77f48b26     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\)       
77f48b26     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0)       
77f48b26     RegOpenKeyExA (HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0)       
77f48b70     RegOpenKeyExA (HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0)       
77f48b26     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1)       
77f48b26     RegOpenKeyExA (HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1)       
77f48b70     RegOpenKeyExA (HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1)       
75c6a442     WaitForSingleObject(7cc,ffffffff)       
77f48b26     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2)       
77f48b26     RegOpenKeyExA (HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2)       
77f48b70     RegOpenKeyExA (HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2)       
77f48b26     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3)       
77f48b26     RegOpenKeyExA (HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3)       
77f48b70     RegOpenKeyExA (HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3)       
77f48b26     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4)       
77f48b26     RegOpenKeyExA (HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4)       
77f48b70     RegOpenKeyExA (HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4)       
77f48b26     RegOpenKeyExA (HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\)       
77f48b70     RegOpenKeyExA (HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\)       
77f48b26     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\)       
77f48b26     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0)       
77f48b26     RegOpenKeyExA (HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0)       
77f48b70     RegOpenKeyExA (HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0)       
77f48b26     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1)       
77f48b26     RegOpenKeyExA (HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1)       
77f48b70     RegOpenKeyExA (HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1)       
77f48b26     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2)       
77f48b26     RegOpenKeyExA (HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2)       
77f48b70     RegOpenKeyExA (HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2)       
77f48b26     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3)       
77f48b26     RegOpenKeyExA (HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3)       
77f48b70     RegOpenKeyExA (HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3)       
77f48b26     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4)       
77f48b26     RegOpenKeyExA (HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4)       
77f48b70     RegOpenKeyExA (HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4)       
75c6a442     WaitForSingleObject(7c8,ffffffff)       
766840ce     RegOpenKeyExA (HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache)       
766840ce     RegOpenKeyExA (HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache)       
76687732     RegOpenKeyExA (HKLM\System\Setup)       
766840ce     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders)       
766840ce     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache)       
766840ce     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders)       
76686289     RegOpenKeyExA (Content)       
5d173344     GetVersionExA()       
5d1733ab     GetCommandLineA()       
5d174952     GetVersionExA()       
5d1754e8     GetCurrentProcessId()=2332       
5d175742     GetVersionExA()       
7d5f7057     GetVersionExA()       
7668804d     LoadLibraryA(shell32.dll)=7d590000       
77f469fd     WaitForSingleObject(760,0)       
76686289     RegOpenKeyExA (Paths)       
76686289     RegOpenKeyExA (Path1)       
76686289     RegOpenKeyExA (Path2)       
76686289     RegOpenKeyExA (Path3)       
76686289     RegOpenKeyExA (Path4)       
76686289     RegOpenKeyExA (Special Paths)       
766a2e9f     RegSetValueExA (Directory)       
766a2f04     RegSetValueExA (Paths)       
766a2e9f     RegSetValueExA (CachePath)       
766a2f04     RegSetValueExA (CacheLimit)       
76686289     RegOpenKeyExA (Cookies)       
76686289     RegOpenKeyExA (History)       
76683745     WaitForSingleObject(774,ffffffff)       
76686030     CreateFileA(C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat)       
766858fe     CreateFileA(C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat)       
76683745     WaitForSingleObject(76c,ffffffff)       
76686030     CreateFileA(C:\Documents and Settings\Administrator\Cookies\index.dat)       
766858fe     CreateFileA(C:\Documents and Settings\Administrator\Cookies\index.dat)       
76683745     WaitForSingleObject(75c,ffffffff)       
76686030     CreateFileA(C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat)       
766858fe     CreateFileA(C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat)       
76686289     RegOpenKeyExA (Extensible Cache)       
76687917     WaitForSingleObject(77c,ea60)       
76686289     RegOpenKeyExA (MSHist012007052220070523)       
76686289     RegOpenKeyExA (MSHist012007052320070524)       
76686289     RegOpenKeyExA (MSHist012007052420070525)       
76686289     RegOpenKeyExA (MSHist012007052520070526)       
76686289     RegOpenKeyExA (MSHist012007052620070527)       
76686289     RegOpenKeyExA (MSHist012007052720070528)       
76686289     RegOpenKeyExA (UserData)       
77f50e32     RegOpenKeyExA (HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings)       
76689713     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings)       
7668a6be     RegOpenKeyExA (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache)       
77f48b26     RegOpenKeyExA (HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings)       
766cc327     RegOpenKeyExA (HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache)       
766cc345     RegOpenKeyExA (HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache)       
766cc35e     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache)       
766cc37b     RegOpenKeyExA (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache)       
77f48b26     RegOpenKeyExA (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings)       
77f48d24     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings)       
766897e6     CreateMutex((null))       
766816f2     GetSystemTime()       
766990e7     CreateFileA(C:\Documents and Settings\Administrator\Cookies\administrator@wmvmedialease[1].txt)       
766e3524     CreateFileA(C:\Documents and Settings\Administrator\Cookies\administrator@wmvmedialease[1].txt)       
766e3130     WriteFile(h=738)       
766e3167     WriteFile(h=738)       
77f512c0     RegOpenKeyExA (Domains\wmvmedialease.com)       
77f48b70     RegOpenKeyExA (HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\wmvmedialease.com)       
75c6bd98     LoadLibraryA(WININET.dll)=76680000       
71a4108d     GetCurrentProcessId()=2332       
7668ac0f     LoadLibraryA(wsock32)=71a40000       
7668acb3     LoadLibraryA(ws2_32)=71a20000       
77f512c0     RegOpenKeyExA (ProtocolDefaults\)       
766990e7     CreateFileA(C:\Documents and Settings\Administrator\Cookies\administrator@wmvmedialease[2].txt)       
766e3524     CreateFileA(C:\Documents and Settings\Administrator\Cookies\administrator@wmvmedialease[2].txt)       
766e3130     WriteFile(h=734)       
766e3167     WriteFile(h=734)       
401193     CreateMutex(MutexMap)       
4011ab     WaitForSingleObject(734,1388)       
4011ab     WaitForSingleObject(738,1388)       
401084     CreateFileA(C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TFR65.tmp)       
4010a7     WriteFile(h=730)       
4018b3     CreateProcessA((null),regsvr32 C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TFR65.tmp /s,0,(null))       
7c816513     WaitForSingleObject(728,64)       
76d74cd7     LoadLibraryA(VERSION.dll)=77bd0000       
7c819154     LoadLibraryA(advapi32.dll)=77da0000       
10001e25     LoadLibraryA(psapi.dll)=76bc0000       
10001e66     GetCurrentProcessId()=2332       
76bc183b     ReadProcessMemory(h=730)       
76bc185a     ReadProcessMemory(h=730)       
76bc1878     ReadProcessMemory(h=730)       
76bc17bb     ReadProcessMemory(h=730)       
*****   Injecting C:\iDEFENSE\SysAnalyzer\api_log.dll into new process       
*****   OpenProcess Handle=730       
*****   Remote Allocation base: 90000       
*****   WriteProcessMemory=1 BufLen=23  BytesWritten:23       
*****   LoadLibraryA=7c801d77       
*****   CreateRemoteThread=72c       
401084     CreateFileA(C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TFR66.tmp)       
4010a7     WriteFile(h=71c)       
***** Install URLDownloadToFileA hook failed...Error: Asm Length failed? 0 JMP [B11788] Unknown identifier       
***** Install URLDownloadToCacheFile hook failed...Error: Asm Length failed? 0 JMP [B1178C] Unknown identifier       
4011ab     WaitForSingleObject(71c,1388)       
7c821a94     CreateFileA(C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TFR66.tmp)       
4019c3     WriteFile(h=720)       
71a22623     WaitForSingleObject(ac,0)       
71a22623     WaitForSingleObject(b4,0)       
77f53c22     RegCreateKeyExA (HKCR\AXVideoCodecExtension\CLSID,)       
77f53c3e     RegSetValueExA ((null))       
77f53c22     RegCreateKeyExA (HKCR\CLSID\{B4942DC4-69D1-4a63-9773-884C78C04459},)       
77f53c22     RegCreateKeyExA (HKCR\CLSID\{B4942DC4-69D1-4a63-9773-884C78C04459}\InprocServer32,)       
77f53c22     RegCreateKeyExA (HKCR\CLSID\{B4942DC4-69D1-4a63-9773-884C78C04459}\TypeLib,)       
77f53c22     RegCreateKeyExA (HKCR\CLSID\{B4942DC4-69D1-4a63-9773-884C78C04459}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4},)       
77f53c22     RegCreateKeyExA (HKCR\CLSID\{B4942DC4-69D1-4a63-9773-884C78C04459}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4},)       
77f53c22     RegCreateKeyExA (HKCR\TypeLib\{41D0F55C-009D-45c8-A26E-A6D5024D86C7}\1.0\0\Win32,)       
77c09d45     ExitProcess()       
***** Injected Process Terminated *****       
74681d36     GetCurrentProcessId()=2344       
74682056     GetCurrentProcessId()=2344       
7d5f6a01     GetCurrentProcessId()=2344       
14ec395     LoadLibraryA(KERNEL32.DLL)=7c800000       
14ec591     LoadLibraryA(WININET.dll)=76680000       
14ec591     LoadLibraryA(KERNEL32.dll)=7c800000       
14ec591     LoadLibraryA(USER32.dll)=77d10000       
14ec591     LoadLibraryA(ADVAPI32.dll)=77da0000       
14ec591     LoadLibraryA(SHELL32.dll)=7d590000       
14ec591     LoadLibraryA(ole32.dll)=76990000       
14ec591     LoadLibraryA(OLEAUT32.dll)=770f0000       
14ec591     LoadLibraryA(SHLWAPI.dll)=77f40000       
14ec591     LoadLibraryA(NETAPI32.dll)=5fdd0000       
14c99af     GetVersionExA()       
14c9a29     GetCommandLineA()       
14cc00a     GetCurrentProcessId()=2332       
14c6ab5     GetVersionExA()       
14a2679     ReadFile()       
4019da     LoadLibraryA(C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TFR66.tmp)=14a0000       
401a74     RegDeleteKeyA (HKCU\SOFTWARE\Microsoft\NBFC)       
14ade89     GetVersionExA()       
14a19ea     WaitForSingleObject(718,1770)       
14a1a51     RegCreateKeyExA (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,(null))       
14a1a64     RegDeleteKeyA (wmvmedialease codec)       
14a3491     Copy(C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TFR66.tmp->C:\windows\system32\ihhhbgag.dll)       
7c8283f4     WriteFile(h=718)       
14d32ff     LoadLibraryA(user32.dll)=77d10000       
73fbae76     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback)       
746826aa     GetVersionExA()       
746830a7     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\Compatibility\codec.exe)       
746830a7     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\SystemShared\)       
7468245b     CreateMutex(CTF.LBES.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7468245b     CreateMutex(CTF.Compart.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7468245b     CreateMutex(CTF.Asm.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7468245b     CreateMutex(CTF.Layouts.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7468245b     CreateMutex(CTF.TMD.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
746830a7     RegOpenKeyExA (HKCU\Keyboard Layout\Toggle)       
7468260a     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\)       
74684683     GetCurrentProcessId()=2332       
7468245b     CreateMutex(CTF.TimListCache.FMPDefaultS-1-5-21-1060284298-1214440339-682003330-500MUTEX.DefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7469d232     WaitForSingleObject(6f8,1388)       
746b556a     GetCurrentProcessId()=2332       
73658f33     GetVersionExA()       
73665225     GetVersionExA()       
7365d4f4     LoadLibraryA(C:\windows\system32\ole32.dll)=76990000       
7469d232     WaitForSingleObject(704,1388)       
7469d232     WaitForSingleObject(70c,1388)       
746830a7     RegOpenKeyExA (HKCU\SOFTWARE\Microsoft\CTF\LangBarAddIn\)       
746830a7     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\LangBarAddIn\)       
7468245b     CreateMutex(MSCTF.Shared.MUTEX.AAF)       
7469d232     WaitForSingleObject(6ec,1388)       
7469d91c     OpenProcess(pid=1344)       
7468245b     CreateMutex(MSCTF.Shared.MUTEX.ACJ)       
7469d232     WaitForSingleObject(6e0,1388)       
7469f824     WaitForSingleObject(6e8,0)       
14cdff4     ExitProcess()       
74681d36     GetCurrentProcessId()=2332       
74682056     GetCurrentProcessId()=2332       
7d5f6a01     GetCurrentProcessId()=2332       
76681808     WaitForSingleObject(74c,ffffffff)       

DirwatchData
       
--------------------------------------------------
WatchDir Initilized OK       
Watching C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp       
Watching C:\windows       
Watching C:\Program Files       
Created: C:\windows\Prefetch\SNIFF_HIT.EXE-1AB02EA8.pf       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TFR65.tmp       
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TFR65.tmp       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TFR66.tmp       
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TFR66.tmp       
Created: C:\windows\Prefetch\REGSVR32.EXE-25EEFE2F.pf       
Modifed: C:\windows\Prefetch\REGSVR32.EXE-25EEFE2F.pf       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET5D4A.tmp       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET67.tmp       
Deteled: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET67.tmp       
Deteled: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET5D4A.tmp       
Modifed: C:\windows\Debug\UserMode\userenv.log       
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFFC0E.tmp       
Deteled: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFFC0E.tmp       
Created: C:\windows\Prefetch\PROC_ANALYZER.EXE-3974E660.pf       
Modifed: C:\windows\Prefetch\PROC_ANALYZER.EXE-3974E660.pf       
Created: C:\windows\system32\ihhhbgag.dll       
Modifed: C:\windows\system32\ihhhbgag.dll       
Modifed: C:\windows\system32       
Created: C:\windows\Prefetch\CODEC.EXE-34A6611B.pf       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF645.tmp       
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF645.tmp

worker321

反病毒专家 AntiVirusKit 2006 扫描病毒日志记录
版本 16.0.7
双引擎反病毒签名 2007-5-27
开始时间: 2007-5-28 11:24
引擎: KAV 引擎 (AVK 16.10153), BD 引擎 (BD 16.6079)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: codec.exe
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\codec.zip
        Status: 已发现病毒
        病毒: Trojan.Win32.Agent.ahp (KAV 引擎)
对象: codec.zip
        路径: C:\Documents and Settings\Administrator\桌面
        Status: 已发现病毒
        病毒: Trojan.Win32.Agent.ahp (KAV 引擎)
扫描完成: 2007-5-28 11:24
    已检查 1 个文件
    已发现 1 个染毒文件
    发现 0 个可疑文件

鼻耳盖子

:\DOCUMENTS AND SETTINGS\MASTER.MASTE\LOCAL SETTINGS\TEMP\TFR93.TMP I:\TEST\070527\40\CODEC\CODEC.EXE