[7512d6]这个东西有点新鲜

zane_xzz

CreateFile    C:\WINDOWS\system32\D4231B54.EXE
CreateRegKey    \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\747BEA68
CreateRegValue    \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\747BEA68\Description
CreateRegKey    \REGISTRY\USER\S-1-5-21-1275210071-1682526488-839522115-1003\SYSTEM
CreateRegKey    \REGISTRY\USER\S-1-5-21-1275210071-1682526488-839522115-1003\SYSTEM\CurrentControlSet
CreateRegKey    \REGISTRY\USER\S-1-5-21-1275210071-1682526488-839522115-1003\SYSTEM\CurrentControlSet\Services
CreateRegKey    \REGISTRY\USER\S-1-5-21-1275210071-1682526488-839522115-1003\SYSTEM\CurrentControlSet\Services\747BEA68
CreateRegValue    \REGISTRY\USER\S-1-5-21-1275210071-1682526488-839522115-1003\SYSTEM\CurrentControlSet\Services\747BEA68\Description
CreateRegValue    \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\747BEA68\DisplayName
CreateRegValue    \REGISTRY\USER\S-1-5-21-1275210071-1682526488-839522115-1003\SYSTEM\CurrentControlSet\Services\747BEA68\DisplayName
CreateRegValue    \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\747BEA68\ErrorControl
CreateRegValue    \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\747BEA68\ImagePath

The EQs

Scan performed at: 2007-6-6 8:14:33
Scanning Log
NOD32 version 2310 (20070605) NT
Command line: C:\Documents and Settings\EQ2\桌面\framecom.rar
Operating memory - is OK

Date: 6.6.2007  Time: 08:14:37
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\framecom.rar
C:\Documents and Settings\EQ2\桌面\framecom.rar ?RAR ?framecom\FramesNet.CoM - a variant of Win32/Agent.NEO trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 08:14:37 Total scanning time: 0 sec (00:00:00)

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\framecom.rar'
C:\Documents and Settings\Administrator\My Documents\
  framecom.rar
    [0] Archive type: RAR
    --> framecom\FramesNet.CoM
        [DETECTION] Is the Trojan horse TR/Popwin.CF
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

红心王子

已删除: 病毒 Trojan.Generic (变种)        文件: C:\Documents and Settings\Administrator\桌面\framecom.rar/framecom\FramesNet.CoM
卡巴7干掉

taihuxian

Virus: Win32:Agent-HFX [Trj]

Virus found while downloading Web content.

Address: bbs.kafan.cn

l784588

Avast 报Win32:Agent-GPD [Trj].

tracydk

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-6-6
Start time: 2007-6-6 10:08
Engine(s): KAV engine (AVK 17.5733), BD-Engine (BD 17.5315)
Heuristic: On
Archives: On
System areas: Off

Check selected directories and files...
Object: FramesNet.CoM
        Path: C:\Documents and Settings\Administrator\桌面\framecom\framecom
        Status: Move file into quarantine
        Virus: GenPack:Trojan.Popwin.CF (BD-Engine)
Analysis complete: 2007-6-6 10:08
    1 files checked
    1 infected files detected
    0 suspected files detected

solcroft

这只狗好难养
才发现到设置新规则后要重启，要不它什么都给你来个default reject

foxhound

Antivirus	Version	Update	Result
AhnLab-V3	2007.5.31.2	06.05.2007[td]no virus found
AntiVir	7.4.0.32	06.05.2007	TR/Popwin.CF
Authentium	4.93.8	05.23.2007[td]no virus found
Avast	4.7.997.0	06.05.2007	Win32:Agent-GPD
AVG	7.5.0.467	06.05.2007[td]no virus found
BitDefender	7.2	06.06.2007	GenPack:Trojan.Popwin.CF
CAT-QuickHeal	9.00	06.05.2007	(Suspicious) - DNAScan
ClamAV	devel-20070416	06.06.2007[td]no virus found
DrWeb	4.33	06.06.2007	Trojan.Popwin
eSafe	7.0.15.0	06.05.2007	suspicious Trojan/Worm
eTrust-Vet	30.7.3693	06.05.2007[td]no virus found
Ewido	4.0	06.05.2007	Backdoor.Agent.ahj
FileAdvisor	1	06.06.2007[td]no virus found
Fortinet	2.85.0.0	06.06.2007	W32/Agent.NEO!tr
F-Prot	4.3.2.48	06.05.2007[td]no virus found
F-Secure	6.70.13030.0	06.05.2007	Hupigon.gen66
Ikarus	T3.1.1.8	06.05.2007	Backdoor.Win32.Agent.ahj
Kaspersky	4.0.2.24	06.06.2007[td]no virus found
McAfee	5046	06.05.2007	New Malware.dm
Microsoft	1.2503	06.05.2007	Backdoor:Win32/Popwin.gen!C
NOD32v2	2311	06.06.2007	a variant of Win32/Agent.NEO
Norman	5.80.02	06.05.2007[td]no virus found
Panda	9.0.0.4	06.06.2007[td]no virus found
Prevx1	V2	06.06.2007[td]no virus found
Sophos	4.18.0	06.01.2007[td]no virus found
Sunbelt	2.2.907.0	06.04.2007	VIPRE.Suspicious
Symantec	10	06.06.2007	Trackware.Alexa
TheHacker	6.1.6.129	06.04.2007[td]no virus found
VBA32	3.12.0	06.06.2007	Backdoor.Win32.Agent.ahj
VirusBuster	4.3.23:9	06.05.2007[td]no virus found
Webwasher-Gateway	6.0.1	06.06.2007	Trojan.Popwin.CF

[ 本帖最后由 foxhound 于 2007-6-6 11:03 编辑 ]