[MD5: BF552C]

显示全部楼层 · 发表于 2007-6-12 05:53:29

貌似是新病毒？？？nod32报未知
Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update as Trojan.Win32.StartPage.aoq. Thank you for your help.
-----------------
Regards, Yury Nesmachny
Virus Analyst, Kaspersky Lab.

Ph.: +7(495) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

显示全部楼层 · 发表于 2007-6-12 05:58:12

行为阻拦 omgwtf

显示全部楼层 · 发表于 2007-6-12 06:00:19

nod32没有注册表监控。。。。

显示全部楼层 · 发表于 2007-6-12 06:08:44

[WARNING] Is the Trojan horse TR/Dldr.Agent.rd.1!
C:\WINDOWS\Temp\_avast4_\unp124522825.tmp

显示全部楼层 · 发表于 2007-6-12 06:16:32

这个东西不报也罢，运行了一下，除了修改IE主页什么动作都没有

显示全部楼层 · 发表于 2007-6-12 07:01:01

運行Install.exe，發現下列行為，被EQ-Secure RC2攔截！
------------------
2007-06-12 06:59:34 运行应用程序操作:允许
进程路径:C:\WINDOWS\Explorer.EXE
文件路径:D:\桌面\virus\Install\Install.exe
规则:所有程序规则->ALL->*.*

2007-06-12 06:59:35 修改注册表内容操作:阻止
进程路径:D:\桌面\virus\Install\Install.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
注册表名称:Start Page
注册表数据:hxxp://www.egof.com
规则:所有程序规则->IE瀏覽器設置->*\Software\Microsoft\Internet explorer\Main

----------------------------------------------------------------------------------------------------
1.他會修改注册表内容
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Start Page
hxxp://www.egof.com

显示全部楼层 · 发表于 2007-6-12 07:15:46

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\Install.rar'
C:\Documents and Settings\Administrator\My Documents\
  Install.rar
[0] Archive type: RAR
--> Install.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.rd.1
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-6-12 09:27:21

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-6-6
Start time: 2007-6-12 9:29
Engine(s): KAV engine (AVK 17.5733), BD-Engine (BD 17.5315)
Heuristic: On
Archives: On
System areas: Off

Check selected directories and files...
Object: Install.exe
Path: C:\Documents and Settings\Administrator\桌面\Install
Status: Move file into quarantine
Virus: Trojan.Win32.StartPage.aoq (KAV engine), BehavesLike:Trojan.StartPage (BD-Engine)
Analysis complete: 2007-6-12 9:29
1 files checked
1 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-6-12 09:30:32

怎么没事老上报卡巴啊，难道对上报NOD失望了。。。

显示全部楼层 · 发表于 2007-6-12 09:55:28

NOD报未知
自己上报了

[病毒样本] [MD5: BF552C]

本帖子中包含更多资源

本帖子中包含更多资源

回复 #1 EQ2 的帖子