仨[MD5: F876B8 38C67E 1ECE39]

allenhippo

The EQs

Scan performed at: 2007-6-19 11:41:04
Scanning Log
NOD32 version 2337 (20070618) NT
Command line: C:\Documents and Settings\EQ2\桌面\桌面
Operating memory - is OK

Date: 19.6.2007  Time: 11:41:08
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\桌面\
C:\Documents and Settings\EQ2\桌面\桌面\x2[1].exe - a variant of Win32/Hupigon trojan
C:\Documents and Settings\EQ2\桌面\桌面\x3[1].exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\桌面\xx11[1].exe - probably unknown NewHeur_PE virus [7]
Number of scanned files: 3
Number of threats found: 3
Number of files cleaned: 3
Time of completion: 11:41:09 Total scanning time: 1 sec (00:00:01)

Notes:
[7] File is probably infected with an unknown virus.

wangjay1980

detected: virus Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\virus1.rar/x3[1].exe//SimplePack//PE_Patch.MaskPE
detected: virus Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\x2[1].zip/x2[1].exe//SimplePack//PE_Patch.MaskPE

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\x2[1].zip'
C:\Documents and Settings\Administrator\My Documents\
  x2[1].zip
    [0] Archive type: ZIP
    --> x2[1].exe
        [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Graybird.GN.378715 Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\virus.rar'
C:\Documents and Settings\Administrator\My Documents\
  virus.rar
    [0] Archive type: RAR
    --> xx11[1].exe
        [DETECTION] Is the Trojan horse TR/PSW.27033
        [WARNING]   Infected files in archives cannot be repaired!
    --> x3[1].exe
        [DETECTION] Is the Trojan horse TR/Proxy.Delf.CA
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

a256886572008

運行x3[1].exe，發現下列行為，被EQ-Secure RC2攔截！
----------------
2007-06-19 11:47:34    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\allenhippo_virus\x3[1].exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-19 11:47:34    创建文件      操作:阻止
进程路径:D:\桌面\virus\allenhippo_virus\x3[1].exe
文件路径:C:\windows\system32\Packet.dll
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll


2007-06-19 11:47:34    创建文件      操作:阻止
进程路径:D:\桌面\virus\allenhippo_virus\x3[1].exe
文件路径:C:\windows\system32\WanPacket.dll
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll


2007-06-19 11:47:34    创建文件      操作:阻止
进程路径:D:\桌面\virus\allenhippo_virus\x3[1].exe
文件路径:C:\windows\system32\wpcap.dll
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll


2007-06-19 11:47:34    创建文件      操作:阻止
进程路径:D:\桌面\virus\allenhippo_virus\x3[1].exe
文件路径:C:\windows\system32\drivers\svchost.exe
规则:所有程序规则->2.1.2组：保護系統進程->*\*svchost*.exe


2007-06-19 11:47:35    创建文件      操作:阻止
进程路径:D:\桌面\virus\allenhippo_virus\x3[1].exe
文件路径:C:\windows\system32\drivers\svchost.exe
规则:所有程序规则->2.1.2组：保護系統進程->*\*svchost*.exe


2007-06-19 11:47:35    创建文件      操作:阻止
进程路径:D:\桌面\virus\allenhippo_virus\x3[1].exe
文件路径:C:\windows\system32\drivers\svchost.exe
规则:所有程序规则->2.1.2组：保護系統進程->*\*svchost*.exe

-------------------------------------------------------
1.他會在C:\windows\system32\產生
   Packet.dll
   WanPacket.dll
   wpcap.dll
2.他會在下列路徑產生svchost.exe
   C:\windows\system32\drivers\

欠妳緈諨

[ 本帖最后由 欠你幸福 于 2007-6-19 11:50 编辑 ]

a256886572008

運行運行xx11[1].exe，發現下列行為，被EQ-Secure RC2攔截！
--------------------
2007-06-19 11:51:42    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\allenhippo_virus\xx11[1].exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-19 11:51:42    创建文件      操作:阻止
进程路径:D:\桌面\virus\allenhippo_virus\xx11[1].exe
文件路径:C:\windows\winow.dll
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll


2007-06-19 11:51:42    创建文件      操作:阻止
进程路径:D:\桌面\virus\allenhippo_virus\xx11[1].exe
文件路径:C:\windows\winow.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-19 11:51:43    创建文件      操作:阻止
进程路径:D:\桌面\virus\allenhippo_virus\xx11[1].exe
文件路径:C:\windows\winow.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-19 11:51:43    创建文件      操作:阻止
进程路径:D:\桌面\virus\allenhippo_virus\xx11[1].exe
文件路径:C:\windows\winow.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe

-------------------------------------------------------------------
1.他會在C:\windows\產生
   winow.dll
   winow.exe

观弈书童

x2[1].exe - Win32/Hupigon 木马的变种
xx11[1].exe - 未查明的 NewHeur_PE 病毒 [7]
x3[1].exe - 未查明的 NewHeur_PE 病毒 [7]

蓝色牛仔裤

漏一个。。


[Scan path] C:\Documents and Settings\Administrator\桌面\virus\x2[1].exe
>>>C:\Documents and Settings\Administrator\桌面\virus\x2[1].exe infected with BackDoor.Pigeon.1562

[Scan path] C:\Documents and Settings\Administrator\桌面\virus\x3[1].exe
>>>>C:\Documents and Settings\Administrator\桌面\virus\x3[1].exe\data001 infected with Trojan.Sniff
>C:\Documents and Settings\Administrator\桌面\virus\x3[1].exe\data002 - Ok
>>C:\Documents and Settings\Administrator\桌面\virus\x3[1].exe\data003 - Ok
>>C:\Documents and Settings\Administrator\桌面\virus\x3[1].exe\data004 - Ok
>>C:\Documents and Settings\Administrator\桌面\virus\x3[1].exe\data005 - Ok
C:\Documents and Settings\Administrator\桌面\virus\x3[1].exe - archive contains infected objects

[Scan path] C:\Documents and Settings\Administrator\桌面\virus\xx11[1].exe
>>C:\Documents and Settings\Administrator\桌面\virus\xx11[1].exe - Ok

a256886572008

運行運行x2[1].exe，發現下列行為，被EQ-Secure RC2攔截！
--------------
2007-06-19 12:14:11    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\x2[1]\x2[1].exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-19 12:14:12    创建文件      操作:阻止
进程路径:D:\桌面\virus\x2[1]\x2[1].exe
文件路径:C:\windows\G_Server2006.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-19 12:14:12    创建文件      操作:阻止
进程路径:D:\桌面\virus\x2[1]\x2[1].exe
文件路径:C:\windows\G_Server2006.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-19 12:14:12    创建文件      操作:阻止
进程路径:D:\桌面\virus\x2[1]\x2[1].exe
文件路径:C:\windows\G_Server2006.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-19 12:14:13    修改注册表内容      操作:阻止
进程路径:C:\windows\system32\services.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeonServer
注册表名称:[Key]
规则:所有程序规则->服務_普通模式->HKEY_LOCAL_MACHINE\SYSTEM\*controlset*\Services\*


2007-06-19 12:14:13    创建文件      操作:阻止
进程路径:D:\桌面\virus\x2[1]\x2[1].exe
文件路径:C:\windows\FFFFSSSS.BAT
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.bat

----------------------------------
1.他會在下列路徑產生G_Server2006.exe
   C:\windows\
2.他會修改注册表内容
   HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeonServer
   [Key]
3.他會在下列路徑產生FFFFSSSS.BAT
   C:\windows\