两个入侵者[MD5: 2BAC55 FD28B0]

wangjay1980

NOD不是一段时间升一次级吗

The EQs

隔一段时间升级高级启发。。。。nod32每次升级高级启发都能带来一丝的惊喜。。。

1p1

原帖由 EQ2 于 2007-6-19 21:20 发表
有没有这样设置？？

恩
是这样的
可能是我用的id用的人太多了

The EQs

偶还有几个90天的序列号。。等用完了。。还有1年的序列号。。等用完了就续费。。。。反正也不贵

wangjay1980

Hello,

a.exe_, b.exe_ - Trojan-Downloader.Win32.Delf.bmu

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Alexander Romanenko
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\virus.rar'
C:\Documents and Settings\Administrator\My Documents\
  virus.rar
    [0] Archive type: RAR
    --> a.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> b.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

蓝色牛仔裤

呃。。。怎么都是启发。。


[Scan path] C:\Documents and Settings\Administrator\桌面\virus.rar
>C:\Documents and Settings\Administrator\桌面\virus.rar\a.exe probably infected with DLOADER.Trojan
>C:\Documents and Settings\Administrator\桌面\virus.rar\b.exe probably infected with DLOADER.Trojan
C:\Documents and Settings\Administrator\桌面\virus.rar - archive contains infected objects

taihuxian

Virus: Trojan-Downloader.Win32.Delf.bmu (2x)

Virus found while downloading Web content.

Address: bbs.kafan.cn

woai_jolin

2007/6/20 20:04:44        eAmon        file        D:\病毒测试\b.exe        probably a variant of Win32/TrojanDownloader.Delf.NJH trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

2007/6/20 20:04:43        eAmon        file        D:\病毒测试\A.EXE        probably a variant of Win32/TrojanDownloader.Delf.NJH trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Windows\Explorer.EXE.

a256886572008

運行a.exe，發現下列行為，被EQ-Secure RC2攔截！
-----------------
2007-06-20 20:23:52    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\allenhippo﹍virus\a.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-20 20:23:52    创建文件      操作:阻止
进程路径:D:\桌面\virus\allenhippo﹍virus\a.exe
文件路径:C:\windows\system32\system.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-20 20:23:52    创建文件      操作:阻止
进程路径:D:\桌面\virus\allenhippo﹍virus\a.exe
文件路径:C:\windows\system32\system.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-20 20:23:52    创建文件      操作:阻止
进程路径:D:\桌面\virus\allenhippo﹍virus\a.exe
文件路径:C:\windows\system32\system.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-20 20:23:53    运行应用程序      操作:阻止
进程路径:D:\桌面\virus\allenhippo﹍virus\a.exe
文件路径:C:\windows\system32\cmd.exe
命令行:/c del "D:\桌面\virus\allenhippo﹍virus\a.exe"
规则:所有程序规则->系統程序->%windir%\system32\cmd.exe

-----------------------
1.他會在下列路徑產生system.exe
   C:\windows\system32\
2.他會利用cmd.exe殺掉自己
   /c del "D:\桌面\virus\allenhippo﹍virus\a.exe"