0866F3

显示全部楼层 · 发表于 2007-6-20 14:11:30

Scan performed at: 2007-6-20 14:15:27
Scanning Log
NOD32 version 2340 (20070620) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.rar
Operating memory - is OK

Date: 20.6.2007 Time: 14:15:31
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.rar
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?0.exe - a variant of Win32/PSW.Delf.NHI trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 14:15:31 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-6-20 14:12:19

Kaspersky Anti-Virus 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=90095 is infected with Downloader virus

显示全部楼层 · 发表于 2007-6-20 14:12:31

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=90095 is infected with Downloader virus

显示全部楼层 · 发表于 2007-6-20 14:16:33

bd报：

Generic.PWStealer.34C01659

显示全部楼层 · 发表于 2007-6-20 14:17:15

運行0.exe，發現下列行為，被EQ-Secure RC2攔截！
--------------------
2007-06-20 14:18:56 运行应用程序    操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\0866F3\0.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE

2007-06-20 14:18:56 创建文件    操作:阻止
进程路径:D:\桌面\virus\0866F3\0.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.2dt
规则:所有程序规则->保護安全軟體->C:\Program Files\*

2007-06-20 14:18:56 创建文件    操作:阻止
进程路径:D:\桌面\virus\0866F3\0.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.2dt
规则:所有程序规则->保護安全軟體->C:\Program Files\*

2007-06-20 14:18:56 创建文件    操作:阻止
进程路径:D:\桌面\virus\0866F3\0.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.2dt
规则:所有程序规则->保護安全軟體->C:\Program Files\*

2007-06-20 14:18:56 创建文件    操作:阻止
进程路径:D:\桌面\virus\0866F3\0.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmt
规则:所有程序规则->保護安全軟體->C:\Program Files\*

2007-06-20 14:18:56 创建注册表值    操作:阻止
进程路径:D:\桌面\virus\0866F3\0.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
注册表名称:{A6011F8F-A7F8-49AA-9ADA-49127D43138F}
规则:所有程序规则->資源管理器->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks*

------------------------------------
1.他會在C:\Program Files\Common Files\Microsoft Shared\MSINFO\產生
system.2dt
NewInfo.bmt
2.他會创建注册表值
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{A6011F8F-A7F8-49AA-9ADA-49127D43138F}

显示全部楼层 · 发表于 2007-6-20 14:20:38

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\样本.rar
  [0] Archive type: RAR
  --> 0.exe
   [DETECTION] Contains signature of the dropper DR/Delphi.Gen
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-6-20 14:26:20

发表回复

显示全部楼层 · 发表于 2007-6-20 14:38:39

大A
Win32:Delf-EWR [Trj]

显示全部楼层 · 发表于 2007-6-20 15:58:02

很明显是个下载器,看楼上EQ日至没有拦到HOOK吗?

[ 本帖最后由 blueline 于 2007-6-20 16:19 编辑 ]

[病毒样本] 0866F3

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源