1065E4

沸沸

woai_jolin

2007/6/22 13:26:18        Scanning Log
2007/6/22 13:26:18        Version of virus signature database: 2343 (20070621)
2007/6/22 13:26:18        Date: 22.6.2007  Time: 13:26:18
2007/6/22 13:26:18        Scanned disks, folders and files: D:\病毒\
2007/6/22 13:26:19        D:\病毒\样本.rar - a variant of Win32/PSW.Delf.NHI trojan - deleted - quarantined
2007/6/22 13:26:19        D:\病毒\样本.rar » RAR » A.exe - a variant of Win32/PSW.Delf.NHI trojan
2007/6/22 13:26:19        Number of scanned files: 2
2007/6/22 13:26:19        Number of threats found: 1
2007/6/22 13:26:19        Time of completion: 13:26:19  Total scanning time: 1 sec (00:00:01)

蓝色牛仔裤

[Scan path] C:\Documents and Settings\Administrator\桌面\样本.rar
>>>C:\Documents and Settings\Administrator\桌面\样本.rar\A.exe infected with Trojan.PWS.Gamania.origin
C:\Documents and Settings\Administrator\桌面\样本.rar - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 3
Infected objects found: 1
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 23 Kb/s
Scan time: 00:00:00

a256886572008

運行A.exe，發現下列行為，被EQ-Secure RC2攔截！

2007-06-22 14:20:45    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\1065E4\A.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-22 14:20:45    创建文件      操作:阻止
进程路径:D:\桌面\virus\1065E4\A.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.2dt
规则:所有程序规则->保護安全軟體->C:\Program Files\*


2007-06-22 14:20:45    创建文件      操作:阻止
进程路径:D:\桌面\virus\1065E4\A.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.2dt
规则:所有程序规则->保護安全軟體->C:\Program Files\*


2007-06-22 14:20:45    创建文件      操作:阻止
进程路径:D:\桌面\virus\1065E4\A.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.2dt
规则:所有程序规则->保護安全軟體->C:\Program Files\*


2007-06-22 14:20:45    创建文件      操作:阻止
进程路径:D:\桌面\virus\1065E4\A.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmt
规则:所有程序规则->保護安全軟體->C:\Program Files\*



2007-06-22 14:20:45    创建注册表值      操作:阻止
进程路径:D:\桌面\virus\1065E4\A.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
注册表名称:{A6011F8F-A7F8-49AA-9ADA-49127D43138F}
规则:所有程序规则->資源管理器->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks*

1.他會在C:\Program Files\Common Files\Microsoft Shared\MSINFO\產生
   system.2dt
   NewInfo.bmt
2.他會创建注册表值
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
   {A6011F8F-A7F8-49AA-9ADA-49127D43138F}

KAV-Longhorn

Kaspersky Internet Security 7.0

The requested URL http://bbs.kafan.cn/attachment.php?aid=90861 is infected with Trojan-PSW.Win32.Delf.qc virus