2009.04.04最新版本烈性病毒

显示全部楼层 · 发表于 2009-4-4 22:43:35

常在河边走，哪能不湿鞋————今下午一客户那，我算是真切的体会到了这句话。我的两个U盘，共10G资料全部被病毒感染。回来后，我下午忙着维修一台电脑，一不留神U盘插到那台电脑里面去了，结果那电脑全盘被感染，重装了两回才搞定，手提电脑也中毒了————因为没装杀毒软件，唉，可怜我那浩如烟海的资料！

豁出去了也要把这个超恶超变态的病毒逮住游街示众，谁叫你那么没人性~

每个盘符下面都有病毒文件，这个可能是最新版本，这个三个病毒文件如下：

system.dll 大小：41K

MSDOS.bat 大小：8K

autorun.inf

一句话，烈性病毒！

瞬间全盘感染

[ 本帖最后由 5551551 于 2009-4-5 01:24 编辑 ]

显示全部楼层 · 发表于 2009-4-4 22:45:32

C:\downloads\2009.04.04最新版本烈性病毒.rar > RAR > 2009.04.04最新版本烈性病毒\autorun.inf - Win32/AutoRun.Agent.EE 蠕虫
C:\downloads\2009.04.04最新版本烈性病毒.rar > RAR > 2009.04.04最新版本烈性病毒\MSDOS.bat - Win32/AutoRun.NC 蠕虫
C:\downloads\2009.04.04最新版本烈性病毒.rar > RAR > 2009.04.04最新版本烈性病毒\system.dll - Win32/TrojanDownloader.Agent.OMQ 特洛伊木马

显示全部楼层 · 发表于 2009-4-4 22:48:33

'WORM/Autorun.ubh [worm]'
'WORM/Otwycal.g [worm]'
'TR/Killav.bao.61 [trojan]'

显示全部楼层 · 发表于 2009-4-4 22:58:12

实机EQ测试
2009-04-04 22:58:39 创建文件操作:阻止并结束进程
进程路径:E:\2009[1].04.04最新版本烈性病毒\2009.04.04最新版本烈性病毒\MSDOS.bat
文件路径:C:\WINDOWS\Tasks\0x01xx8p.exe
触发规则:所有程序规则->WINDOWS_2->%windir%\Tasks\*.exe

显示全部楼层 · 发表于 2009-4-4 23:01:45

Ultra String Reference Plugin
Address Disassembly                            Text String
1315181E push 13151150                         \
13151A62 push 13151160                         InfeWeb:\r\n
13151A67 push 13151154                         windows.txt
13151BF0 push 131511C4                         .do
13151C04 push 131511BC                         .htm
13151C18 push 131511B4                         .html
13151C2C push 131511AC                         .shtm
13151C40 push 131511A4                         .shtml
13151C54 push 1315119C                         .asp
13151C64 push 13151194                         .aspx
13151C74 push 1315118C                         .php
13151C84 push 13151184                         .jsp
13151C94 push 1315117C                         .cgi
13151CA4 push 13151174                         .xml
13151CB4 push 1315116C                         .GHO
131531E4 push 131511C8                         .WYCao
13153237 push 131511C8                         .WYCao
13153491 push 131511F8                         InfeExe:\r\n
13153496 push 13151154                         windows.txt
13153504 push 131511F0                         .exe
13153514 push 131511E8                         .bat
13153524 push 131511E0                         .cmd
13153534 push 131511D8                         .com
13153544 push 131511D0                         .scr
131535CF push 13151218                         COMSPEC
131535E9 push 1315120C                         /c  del
13153611 push 13151204                         > nul
13153774 push 1315125C                         Program Files
131537B5 push 13151254                         \*.*
13153802 push 13151250                         .
13153812 push 1315124C                         ..
13153830 push 13151150                         \
1315386A push 13151250                         .
1315387E push 1315124C                         ..
131538A0 push 13151150                         \
131538ED push 13151244                         qq.exe
131538FD push 13151234                         QQDoctor.exe
1315390D push 13151220                         QQDoctorMain.exe
13153961 push 13151250                         .
13153971 push 1315124C                         ..
13153993 push 13151150                         \
131539C6 push 13151250                         .
131539DA push 1315124C                         ..
13153A00 push 13151150                         \
13153A46 push 13151244                         qq.exe
13153A56 push 13151234                         QQDoctor.exe
13153A66 push 13151220                         QQDoctorMain.exe
13153AEF mov    esi, 131512AC                   [AutoRun]\r\nopen=MSDOS.bat\r\nshell\open=打开(&O)\r\nshell\open\Command=MSDOS.bat\r\nshell\open\Default=1\r\nshell\explore=资源管理器(&X)\r\nshell\explore\Command=MSDOS.bat\r\n
13153B27 push 1315129C                         FixedDrive:\r\n
13153B2C push 13151154                         windows.txt
13153B3E push 13151288                         RemovableDrive:\r\n
13153B43 push 13151154                         windows.txt
13153B98 push 1315127C                         \MSDOS.bat
13153C1A push 1315126C                         \autorun.inf
13153D29 push 13151154                         windows.txt
13153DC7 push 1315135C                         SOFTWARE\Data\Config
13153E18 push 13151354                         Downing
13153EC5 push 13151150                         \
131540B3 mov    esi, 13151388                   http://444.er18.com/config.txt
1315413B push 13151150                         \
131541A5 push 13151154                         windows.txt
131541B9 push 1315137C                         Random:\r\n
131541F0 push 1315137C                         Random:\r\n
131541F5 push 13151154                         windows.txt
1315422D push 1315135C                         SOFTWARE\Data\Config
13154280 push 13151374                         Down:\r\n
13154285 push 13151154                         windows.txt
1315430E push 131513B4                         OpenSys:\r\n
13154313 push 13151154                         windows.txt
1315432C push 1315135C                         SOFTWARE\Data\Config
13154359 push 131513A8                         ReadTime:\r\n
1315435E push 13151154                         windows.txt
131543B2 push 131513C0                         RemovInfe:\r\n
131543D2 push 131513D0                         HDInfe:\r\n
13154442 push 131513F0                         program files\Internet Explorer\IEXPLORE.EXE
1315445C push 131513E4                         FlipWEB:\r\n
13154461 push 13151154                         windows.txt
131544DB push 131513DC                         %s %s
13154577 push 1315142C                         SendGet:\r\n
1315457C push 13151154                         windows.txt
131545BF push 13151420                         ?anyehorse=
131546EA push esi                            (Initial CPU selection)
13154709 push 13151474                         smss.exe
1315474A push 1315146C                         \Tasks
13154763 push 1315145C                         \0x01xx8p.exe
131547C4 push 13151448                         SeDebugPrivilege
131547ED push 13151438                         explorer1.exe
1315489F push 13151480                         %d
13154A5E push 1315148C                         MSDOS.bat
13154AA2 push 13151484                         open
13154C35 push 131514F4                         \spoolsv.exe
13154C44 push 1315146C                         \Tasks
13154C50 push 131514E0                         \Tasks\spoolsv.ext
13154C5F push 131514CC                         \Tasks\SysFile.brk
13154CCA push 131514B4                         \dllcache\spoolsv.exe
13154D41 push 13151498                         \
13154E9B push 1315151C                         avp.exe
13154EA7 push 13151510                         kvsrvxp.exe
13154EB6 push 13151504                         kissvc.exe
13154F3C push 1315151C                         avp.exe

显示全部楼层 · 发表于 2009-4-4 23:03:21

4/4/2009 23:02:44 已偵測: Worm.Win32.AutoRun.ubh C:\Documents and Settings\kato9096\桌面\2009.04.04最新版本烈性病毒.rar/2009.04.04郔陔唳掛轄俶瓷馮\autorun.inf
4/4/2009 23:02:44 已偵測: Worm.Win32.AutoRun.yze C:\Documents and Settings\kato9096\桌面\2009.04.04最新版本烈性病毒.rar/2009.04.04郔陔唳掛轄俶瓷馮\MSDOS.bat
4/4/2009 23:02:44 已偵測: Trojan.Win32.KillAV.bao C:\Documents and Settings\kato9096\桌面\2009.04.04最新版本烈性病毒.rar/2009.04.04郔陔唳掛轄俶瓷馮\system.dll

显示全部楼层 · 发表于 2009-4-4 23:03:42

程序：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$DI00.875\MSDOS.BAT
被删除文件：
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
是否阻止文件被删除?
程序：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$DI00.875\MSDOS.BAT
木马程序生成以下文件：
1) C:\WINDOWS\TASKS\SPOOLSV.EXT
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2009-4-4 23:38:46

When accessing data from the URL, "http://bbs.kafan.cn/attachment.php?aid=504695&k=34d22bcacc9d14811988db83d7085355&t=1238859310"
a virus or unwanted program 'WORM/Autorun.ubh' [worm] was found.
Action taken: Blocked file

显示全部楼层 · 发表于 2009-4-4 23:55:45

KV2009捕杀掉。

显示全部楼层 · 发表于 2009-4-5 00:09:25

Name: Otwycal
Type: Worm

Description:
A malicious software that replicates independently via LANs, Internet, e-mail, IRC channels, file-sharing networks, etc.

Files:
c:\users\administrator\desktop\2009.04.04最新版本烈性病毒\msdos.bat

Name: Autoruner
Type: Worm

Description:
A malicious software that replicates independently via LANs, Internet, e-mail, IRC channels, file-sharing networks, etc.

Files:
c:\users\administrator\desktop\2009.04.04最新版本烈性病毒\autorun.inf

Name: Trojan.KillAV.BMT
Type: Trojan

Description:

Files:
c:\users\administrator\desktop\2009.04.04最新版本烈性病毒\system.dll

[病毒样本] 2009.04.04最新版本烈性病毒

本帖子中包含更多资源