Foreign Virus 6X（第113次更新）

显示全部楼层 · 发表于 2009-8-26 20:32:10

本帖最后由 Sherry.ai 于 2010-4-21 19:01 编辑

from foreign website

93：http://www.dbank.com/download.action?t=40&k=MTM3NzY1MDY=&pcode=LCwzNjU2NiwzNjU2Ng==&rnd=595
99：http://www.dbank.com/download.action?t=40&k=MTQyMTE4MjE=&pcode=LCwzNjU2NiwzNjU2Ng==&rnd=2447
100：http://www.brsbox.com/filebox/down/fc/0ed3bf5adc1a497c2dac9418b9fe6f99
105：http://www.brsbox.com/filebox/down/fc/1bc85e1e97c5d8c02ff99ef42e5a3e9f
107：http://www.brsbox.com/filebox/down/fc/16582dd467cd78346b8f9a2f36a36973
109：http://www.brsbox.com/filebox/down/fc/58f0247e8989cbbc5dc777dbaf1ba3cd

显示全部楼层 · 发表于 2009-8-26 20:37:28

Trojan.Win32.Generic.11EC7F87
Trojan.Win32.ZBot.bi
Trojan.Clicker.Win32.Undef.kz

显示全部楼层 · 发表于 2009-8-26 20:38:40

好大啊！1.3MB
NOD32 Miss Template.bmp
C:\Documents and Settings\Administrator\桌面\a\hallmark.exe > RAR > a.reg - REG/RunKeys.NAA 特洛伊木马
C:\Documents and Settings\Administrator\桌面\a\hallmark.exe > RAR > mirc.ini - IRC/Zapchast.G 特洛伊木马
C:\Documents and Settings\Administrator\桌面\a\hallmark.exe > RAR > run.bat - BAT/Runner.E 特洛伊木马
C:\Documents and Settings\Administrator\桌面\a\hallmark.exe > RAR > s.mrc - 可能是 Win32/Zapchast 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\a\my_tribe_1.exe > 7ZIP > crack.exe - Win32/TrojanDownloader.Agent.PHH 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\a\my_tribe_1.exe > 7ZIP > patch.exe - Win32/TrojanDropper.Small.NJP 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\a\my_tribe_1.exe > 7ZIP > serial.exe - Win32/Kryptik.AGO 特洛伊木马的变种

[ 本帖最后由 qq316107934 于 2009-8-26 20:39 编辑 ]

显示全部楼层 · 发表于 2009-8-26 21:04:33

[Found Trojan] <REG/Zapchast.H (exact, component, not disinfectable)> D:\TDDownload\hallmark.exe->(RAR)->a.reg->(Unicode)
[Found backdoor] <IRC/Zapchast.AK (exact, not disinfectable)> D:\TDDownload\hallmark.exe->(RAR)->mirc.ini
[Found Trojan] <BAT/Zapchast.CE (exact, not disinfectable)> D:\TDDownload\hallmark.exe->(RAR)->run.bat
[Contains infected objects] D:\TDDownload\hallmark.exe
[Quarantined] D:\TDDownload\hallmark.exe->(RAR)->s.mrc
miss 2，to

显示全部楼层 · 发表于 2009-8-26 23:00:07

瑞星2010

显示全部楼层 · 发表于 2009-8-26 23:10:09

2009/8/26 23:08:31 已删除木马程序 Backdoor.IRC.Zapchast.zwrc G:\Temp\Virus\1\hallmark.exe
2009/8/26 23:08:31 已删除木马程序 Trojan-Downloader.Win32.Small.amcd G:\Temp\Virus\1\my_tribe_1.exe//crack.exe
2009/8/26 23:08:31 已删除木马程序 Backdoor.IRC.Zapchast.zwrc G:\Temp\Virus\1\hallmark.exe/mirc.ini
2009/8/26 23:08:31 已删除木马程序 Trojan-Downloader.Win32.Small.kdj G:\Temp\Virus\1\my_tribe_1.exe//patch.exe
2009/8/26 23:08:31 已删除木马程序 Backdoor.IRC.Zapchast.zwrc G:\Temp\Virus\1\hallmark.exe/run.bat
2009/8/26 23:08:31 已删除病毒 HEUR:Trojan.Win32.Generic G:\Temp\Virus\1\my_tribe_1.exe//serial.exe
2009/8/26 23:08:31 已删除木马程序 Backdoor.IRC.Zapchast.zwrc G:\Temp\Virus\1\hallmark.exe/s.mrc

显示全部楼层 · 发表于 2009-8-27 13:39:46

那个.bmp没问题吧...

hallmark.exe/spoolsv.exe is a riskware Program.mIRC.603
hallmark.exe/s.mrc infected with IRC.Flood.702

my_tribe_1.exe/crack.exe infected with Trojan.DownLoad.40183
my_tribe_1.exe/keygen.exe probably infected with Win32.Virut
my_tribe_1.exe/patch.exe infected with Trojan.DownLoad.42456
my_tribe_1.exe/serial.exe probably infected with Trojan.Packed.214

ps. nod miss了那个spoolsv.exe，却报了那一堆配置文件...

显示全部楼层 · 发表于 2009-8-27 15:21:53

上报红伞

显示全部楼层 · 发表于 2009-8-27 19:28:03

Update

显示全部楼层 · 发表于 2009-8-27 19:30:42

IObit miss 4，to

[病毒样本] Foreign Virus 6X（第113次更新）

本帖子中包含更多资源

评分

本帖子中包含更多资源