网上找系统补丁，竟然是个随机8位数。

一派胡言

没事干，找那种补丁集呢，说实话，电脑很少打补丁。尤其那种补丁集，装起来很烦的。没用系统自带的自动更新，怕最近微软搞的什么正版验证。

uhthn2002

C:\Documents and Settings\uhthn\Desktop\Install.exe:<RAR>\skyepe.exe : is suspected of Malware.Delf.104


Directories       : 0       Files in archives:      Files on disks:
Archives:                   - total       : 3       - total       : 1     
- scanned         : 1       -  scanned    : 3       - scanned     : 1     
- contain viruses : 0       -  infected   : 0       - infected    : 0     
- deleted         : 0       -  suspicious : 1       - suspicious  : 1

uhthn2002

C:\Documents and Settings\uhthn\Desktop\4F249C9D\video.dll : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\uhthn\Desktop\4F249C9D\video.dll : backup copy created
C:\Documents and Settings\uhthn\Desktop\4F249C9D\kulionwl.dll : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\uhthn\Desktop\4F249C9D\kulionwl.dll : backup copy created
C:\Documents and Settings\uhthn\Desktop\4F249C9D\kulionrx.dll : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\uhthn\Desktop\4F249C9D\kulionrx.dll : backup copy created
C:\Documents and Settings\uhthn\Desktop\4F249C9D\kulionwm.dll : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\uhthn\Desktop\4F249C9D\kulionwm.dll : backup copy created
C:\Documents and Settings\uhthn\Desktop\4F249C9D\winow.dll : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\uhthn\Desktop\4F249C9D\dl1.exe:<RAR>\yswm613.exe : infected Trojan-Spy.Win32.Delf.uh
C:\Documents and Settings\uhthn\Desktop\4F249C9D\dl1.exe:<RAR>\ysgj613.exe : infected MalwareScope.Trojan-PSW.Game.17
C:\Documents and Settings\uhthn\Desktop\4F249C9D\dl1.exe:<RAR>\yswl613.exe : infected MalwareScope.Trojan-PSW.Game.17
C:\Documents and Settings\uhthn\Desktop\4F249C9D\dl1.exe:<RAR>\626rxys.exe : infected MalwareScope.Trojan-PSW.Game.17
C:\Documents and Settings\uhthn\Desktop\4F249C9D\dl1.exe:<RAR>\gf.exe : infected MalwareScope.Trojan-PSW.Game.17
C:\Documents and Settings\uhthn\Desktop\4F249C9D\dl2.exe:<RAR>\ad1309.exe : infected AdWare.Win32.BHO.av
C:\Documents and Settings\uhthn\Desktop\4F249C9D\dl2.exe:<RAR>\bind_50437.exe : infected Trojan.Win32.TrojanDownloader.QQHelper.NCO
C:\Documents and Settings\uhthn\Desktop\4F249C9D\dl2.exe:<RAR>\boolan60.exe : infected Trojan.Win32.TrojanDownloader.Adload.NEA
C:\Documents and Settings\uhthn\Desktop\4F249C9D\dl2.exe:<RAR>\fc01.exe : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\uhthn\Desktop\4F249C9D\4F249C9D.exe : is suspected of Malware.Delf.104



Directories       : 0       Files in archives:      Files on disks:
Archives:                   - total       : 14      - total       : 22   
- scanned         : 3       -  scanned    : 14      - scanned     : 22   
- contain viruses : 2       -  infected   : 9       - infected    : 7     
- deleted         : 0       -  suspicious : 0       - suspicious  : 1

风雪

费尔7个其中一个启发。

rasis

4F249C9D\0161.exe
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Lahnie
      [WARNING]   The file was ignored!
4F249C9D\4F249C9D.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [WARNING]   The file was ignored!
4F249C9D\dl1.exe
  [0] Archive type: RAR SFX (self extracting)
  --> yswm613.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.24661
  --> ysgj613.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.26297
  --> yswl613.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.25261
  --> 626rxys.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.24466
  --> gf.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.26778.A
      [WARNING]   The file was ignored!
4F249C9D\dl2.exe
  [0] Archive type: RAR SFX (self extracting)
  --> ad1309.exe
      [DETECTION] Contains signature of the dropper DR/BHO.AV.79
  --> bind_50437.exe
      [DETECTION] Is the Trojan horse TR/Agent.20480.173
  --> boolan60.exe
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> fc01.exe
      [DETECTION] Is the Trojan horse TR/PSW.Stealer.43488
  --> setup94.exe
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/CDN.B.1
      [WARNING]   The file was ignored!
4F249C9D\kulionrx.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
4F249C9D\kulionwl.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
4F249C9D\kulionwm.dll
      [DETECTION] Is the Trojan horse TR/PSW.Steal.27136
      [WARNING]   The file was ignored!
4F249C9D\video.dll
      [DETECTION] Is the Trojan horse TR/PSW.Lmir.YW.5
      [WARNING]   The file was ignored!
4F249C9D\winow.dll
      [DETECTION] Is the Trojan horse TR/PSW.32256.2
      [WARNING]   The file was ignored!


End of the scan: 2007年7月7日  11:17
Used time: 00:12 min

The scan has been done completely.

      1 Scanning directories
     36 Files were scanned
     17 viruses and/or unwanted programs were found
      2 classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     17 Files not concerned
      3 Archives were scanned
      9 Warnings
      0 Notes
      0 Hidden objects were found

promised

c:\ABC\4F249C9D\4F249C9D\-108-10115-11
c:\ABC\4F249C9D\4F249C9D\-92-10115-11
c:\ABC\4F249C9D\4F249C9D\0161.exe
c:\ABC\4F249C9D\4F249C9D\16891.txt - Signature 'Trojan-Downloader.Win32.Adload.bz' found
c:\ABC\4F249C9D\4F249C9D\2ae21.exe - Signature 'Trojan-Downloader.Win32.Adload.bz' found
c:\ABC\4F249C9D\4F249C9D\4F249C9D.exe - Signature 'Backdoor.Win32.PcClient.GV' found
c:\ABC\4F249C9D\4F249C9D\cid_store.dat
c:\ABC\4F249C9D\4F249C9D\cnprov.dat
c:\ABC\4F249C9D\4F249C9D\dl1.exe:\yswm613.exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found
c:\ABC\4F249C9D\4F249C9D\dl1.exe:\ysgj613.exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found
c:\ABC\4F249C9D\4F249C9D\dl1.exe:\yswl613.exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found
c:\ABC\4F249C9D\4F249C9D\dl1.exe:\626rxys.exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found
c:\ABC\4F249C9D\4F249C9D\dl1.exe:\gf.exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found
c:\ABC\4F249C9D\4F249C9D\dl1.exe
c:\ABC\4F249C9D\4F249C9D\dl2.exe:\ad1309.exe
c:\ABC\4F249C9D\4F249C9D\dl2.exe:\bind_50437.exe
c:\ABC\4F249C9D\4F249C9D\dl2.exe:\boolan60.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
c:\ABC\4F249C9D\4F249C9D\dl2.exe:\fc01.exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found
c:\ABC\4F249C9D\4F249C9D\dl2.exe:\host.exe
c:\ABC\4F249C9D\4F249C9D\dl2.exe:\dodolook379.exe - Signature 'not-a-virus:AdWare.Win32.Cinmus.f' found
c:\ABC\4F249C9D\4F249C9D\dl2.exe:\ad_2200.exe
c:\ABC\4F249C9D\4F249C9D\dl2.exe:\setup94.exe
c:\ABC\4F249C9D\4F249C9D\dl2.exe
c:\ABC\4F249C9D\4F249C9D\fixmfs.dll
c:\ABC\4F249C9D\4F249C9D\idnreg.dll
c:\ABC\4F249C9D\4F249C9D\kulionrx.dll - Signature 'Trojan-PWS.Win32.Nilage.bga' found
c:\ABC\4F249C9D\4F249C9D\kulionwl.dll - Signature 'Trojan-PWS.Win32.Nilage.b' found
c:\ABC\4F249C9D\4F249C9D\kulionwm.dll - Signature 'Generic.PWStealer' found
c:\ABC\4F249C9D\4F249C9D\mprmsgse.axz
c:\ABC\4F249C9D\4F249C9D\mscpx32r.det
c:\ABC\4F249C9D\4F249C9D\ocinfo.dat
c:\ABC\4F249C9D\4F249C9D\ser.exe - Signature 'Trojan-Downloader.Win32.Adload.bz' found
c:\ABC\4F249C9D\4F249C9D\video.dll - Signature 'Generic.PWStealer' found
c:\ABC\4F249C9D\4F249C9D\winow.dll - Signature 'Trojan-PWS.Win32.Delf.HG' found
c:\ABC\4F249C9D\4F249C9D\_

        35 Files scanned
          (4 Archives with 13 files)
        17 Signatures found
        0 Suspect code-parts found
        Used time: 0:02.375

wangjay1980

Hello,

-108-10115-11, -92-10115-11, cid_store.dat, cnprov.dat, file, fixmfs.dll, idnreg.dll, mprmsgse.axz, mscpx32r.det, ocinfo.dat

No malicious code were found in these files.

0161.exe_ - Trojan.Win32.BHO.aw,
16891.txt - Trojan-Downloader.Win32.Adload.bz,
winow.dll - Trojan-PSW.Win32.WOW.rh

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Erakhtin Kirill
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/



> Attachment: 4F249C9D.zip