[病毒样本] 9ge

显示全部楼层 · 发表于 2007-7-14 18:13:40

红伞报了

显示全部楼层 · 发表于 2007-7-14 18:46:57

1184409958,2007-7-14 18:45:58,Heuri.Possible/Packed,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\huan.zip>>huan.exe,Manual scan
1184410066,2007-7-14 18:47:46,Trojan.SangeAG.rcwd,木马,mygood,D:\3\新建文件夹\新建文件夹\setups[1].part1.rar>>bind_50100.exe,Manual scan
1184410066,2007-7-14 18:47:46,Packed.FSG.a,带壳程序,mygood,D:\3\新建文件夹\新建文件夹\setups[1].part1.rar>>hyddp.exe,Manual scan
1184410066,2007-7-14 18:47:46,Heuri.Possible/Packed,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\setups[1].part1.rar>>hyllk.exe,Manual scan
1184410066,2007-7-14 18:47:46,W32.VB.QK.smut,病毒,mygood,D:\3\新建文件夹\新建文件夹\setups[1].part1.rar>>setup.exe,Manual scan
1184410066,2007-7-14 18:47:46,Packed.FSG.a,带壳程序,mygood,D:\3\新建文件夹\新建文件夹\setups[1].part1.rar>>twin.exe,Manual scan
1184410066,2007-7-14 18:47:46,Adware.Toolbar.Baidu.zvch.dll,广告程序,mygood,D:\3\新建文件夹\新建文件夹\setups[1].part1.rar>>yqud.exe>>emb-0.cab>>BaiduBar.dll,Manual scan
费尔

显示全部楼层 · 发表于 2007-7-14 20:46:11

bind_50100.exe
   [DETECTION] Is the Trojan horse TR/Dldr.QQHelper.TP.14

hyddp.exe
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/FSG). Please verify the origin of the file

yqud.exe
   [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Baidbar

显示全部楼层 · 发表于 2007-7-14 21:47:43

qqhelper

Scanned disks, folders and files: F:\setups[1]\
F:\setups[1]\bind_50100.exe - a variant of Win32/TrojanDownloader.QQHelper.NCO trojan

显示全部楼层 · 发表于 2007-7-14 21:57:44

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/13 18:54:26 (807131 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 827472
Command line: "@C:\Users\Jason\AppData\Local\Temp\~OD7030.tmp"
===================================================================================================

   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------
- Scanning files in the directory: D:\v\
   1332 ms D:\v\8150E1AA.exe
   120 ms D:\v\bind_50100.exe
   27 ms D:\v\hook.dll
   586 ms D:\v\hyddp.exe
   460 ms D:\v\hyllk.exe
   82 ms D:\v\hymm.idt
   775 ms D:\v\qqllk.dll
   1757 ms D:\v\qvjcbga.exe
   284 ms D:\v\setup.exe
   1237 ms D:\v\twin.exe                                              Security Risk Suspicious_F.gen ()
   2840 ms D:\v\yqud.exe
- File D:\v\twin.exe quarantined.
- File D:\v\twin.exe deleted.

===================================================================================================

The scanning started: 2007/07/14 21:49:17
            ended: 2007/07/14 21:49:28
Logged on as       : Jason
on hostname       : JASON-PC

Scanning results:
Total number of files found..............................:    11
Number of files scanned..................................:    11
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    0
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    1

Copyright (c) 1993-2005 Norman ASA.

显示全部楼层 · 发表于 2007-7-14 23:47:45

Hello,

hook.dll, hyddp.exe_, hyllk.exe_, hymm.idt, qqllk.dll, twin.exe_, yqud.exe_

No malicious code were found in these files.

setup.exe_ - Trojan.Win32.VB.sj

This file is already detected. Please update your antivirus bases.

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.