hxxp://85.255.120.78/bc/config.html [MD5: 0C36FF]

显示全部楼层 · 发表于 2007-7-25 01:12:32

继续整理东西[:26:]

[ 本帖最后由 lanvin 于 2007-7-25 01:16 编辑 ]

显示全部楼层 · 发表于 2007-7-25 01:13:26

Scan performed at: 2007-7-25 1:13:15
Scanning Log
NOD32 version 2417 (20070724) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.rar
Operating memory - is OK

Date: 25.7.2007 Time: 01:13:20
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.rar
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?1800.exe - probably a variant of Win32/Spy.Agent.EO trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 01:13:21 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2007-7-25 01:16:23

金山报病毒:UnKnownVirus.Morphine

显示全部楼层 · 发表于 2007-7-25 01:22:00

不厚道的去jotti上扫了下。。。。很多都在报X。。。

显示全部楼层 · 发表于 2007-7-25 06:08:22

C:\Documents and Settings\Administrator\桌面\样本
.rar>>1800.exe>>morphine
Trojan.Spy.BZub.adc
干掉。。

显示全部楼层 · 发表于 2007-7-25 07:28:02

avast挂

显示全部楼层 · 发表于 2007-7-25 08:09:24

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=104647 is infected with Packed.Win32.Morphine.a virus

显示全部楼层 · 发表于 2007-7-25 08:47:37

微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.203\1800.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\IPV6MONS.DLL
是否删除木马程序及其衍生物?

木马名称:未知后门程序
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.359\1800.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-7-25 08:57:57

样本.rar
  [0] Archive type: RAR
  --> 1800.exe
   [DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen

显示全部楼层 · 发表于 2007-7-25 09:06:16

AhnLab-V3	2007.7.25.0	2007.07.24	Win-Trojan/Morphine.75264.AI
AntiVir	7.4.0.44	2007.07.24	TR/Crypt.Morphine.Gen
Authentium	4.93.8	2007.07.24	no virus found
Avast	4.7.997.0	2007.07.25	no virus found
AVG	7.5.0.476	2007.07.24	PSW.Generic4.VHW
BitDefender	7.2	2007.07.25	Trojan.Spy.BZub.ET
CAT-QuickHeal	9.00	2007.07.24	(Suspicious) - DNAScan
ClamAV	devel-20070416	2007.07.24	no virus found
DrWeb	4.33	2007.07.25	Trojan.PWS.Tanspy
eSafe	7.0.15.0	2007.07.24	Suspicious Trojan/Worm
eTrust-Vet	31.1.5003	2007.07.24	no virus found
Ewido	4.0	2007.07.24	no virus found
FileAdvisor	1	2007.07.25	no virus found
Fortinet	2.91.0.0	2007.07.24	W32/Cimuz.A!tr
F-Prot	4.3.2.48	2007.07.25	no virus found
F-Secure	6.70.13030.0	2007.07.25	Packed.Win32.Morphine.a
Ikarus	T3.1.1.8	2007.07.24	MalwareScope.Trojan-Spy.BZub.1
Kaspersky	4.0.2.24	2007.07.25	Packed.Win32.Morphine.a
McAfee	5081	2007.07.24	no virus found
Microsoft	1.2704	2007.07.25	VirTool:Win32/Obfuscator.E
NOD32v2	2417	2007.07.24	probably a variant of Win32/Spy.Agent.EO
Norman	5.80.02	2007.07.24	W32/BHO.QG
Panda	9.0.0.4	2007.07.24	Generic Malware
Sophos	4.19.0	2007.07.17	Troj/Cimuz-CH
Sunbelt	2.2.907.0	2007.07.25	Infostealer.Bzup
Symantec	10	2007.07.25	Infostealer.Bzup
TheHacker	6.1.7.152	2007.07.23	Trojan/Morphine.a
VBA32	3.12.2.1	2007.07.24	MalwareScope.Trojan-Spy.BZub.1
VirusBuster	4.3.26:9	2007.07.24	no virus found
Webwasher-Gateway	6.0.1	2007.07.25	Trojan.Crypt.Morphine.Gen

[病毒样本] hxxp://85.255.120.78/bc/config.html [MD5: 0C36FF]

本帖子中包含更多资源