又更新了MD5: A7DCA819

moonsilver

残缺的唯美

D:\Documents and Settings\Administrator\桌面\server.rar >>RAR >>server.exe - Win32/AutoRun.K 蠕虫的变种
D:\Documents and Settings\Administrator\桌面\server.rar - Win32/AutoRun.K 蠕虫的变种 - 已隔离 - 已删除

yurius

C:\virus\server.exe - probably infected with DLOADER.Trojan

红心王子

不杀 上报

Scan taken on 25 Jul 2007 07:40:48 (GMT)
A-Squared	Found nothing
AntiVir	Found TR/Delphi.Downloader.Gen
ArcaVir	Found nothing
Avast	Found Win32:Fujack-Z
AVG Antivirus	Found nothing
BitDefender	Found Generic.Malware.SBdldsp.47DB69AE
ClamAV	Found nothing
CPsecure	Found nothing
Dr.Web	Found DLOADER.Trojan (probable variant)
F-Prot Antivirus	Found Possibly a new variant of W32/SelfStarterInternetTrojan!Maximus
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found a variant of Win32/AutoRun.K
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
Sophos Antivirus	Found Mal/DelpDldr-C
VirusBuster	Found nothing
VBA32	Found nothing

Redevil

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=104901 is infected with Downloader virus

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/24 08:21:08 (815016 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 835357
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~ODA.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: F:\v\server.exe
     1172 ms F:\v\server.exe                                              Virus W32/NetworkWorm ( [ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * Decompressing UPX.
    * Creating several executable files on hard-drive.
    * File length:        26624 bytes.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\SYSTEM32\SVSH0ST.EXE.
    * Creates file C:\sample.bat.
    * Creates file C:\WINDOWS\SYSTEM32\Autorun.inf.
    * Creates file C:\lcg.exe.
    * Creates file C:\autorun.inf.
    * Creates file N:\autorun.inf.
    * Creates file N:\lcg.exe.

[ Spreading through LAN/WAN ]
    * Worm spreading over a network connection.

[ Process/window information ]
    * Creates a mutex niux.
    * Attemps to open REG.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V svchost /T REG_SZ /D C:\WINDOWS\SYSTEM32\SVSH0ST.EXE /F.
    * Attemps to open REG.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_EXPAND_SZ /d http://www.hao123.com                                                                                /f.
    * Attemps to open REG.exe add "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" /v "HomePage" /t REG_DWORD /d 00000001 /f.
    * Attemps to open REG.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate /v DisableWindowsUpdateAccess /t REG_dword /d 00000001 /f.

)
- File F:\v\server.exe quarantined.
- File F:\v\server.exe deleted.

===================================================================================================

The scanning started: 2007/07/25 16:03:35
               ended: 2007/07/25 16:03:37
Logged on as        : Administrator
on hostname         : 2FEA146376E2420

Scanning results:
   Total number of files found..............................:       1
   Number of files scanned..................................:       1
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       0
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       1

Copyright (c) 1993-2005 Norman ASA.