过卡巴的一支［MD5:546ca2］

zxkf

过卡巴的一支

woai_jolin

===================================================================================================
Norman Virus Control On-demand scanner 7.0.0.9

NSE revision 5.91.04
nvcbin.def revision 5.90.00 of 2007/08/09 20:07:15 (824384 variants)
nvcmacro.def revision 5.90.00 of 2007/08/06 19:46:49 (20358 variants)
Total number of variants: 844742
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------

- Scanning drive: F:\
- Scanning system areas of drive: F:\
- Scanning files matching: F:\v\GHO.exe
     3719 ms F:\v\GHO.exe                                                 Virus W32/NetworkWorm ( [ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * Creating several executable files on hard-drive.
    * File length:        26553 bytes.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\SYSTEM32\crsss.exe.
    * Creates file C:\sample.bat.
    * Creates file C:\WINDOWS\SYSTEM32\Autorun.inf.
    * Creates file C:\GHO.exe.
    * Creates file C:\autorun.inf.
    * Creates file N:\autorun.inf.
    * Creates file N:\GHO.exe.

[ Spreading through LAN/WAN ]
    * Worm spreading over a network connection.

[ Process/window information ]
    * Creates a mutex baby.
    * Attemps to open REG.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V crsss /T REG_SZ /D C:\WINDOWS\SYSTEM32\crsss.exe /F.
    * Attemps to open REG.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate /v DisableWindowsUpdateAccess /t REG_dword /d 00000001 /f.
    * Attemps to open REG.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL /v CheckedValue /t REG_dword /d 00000000 /f.

)
- File F:\v\GHO.exe quarantined.
- File F:\v\GHO.exe deleted.

===================================================================================================

The scanning started: 2007/08/14 20:09:10
               ended: 2007/08/14 20:09:15
Logged on as        : Administrator
on hostname         : 2FF87FC2B9AB46F

Scanning results:
   Total number of files found..............................:       1
   Number of files scanned..................................:       1
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       0
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       1

Copyright (c) 1993-2005 Norman ASA.

微点卫士

微点：
程序:
C:\WINDOWS.0\SYSTEM32\CRSSS.EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?
程序:
C:\WINDOWS.0\SYSTEM32\CRSSS.EXE
是否删除病毒程序及其衍生物?

hj5abc

a variant of Win32/AutoRun.K worm

小邪邪

AVK杀了

sb

江民又挂了

zxkf

原帖由 微点卫士 于 2007-8-14 20:11 发表

试图修改系统时间!

有改系统时间么？偶这里设置不能改系统时间的，但MS这支不单过了卡巴的扫描，连主动防御都过了，有用卡7的试试～

1688388728

病毒: Win32:Delf-FKN [Trj]
文件: GHO[1].rar
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM
进程: Maxthon.exe

hkt988

Product: BitDefender 9 Professional Plus
//        Version: 9.5
//
//        创建在:        14/08/2007        14:39:13
//
//-----------------------------------------------------------------


病毒统计

扫描路径        : D:\下载文件夹\GHO.rar
文件夹        : 0
文件        :  2
存档        : 1
被压缩的文件        : 0
被识别的病毒        : 1
被感染文件        : 1

残缺的唯美

--> GHO.exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      A backup was created as '4710a279.qua'  ( QUARANTINE )
        [INFO]      The file was deleted!