老远捡来的[MD5: 9783B9 87212B FF7401 ED26E1 B2D934]

显示全部楼层 · 发表于 2007-8-22 11:02:02

msntsrv(2).exe

AntiVir 7.4.1.63 2007.08.21 HEUR/Crypted
CAT-QuickHeal 9.00 2007.08.21 (Suspicious) - DNAScan
DrWeb 4.33 2007.08.21 Trojan.PWS.Webmonier
eSafe 7.0.15.0 2007.08.20 suspicious Trojan/Worm
Microsoft 1.2803 2007.08.22 Backdoor:Win32/Haxdoor
NOD32v2 2474 2007.08.22 probably unknown NewHeur_PE virus
Norman 5.80.02 2007.08.21 Suspicious_F.gen
Panda 9.0.0.4 2007.08.21 Suspicious file
Sophos 4.20.0 2007.08.22 Mal/Packer
Sunbelt 2.2.907.0 2007.08.22 VIPRE.Suspicious
VBA32 3.12.2.2 2007.08.21 suspected of Malware.Agent.38
Webwasher-Gateway 6.0.1 2007.08.22 Heuristic.Crypted

显示全部楼层 · 发表于 2007-8-22 11:08:52

msntsrv(3).exe

ntiVir 7.4.1.63 2007.08.21 TR/Crypt.XPACK.Gen
Authentium 4.93.8 2007.08.22 -
Avast 4.7.1029.0 2007.08.21 -
AVG 7.5.0.484 2007.08.21 PSW.Ldpinch.NOK
BitDefender 7.2 2007.08.22 Trojan.PWS.LDPinch.TAW
CAT-QuickHeal 9.00 2007.08.21 (Suspicious) - DNAScan
DrWeb 4.33 2007.08.21 Trojan.PWS.LDPinch.1781
F-Secure 6.70.13030.0 2007.08.22 LdPinch.JVR
Ikarus T3.1.1.12 2007.08.22 Trojan-PWS.LDPinch.TAW
Microsoft 1.2803 2007.08.22 TrojanDownloader:Win32/Small.CBA
NOD32v2 2474 2007.08.22 Win32/PSW.LdPinch.NEL
Norman 5.80.02 2007.08.21 LdPinch.JVR
Prevx1 V2 2007.08.22 Generic.Malware
Rising 19.37.20.00 2007.08.22 Packer.RyCrypt
Sophos 4.20.0 2007.08.22 Mal/Basine-C
Sunbelt 2.2.907.0 2007.08.22 Trojan-PWS.LDPinch.TAW
VirusBuster 4.3.26:9 2007.08.21 Trojan.DR.Cimuz.Gen.1
Webwasher-Gateway 6.0.1 2007.08.22 Trojan.Crypt.XPACK.Gen

显示全部楼层 · 发表于 2007-8-22 11:18:43

Hello,

282.exe_ - Backdoor.Win32.IRCBot.adg,
msntsrv(1).exe_ - Trojan-Downloader.Win32.Obfuscated.ca,
msntsrv(2).exe_ - Trojan-Spy.Win32.Banker.crq,
msntsrv(3).exe_ - Trojan-PSW.Win32.LdPinch.cej

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Namestnikov Yury
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: 5s.zip

显示全部楼层 · 发表于 2007-8-22 16:07:15

瑞星杀掉一个

显示全部楼层 · 发表于 2007-8-22 16:12:53

ca pass

显示全部楼层 · 发表于 2007-8-22 16:17:01

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\282.EXE
被修改文件:
C:\WINDOWS.0\SYSTEM32\DRIVERS\IP6FW.SYS
是否阻止文件被修改?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\282.EXE
是否删除病毒程序及其衍生物?
程序:
C:\WINDOWS.0\SYSTEM32\LDRB3.TMP
被修改文件:
C:\WINDOWS.0\SYSTEM32\DRIVERS\IP6FW.SYS
是否阻止文件被修改?
程序:
C:\WINDOWS.0\SYSTEM32\LDRB3.TMP
是否删除病毒程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSNTSRV(2).EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\ATI2KAAG.DLL
2) C:\WINDOWS.0\SYSTEM32\ATI2KSAG.SYS
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSNTSRV(3).EXE
是可疑程序!
试图修改关键系统文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSNTSRV(3).EXE
是否删除病毒程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\SMSS.EXE
修改注册表项:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
是否阻止?
程序:
C:\B5.TMP
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\WINLOGON.EXE
2) C:\WINDOWS.0\SYSTEM32\DEFLIB.SYS
是否删除木马程序及其衍生物?
木马名称:Trojan.Win32.Agent.hhh

程序:
C:\WINDOWS.0\SYSTEM32\DEFLIB.SYS
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\B7.TMP
是否删除木马程序及其衍生物?
蠕虫名称:Worm.Win32.Agent.dsq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\V3XD1.G22ME
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Agent.dsq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\8DAF4D6B\ZGAME1[1]
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\WINDOWS.0\SYSTEM32\DLLH8JKD1Q7.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\8DAF4D6B\ZGAME1[1]
是否删除木马程序及其衍生物?
木马名称:Trojan-Downloader.Win32.Tiny.s

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\VX1DT1.GAME
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Tiny.s

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\8DAF4D6B\ZTOOL1[1]
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\WINDOWS.0\SYSTEM32\DLLH8JKD1Q6.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\8DAF4D6B\ZTOOL1[1]
是否删除木马程序及其衍生物?

好多

显示全部楼层 · 发表于 2007-8-22 16:17:54

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.

显示全部楼层 · 发表于 2007-8-23 02:00:36

C:\Documents and Settings\uhthn\Desktop\virus\msntsrv.exe : infected Trojan.Win32.Small.or
C:\Documents and Settings\uhthn\Desktop\virus\msntsrv(2).exe : is suspected of Malware.Agent.38

Directories    : 0    Files in archives:    Files on disks:
Archives:                - total    : 0    - total    : 5
- scanned       : 0    -  scanned : 0    - scanned    : 5
- contain viruses : 0    -  infected : 0    - infected : 1
- deleted       : 0    -  suspicious : 0    - suspicious  : 1

显示全部楼层 · 发表于 2007-8-23 11:38:25

费尔1个木马，启发3个

显示全部楼层 · 发表于 2007-8-23 15:12:02

AhnLab-V3 2007.8.22.0 2007.08.23 -
AntiVir 7.4.1.63 2007.08.23 TR/Rootkit.Gen
Authentium 4.93.8 2007.08.22 W32/Krotten.A
Avast 4.7.1029.0 2007.08.22 Win32:Agent-KCT
AVG 7.5.0.484 2007.08.22 BackDoor.Ircbot.BAE
BitDefender 7.2 2007.08.23 Trojan.Krotten.B
CAT-QuickHeal 9.00 2007.08.22 (Suspicious) - DNAScan
ClamAV 0.91 2007.08.22 -
DrWeb 4.33 2007.08.23 Trojan.MulDrop.8364
eSafe 7.0.15.0 2007.08.22 Suspicious Trojan/Worm
eTrust-Vet 31.1.5081 2007.08.23 -
Ewido 4.0 2007.08.22 Trojan.Agent.ht
FileAdvisor 1 2007.08.23 -
Fortinet 2.91.0.0 2007.08.23 -
F-Prot 4.3.2.48 2007.08.22 -
F-Secure 6.70.13030.0 2007.08.23 Trojan-Downloader.Win32.Obfuscated.ca
Ikarus T3.1.1.12 2007.08.23 Backdoor.Win32.Rbot.aeu
Kaspersky 4.0.2.24 2007.08.23 Backdoor.Win32.IRCBot.adg
McAfee 5103 2007.08.22 New Malware.aj
Microsoft 1.2803 2007.08.23 TrojanDropper:Win32/Tibs.gen!lds
NOD32v2 2477 2007.08.23 Win32/TrojanDownloader.Nurech.NBG
Norman 5.80.02 2007.08.22 W32/Tibs.AOBB
Panda 9.0.0.4 2007.08.23 Suspicious file
Prevx1 V2 2007.08.23 Generic.Malware
Rising 19.37.31.00 2007.08.23 Trojan.DL.Win32.Agent.yak
Sophos 4.20.0 2007.08.23 Mal/Packer
Sunbelt 2.2.907.0 2007.08.23 VIPRE.Suspicious
Symantec 10 2007.08.23 -
TheHacker 6.1.8.171 2007.08.23 Trojan/Spy.Banker.crq
VBA32 3.12.2.2 2007.08.22 Email-Worm.Win32.Zhelatin.gv
VirusBuster 4.3.26:9 2007.08.22 Trojan.DR.Cimuz.Gen.1
Webwasher-Gateway 6.0.1 2007.08.23 Trojan.Rootkit.Gen

[病毒样本] 老远捡来的[MD5: 9783B9 87212B FF7401 ED26E1 B2D934]