msnvirus1

uhthn2002

MD5
a736a8
f26917
a9bd07
2a8ebf
3940f4
c5822d
972f51
母體及生成物
VBa32
C:\Documents and Settings\uhthn\Desktop\msnv1\system32\setumgmt.dll : infected MalwareScope.Worm.Warezov.1
C:\Documents and Settings\uhthn\Desktop\msnv1\system32\uxthipro.exe : infected MalwareScope.Worm.Warezov.1
C:\Documents and Settings\uhthn\Desktop\msnv1\system32\w32tcomr.dll : infected MalwareScope.Worm.Warezov.1
C:\Documents and Settings\uhthn\Desktop\msnv1\system32\vbarccfg.dll : infected MalwareScope.Worm.Warezov.1
C:\Documents and Settings\uhthn\Desktop\msnv1\system32\w32tcomr.exe : infected MalwareScope.Worm.Warezov.1
C:\Documents and Settings\uhthn\Desktop\msnv1\smile[1].exe : infected MalwareScope.Worm.Warezov.1


Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Heuristics - OPEN
Scan in - C:\Documents and Settings\uhthn\Desktop\msnv1

C:\Documents and Settings\uhthn\Desktop\msnv1\smile[1].exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\msnv1\system32\setumgmt.dll - Suspicious of Worm.Warezov.1
C:\Documents and Settings\uhthn\Desktop\msnv1\system32\uxthipro.exe - Suspicious of Worm.Warezov.1
C:\Documents and Settings\uhthn\Desktop\msnv1\system32\w32tcomr.dat - OK
C:\Documents and Settings\uhthn\Desktop\msnv1\system32\w32tcomr.dll - Suspicious file
C:\Documents and Settings\uhthn\Desktop\msnv1\system32\vbarccfg.dll - Suspicious of Worm.Warezov.1
C:\Documents and Settings\uhthn\Desktop\msnv1\system32\w32tcomr.exe - Suspicious of Trojan-PSW.Game.4

7 Files scanned
0 Infected files found
6 Suspicious files found
0 Files cured
0 Files deleted

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\msnv1.rar'
F:\病毒样本\msnv1.rar
  [0] Archive type: RAR
  --> msnv1\system32\setumgmt.dll
      [DETECTION] Contains signature of the worm WORM/Stration.Gen
  --> msnv1\system32\uxthipro.exe
      [DETECTION] Contains signature of the worm WORM/Stration.Gen
  --> msnv1\system32\w32tcomr.dll
      [DETECTION] Contains signature of the worm WORM/Stration.Gen
  --> msnv1\system32\vbarccfg.dll
      [DETECTION] Contains signature of the worm WORM/Stration.Gen
  --> msnv1\system32\w32tcomr.exe
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> msnv1\smile[1].exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was deleted!

qwerasdf123

现在批处理都这么写了啊?
sandboxie都用上了

@echo off
:loop
del "C:\Documents and Settings\uhthn\Application Data\Sandbox\DefaultBox\drive\C\WINDOWS\system32\server.exe"
if exist "C:\Documents and Settings\uhthn\Application Data\Sandbox\DefaultBox\drive\C\WINDOWS\system32\server.exe" goto loop
C:\WINDOWS\system32\server.exe
del delplme.bat

残缺的唯美

fs  6个

tiedan2

Ikarus:
30:08:2007 19:06:29 SEARCHTASK "USER_DEFINED" started...
scan item: C:\Documents and Settings\zhenjia\桌面\msnv1.rar
File scanned: C:\Documents and Settings\zhenjia\桌面\msnv1.rar - SIGNATURE FOUND "Email-Worm.Win32.Warezov.qy"
30:08:2007 19:06:30 SEARCHTASK "USER_DEFINED" FINISHED...
----------------------------------------------------
Directories scanned: 0
Files scanned: 1
Virus found: 1
----------------------------------------------------

微点卫士

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSNV1\SMILE[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\W32TCOMR.DLL
2) C:\WINDOWS.0\SYSTEM32\W32TCOMR.EXE
3) C:\WINDOWS.0\SYSTEM32\VBARCCFG.DLL
4) C:\WINDOWS.0\SYSTEM32\UXTHIPRO.EXE
5) C:\WINDOWS.0\SYSTEM32\SETUMGMT.DLL
是否删除木马程序及其衍生物?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSNV1\SYSTEM32\W32TCOMR.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSNV1\SYSTEM32\W32TCOMR.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSNV1\SYSTEM32\VBARCCFG.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSNV1\SYSTEM32\UXTHIPRO.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSNV1\SYSTEM32\SETUMGMT.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

欠妳緈諨

ssy275

Result: 6 malware found
Email-Worm.Win32.Warezov.la (virus)
C:\Documents and Settings\ssy\×ÀÃæ\msnv1.exe\msnv1\system32\setumgmt.dll
Email-Worm.Win32.Warezov.pt (virus)
C:\Documents and Settings\ssy\×ÀÃæ\msnv1.exe\msnv1\system32\uxthipro.exe
Email-Worm.Win32.Warezov.qy (virus)
C:\Documents and Settings\ssy\×ÀÃæ\msnv1.exe\msnv1\system32\w32tcomr.dll
C:\Documents and Settings\ssy\×ÀÃæ\msnv1.exe\msnv1\system32\vbarccfg.dll
C:\Documents and Settings\ssy\×ÀÃæ\msnv1.exe\msnv1\system32\w32tcomr.exe
C:\Documents and Settings\ssy\×ÀÃæ\msnv1.exe\msnv1\smile[1].exe

king6808

Win32.Warezov.la

yym1988520

扫描类型：  手动 扫描
事件：  发现风险！
风险： W32.Stration.CX@mm


3 ge