msnvirus2

显示全部楼层 · 发表于 2007-8-30 18:47:37

14b437 d96771 fb0540 3c56d6 2ab163 897e8b

母體及生成物

vba32
C:\Documents and Settings\uhthn\Desktop\msnv2\Windows\avp.exe : infected Trojan.KeyLogger.711
C:\Documents and Settings\uhthn\Desktop\msnv2\jpg[1].exe : infected BackDoor.Pigeon.1604

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Heuristics - OPEN
Scan in - C:\Documents and Settings\uhthn\Desktop\msnv2

C:\Documents and Settings\uhthn\Desktop\msnv2\jpg[1].exe - Suspicious file
C:\Documents and Settings\uhthn\Desktop\msnv2\Windows\avp.exe - Suspicious of MalwareSpy.Win32.Trojan-Downloader.Delf.1
C:\Documents and Settings\uhthn\Desktop\msnv2\Windows\system32\readme.vbs - OK
C:\Documents and Settings\uhthn\Desktop\msnv2\Windows\system32\server.exe - Suspicious of MalwareSpy.Win32.Trojan-Downloader.Delf.1
C:\Documents and Settings\uhthn\Desktop\msnv2\Windows\system32\hvsound2.dll - Suspicious of Win32.Backdoor.Hupigon.5
C:\Documents and Settings\uhthn\Desktop\msnv2\Windows\system32\delplme.bat - OK

6 Files scanned
0 Infected files found
4 Suspicious files found
0 Files cured
0 Files deleted

显示全部楼层 · 发表于 2007-8-30 18:51:27

什么叫做Uhthn Anti-Spyware

显示全部楼层 · 发表于 2007-8-30 18:52:05

Starting the file scan:

Begin scan in 'F:\病毒样本\msnv2.rar'
F:\病毒样本\msnv2.rar
  [0] Archive type: RAR
  --> msnv2\Windows\avp.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> msnv2\Windows\system32\server.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> msnv2\Windows\system32\hvsound2.dll
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
--> msnv2\jpg[1].exe
   [1] Archive type: RAR SFX (self extracting)
   --> server.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-8-30 18:52:40

他写的是香港朋友

显示全部楼层 · 发表于 2007-8-30 18:54:29

卡饭真是高手如云

显示全部楼层 · 发表于 2007-8-30 18:55:30

高手年年有。。。今天特别多

显示全部楼层 · 发表于 2007-8-30 19:13:19

Ikarus:
30:08:2007 19:12:18 SEARCHTASK "USER_DEFINED" started...
scan item: C:\Documents and Settings\zhenjia\桌面\msnv2.rar
File scanned: C:\Documents and Settings\zhenjia\桌面\msnv2.rar - SIGNATURE FOUND "Backdoor.Win32.Agent.ahj"
30:08:2007 19:12:19 SEARCHTASK "USER_DEFINED" FINISHED...
----------------------------------------------------
Directories scanned: 0
Files scanned: 1
Virus found: 1
----------------------------------------------------

显示全部楼层 · 发表于 2007-8-30 19:20:24

jpg[1].exe
为什么红伞监控不报,但是扫描报呢?

显示全部楼层 · 发表于 2007-8-30 19:34:51

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSNV2\WINDOWS\SYSTEM32\SERVER.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\AVP.EXE
2) C:\WINDOWS.0\SYSTEM32\HVSOUND2.DLL
是否删除木马程序及其衍生物?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSNV2\WINDOWS\AVP.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\WINDOWS.0\SYSTEM32\SERVER.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-8-30 20:21:05

[病毒样本] msnvirus2

本帖子中包含更多资源

回复 #2 solcroft 的帖子

本帖子中包含更多资源