毒网前几天提的hxxp://www.datong.gov.cn/ MD5:731219

显示全部楼层 · 发表于 2007-9-5 22:30:41

hxxp://www.datong.gov.cn/fototorpedos.scr

显示全部楼层 · 发表于 2007-9-5 22:33:15

Scan performed at: 2007-9-5 22:32:57
Scanning Log
NOD32 version 2507 (20070905) NT
Command line: C:\Documents and Settings\Don johnson\桌面\样本.rar
Operating memory - is OK

Date: 5.9.2007 Time: 22:33:00
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\样本.rar
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?fototorpedos.scr - a variant of Win32/TrojanDownloader.Dadobra.IA trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 22:33:00 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-9-5 22:56:29

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本.rar
[0] Archive type: RAR
--> fototorpedos.scr
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-5 23:01:10

detected: Trojan program Trojan-Downloader.Win32.Delf.ari File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/fototorpedos.scr

显示全部楼层 · 发表于 2007-9-5 23:03:20

显示全部楼层 · 发表于 2007-9-5 23:59:19

微点，运行提示联网拒绝后，样本自动退出。

显示全部楼层 · 发表于 2007-9-6 11:19:45

微点：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\FOTOTORPEDOS.SCR
协议类型:TCP
本地地址:0.0.0.0
本地端口:3740
远端地址:220.167.167.2(青海·西宁)
远端端口:80
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\FOTOTORPEDOS.SCR
蠕虫程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\GIY0AKC8\BRADESCO[1].EXE
2) C:\CONF\MSM.CMD
是否删除蠕虫程序及其衍生物?

[病毒样本] 毒网前几天提的hxxp://www.datong.gov.cn/ MD5:731219

本帖子中包含更多资源

本帖子中包含更多资源

[病毒样本] 毒网 前几天提的hxxp://www.datong.gov.cn/ MD5:731219

本帖子中包含更多资源

本帖子中包含更多资源

[病毒样本] 毒网前几天提的hxxp://www.datong.gov.cn/ MD5:731219