[5F55D4 4B6BF7]随即6位数

显示全部楼层 · 发表于 2007-9-15 13:40:10

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL: bbs.kafan.cn/attachment.php?aid=127876
Information: Contains detection pattern of the dropper DR/Cinmus.RJ

--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 7.01.00.11, AVE 7.6.0.10, VDF 6.39.1.134

显示全部楼层 · 发表于 2007-9-15 13:40:11

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\ABC.zip'
C:\Documents and Settings\Administrator\My Documents\
  ABC.zip
[0] Archive type: ZIP
--> upxdnd.exe
      [DETECTION] Contains detection pattern of the dropper DR/Cinmus.RJ
      [WARNING] Infected files in archives cannot be repaired!
--> upxdnd.dll
      [DETECTION] Contains detection pattern of the dropper DR/Cinmus.RJ
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-9-15 13:42:17

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\UPXDND.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\UPXDND.EXE
2) C:\WINDOWS.0\SYSTEM32\UPXDND.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-9-15 13:54:45

2007-9-15 13:54:15 1189835655 Administrator 4020 Sign of "Win32:Onlinegames-BBZ [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\ABC.zip\upxdnd.exe\[Embedded#1c60]" file.
2007-9-15 13:54:17 1189835657 Administrator 4020 Sign of "Win32:Onlinegames-BBZ [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\ABC.zip\upxdnd.exe" file.
2007-9-15 13:54:17 1189835657 Administrator 4020 Sign of "Win32:Onlinegames-BBZ [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\ABC.zip\upxdnd.dll" file.

显示全部楼层 · 发表于 2007-9-15 14:01:19

没过红伞

显示全部楼层 · 发表于 2007-9-15 14:02:48

NOD
D:\av\ABC.zip >>ZIP >>upxdnd.exe - 可能是 Win32/PSW.OnLineGames.YA 木马的一个变种
D:\av\ABC.zip >>ZIP >>upxdnd.dll - 可能是 Win32/Genetik 木马的一个变种

显示全部楼层 · 发表于 2007-9-15 14:06:35

卡巴 7.0.0.125 启发

已检测到: 病毒 Heur.Invader (变种) URL: http://bbs.kafan.cn/attachment.php?aid=127876//upxdnd.exe

[ 本帖最后由浪滔天于 2007-9-15 14:08 编辑 ]

显示全部楼层 · 发表于 2007-9-15 17:05:12

Virus: Win32:Onlinegames-BBZ [Trj] (2x)

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2007-9-15 18:58:28

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 4948
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\upxdnd.exe - Suspicious of Trojan-PSW.OnLineGames.1
C:\Documents and Settings\uhthn\Desktop\New Folder\upxdnd.dll - Suspicious of Trojan-PSW.OnLineGames.1

2 Files scanned
0 Infected files found
2 Suspicious files found
0 Files cured
0 Files deleted

[病毒样本] [5F55D4 4B6BF7]随即6位数

本帖子中包含更多资源