红伞又挂了[FC2C45]

显示全部楼层 · 发表于 2007-9-30 22:29:35

死的么

显示全部楼层 · 发表于 2007-10-1 02:40:43

Status       Quarantined
Target       G:\v\playasp.rar
                     Options
                                          , Requested action: Repair, Excluded extensions disabled,
                     Excluded objects disabled, Heuristics enabled, Sandbox enabled, Scan
                     archives

      Statistics       Details

                                          Files             Boot sectorsRegistry key

                     Scanned             3                      0                      0
                        Infected             1                      0                      0
                     Repaired             0                      0                      0
                     Renamed             0                      -                         -
                  Quarantined             1                      -                         -
                        Deleted             0                      -                      0

显示全部楼层 · 发表于 2007-10-1 03:55:09

有人上报了吧
小红伞现在可以了
Antivir  TR/Dldr.Agent.dri
Ikarus  BehavesLikeTrojan.Downloader [比suspicious(level 55)更加详细了]
F-Secure W32/Downloader
Panda  Suspicious file
Webwasher-Gateway  Trojan.Dldr.Agent.dri

★playasp.exe :
   ☆NOT Compressed

★GNRinfo
☆Drops files in %WINSYS% folder.
☆Creating several executable files on hard-drive.

★Changes to filesystem
☆Creates file C:\arun.reg.
☆Deletes file c:\arun.reg.
☆Creates file C:\WINDOWS\SYSTEM32\wxpSetup.txt.
☆Creates file C:\WINDOWS\SYSTEM32\wxpSetup.exe.
☆Deletes file C:\WINDOWS\SYSTEM32\wxpSetup.txt.

★Network services
☆Downloads file from hxxp://xxx1.softuu.cn/download/wxpSetup.txt as C:\WINDOWS\S       YSTEM32\wxpSetup.txt.
☆Connects to "xxx1.softuu.cn"（中国浙江省金华市电信IDC机房）on port 80 (TCP).
☆Opens URL: xxx1.softuu.cn/download/wxpSetup.txt.

★Security issues
☆Starting downloaded file - potential security problem.

★Process&window info
   ☆Creates an event called .

显示全部楼层 · 发表于 2007-10-1 08:50:06

Virus: Trojan-Downloader.Win32.Agent.dri

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2007-10-1 11:41:46

Start of the scan: 2007年10月1日  11:39

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\playasp.rar
  [0] Archive type: RAR
  --> playasp.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.dri
   [INFO]    The file was deleted!

End of the scan: 2007年10月1日  11:39
Used time: 00:09 min

The scan has been done completely.

   1 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-10-1 12:52:50

微点现在报未知、
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\PLAYASP.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-10-1 12:54:28

antivir不乏上报者呵呵~

显示全部楼层 · 发表于 2007-10-1 14:05:41

关了服务就行

显示全部楼层 · 发表于 2007-10-1 15:54:03

已删除：木马程序 Trojan-Downloader.Win32.Agent.dri 文件: F:\10.1\playasp.rar/playasp.exe

显示全部楼层 · 发表于 2007-10-1 17:00:27

KAV 7.0

[病毒样本] 红伞又挂了[FC2C45]

红伞杀!

本帖子中包含更多资源

浏览过的版块