一下载者及几个DLL[MD5: FFF594 9BFB01 C24069 4BF01C 1BF02E 107F20]

promised

1. 00408824 MOV EDX,复件_Fot.00408894 ASCII "c:\mensagem.exe"
   
2. 00408829 MOV EAX,复件_Fot.004088AC ASCII "http://www.zas.ir/1.exe"
   
3. 00408839 PUSH 复件_Fot.004088C4 ASCII "c:\mensagem.exe"
   
4. 00408843 MOV EDX,复件_Fot.004088DC ASCII "c:\explorers.exe"
   
5. 00408848 MOV EAX,复件_Fot.004088F8 ASCII "http://www.zas.ir/2.exe"
   
6. 00408858 PUSH 复件_Fot.00408910 ASCII "c:\explorers.exe"
   
7. 00408862 MOV EDX,复件_Fot.0040892C ASCII "c:\cfg.exe"
   
8. 00408867 MOV EAX,复件_Fot.00408940 ASCII "http://www.zas.ir/3.exe"
   
9. 00408877 PUSH 复件_Fot.00408958 ASCII "c:\cfg.exe"

复制代码

连接都失效了[MD5: FFF594 9BFB01 C24069 4BF01C 1BF02E 107F20]

changzheng2

AVIRA C 【1个】
Archive type: RAR
  --> FotoMensagem.scr
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!

7 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious

补充：AVIRA P版报 jzdv.dll 为ADSPY/Boran.XSS.2
报lbfx.dll 为ADSPY/Boran.XSS.2
报oeia.dll 为ADSPY/Boran.XSS.2
所以AVIRA P报【4个】，过2个。

[ 本帖最后由 changzheng2 于 2007-10-3 11:34 编辑 ]

shixinlong044

FSIS2008扫描三个病毒一个间谍

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\fotomensagem.rar'
C:\Users\morgan\Documents\
  fotomensagem.rar
    [0] Archive type: RAR
    --> FotoMensagem.scr
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> lbfx.dll
        [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Boran.XSS.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> oeia.dll
        [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Boran.XSS.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> cswo.dll
    --> gwas.dll
    --> jzdv.dll
        [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Boran.XSS.2
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年10月2日  20:32
Used time: 00:06 min

The scan has been done completely.

      0 Scanning directories
      7 Files were scanned
      4 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
      5 Warnings
      0 Notes

wangfeng66

SCR 未知病毒。 NOD只报一个

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\fotomensagem\FotoMensagem.scr]
                    …………发现Spy！报告:[1]
文件信息:  大小:68096  MD5:fff594862336027b09f4535412c9a32e


[C:\Documents and Settings\Administrator\桌面\Virus\fotomensagem\jzdv.dll]
                    …………发现Spy！报告:[2]
文件信息:  大小:94208  MD5:107f20f0a11a406cd01c466dc1939c58


文件数:6   病毒数:2  比重:0.3333333333333
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎

moonsilver

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.DL.Agent.bsw

浪滔天

卡巴 7.0.0.125
4个

已删除: 木马程序 Trojan-Spy.Win32.Banker.bbb        文件: F:\病毒样本\fotomensagem.rar/FotoMensagem.scr
已删除: 广告程序 not-a-virus:AdWare.Win32.Boran.bj        文件: F:\病毒样本\fotomensagem.rar/lbfx.dll
已删除: 广告程序 not-a-virus:AdWare.Win32.Boran.bi        文件: F:\病毒样本\fotomensagem.rar/gwas.dll
已删除: 广告程序 not-a-virus:AdWare.Win32.Boran.bh        文件: F:\病毒样本\fotomensagem.rar/jzdv.dll

The EQs

Scan performed at: 2007-10-3 12:46:16
Scanning Log
NOD32 version 2567 (20071002) NT
Command line: C:\Documents and Settings\Don johnson\桌面\fotomensagem.rar
Operating memory - is OK

Date: 3.10.2007  Time: 12:46:21
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\fotomensagem.rar
C:\Documents and Settings\Don johnson\桌面\fotomensagem.rar ?RAR ?FotoMensagem.scr - probably unknown NewHeur_PE virus [7]
Number of scanned files: 7
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 12:46:21 Total scanning time: 0 sec (00:00:00)

Notes:
[7] File is probably infected with an unknown virus.

微点卫士

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\FOTOMENSAGEM.SCR
协议类型:TCP
本地地址:0.0.0.0
本地端口:1659
远端地址:209.59.195.12(美国)
远端端口:80
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\FOTOMENSAGEM.SCR
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\FOTOMENSAGEM.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:

1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\FOTOMENSAGEM.BAT
是否删除可疑程序?