5个更新[MD5: 797381 28C795 2C2B79 430672 53752F]

显示全部楼层 · 发表于 2007-10-12 17:19:32

C:\Documents and Settings\Don johnson\桌面\样本2.rar » RAR » servet.exe - probably a variant of Win32/TrojanDownloader.Delf.NSA trojan
C:\Documents and Settings\Don johnson\桌面\样本2.rar » RAR » ntldr.com - probably a variant of Win32/TrojanDownloader.Delf.NSA trojan
C:\Documents and Settings\Don johnson\桌面\样本2.rar » RAR » logo.exe » RAR » 2.bat - BAT/KillAV.EC trojan
C:\Documents and Settings\Don johnson\桌面\样本2.rar » RAR » logo.exe » RAR » 2.exe - probably a variant of Win32/TrojanDownloader.Delf.NSA trojan
C:\Documents and Settings\Don johnson\桌面\样本2.rar » RAR » no.exe - a variant of Win32/PSW.OnLineGames.NFF trojan
C:\Documents and Settings\Don johnson\桌面\样本2.rar » RAR » 3A164BDB8EB1.dll - a variant of Win32/PSW.OnLineGames.NFF trojan

显示全部楼层 · 发表于 2007-10-12 17:21:09

kv不报

显示全部楼层 · 发表于 2007-10-12 17:22:00

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本2.rar'
C:\Documents and Settings\Administrator\桌面\样本2.rar
  [0] Archive type: RAR
  --> servet.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> ntldr.com
   [DETECTION] Contains suspicious code HEUR/Crypted
  --> logo.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [1] Archive type: RAR SFX (self extracting)
   --> 2.bat
      [DETECTION] Contains detection pattern of the batch virus BAT/Zyfore.AB
   --> 2.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> no.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 3A164BDB8EB1.dll
   [DETECTION] Contains suspicious code HEUR/Crypted
   [WARNING] The file was ignored!

End of the scan: 星期五 2007年10月12日  17:22
Used time: 00:17 min

The scan has been done completely.

   0 Scanning directories
   9 Files were scanned
   4 viruses and/or unwanted programs were found
   3 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   5 Files not concerned
   2 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-10-12 18:12:36

KIS7高启发不报

显示全部楼层 · 发表于 2007-10-12 18:18:21

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\样本2\ntldr.com]
                  …………发现Spy！报告:[1]
文件信息:  大小:20480  MD5:28c795dfce28c7e95894adbaa69d5b00

[C:\Documents and Settings\Administrator\桌面\Virus\样本2\logo.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:72705  MD5:2c2b7997375543b0fbc653d065cd0b87

[C:\Documents and Settings\Administrator\桌面\Virus\样本2\no.exe]
                  …………发现Spy！报告:[1]
文件信息:  大小:84992  MD5:430672f7023b9d3aa26287e5182b6bbe

[C:\Documents and Settings\Administrator\桌面\Virus\样本2\3A164BDB8EB1.dll]
                  …………发现Spy！报告: [4] [1]
文件信息:  大小:68096  MD5:53752f1ee7ad4c4cfaa1e2afc669bbe0

文件数:5 病毒数:4  比重:0.8
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

显示全部楼层 · 发表于 2007-10-12 18:39:15

程序:
D:\客户端\样本2\NO.EXE
木马程序生成以下文件:
1) C:\WINDOWS\DEBUG\3A164BDB8EB1.DLL
是否删除木马程序及其衍生物?
程序:
D:\客户端\样本2\NTLDR.COM
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\NTLDR.COM
是否删除木马程序及其衍生物?
程序:
D:\客户端\样本2\SERVET.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SERVET.EXE
是否删除木马程序及其衍生物?
微点报了3个

显示全部楼层 · 发表于 2007-10-12 19:17:57

微点五个全杀
时间处理结果木马名称木马进程名木马文件创建者
2007-10-12 19:10:30 处理成功未知木马 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$DI01.715\3A164BDB8EB1.DLL G:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-10-12 19:10:19 处理成功未知木马 C:\WINDOWS\DEBUG\3A164BDB8EB1.DLL C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX12.974\NO.EXE
2007-10-12 19:10:08 处理成功未知木马 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX12.974\NO.EXE G:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-10-12 19:09:53 处理成功未知间谍软件 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX12.974\NTLDR.COM G:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-10-12 19:09:50 处理成功未知间谍软件 C:\WINDOWS\SYSTEM32\SERVET.EXE C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX08.217\SERVET.EXE
2007-10-12 19:09:49 处理成功未知间谍软件 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX12.974\SERVET.EXE G:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-10-12 19:09:46 处理成功未知间谍软件 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX08.217\SERVET.EXE G:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-10-12 19:09:28 处理成功未知间谍软件 C:\WINDOWS\SYSTEM32\NTLDR.COM C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$DI05.464\NTLDR.COM
2007-10-12 19:09:19 处理成功未知间谍软件 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$DI05.464\NTLDR.COM G:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-10-12 19:09:09 延时删除未知间谍软件 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX08.217\NTLDR.COM G:\PROGRAM FILES\WINRAR\WINRAR.EXE

时间处理结果病毒名称病毒进程名病毒文件创建者
2007-10-12 19:08:34 处理成功未知病毒 C:\WINDOWS\EHOME\2.BAT
2007-10-12 19:08:28 处理成功未知病毒 C:\WINDOWS\EHOME\2.BAT

显示全部楼层 · 发表于 2007-10-12 19:19:56

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.Agent.bds
病毒： Trojan.DL.Win32.Inject.l
病毒： Trojan.Win32.Agent.znu

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.44.42

显示全部楼层 · 发表于 2007-10-12 20:51:19

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 504
Paranoia Database - 10368
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\0

C:\Documents and Settings\uhthn\Desktop\0\servet.exe - Suspected MalwareDetector:Trojan-Downloader.Delf.1
C:\Documents and Settings\uhthn\Desktop\0\ntldr.com - OK
C:\Documents and Settings\uhthn\Desktop\0\logo.exe - OK
C:\Documents and Settings\uhthn\Desktop\0\no.exe - OK
C:\Documents and Settings\uhthn\Desktop\0\3A164BDB8EB1.dll - OK

5 Files scanned
0 Infected files found
1 Suspected files found
0 Files cured
0 Files deleted

[病毒样本] 5个更新[MD5: 797381 28C795 2C2B79 430672 53752F]

本帖子中包含更多资源

6个

17/4