实机病毒（东西比较多，就不发MD5了）

显示全部楼层 · 发表于 2007-10-12 18:19:15

在学校老师的电脑里抓到的，生成了一堆东西
表面现象为自启动、隐藏文件夹选项、不显示隐藏文件、生成与文件夹同名exe文件、具有感染性...大家小心
学校没有Internet网络，联没联网就不知道了....

PS：我可怜的U盘，全感染了...

显示全部楼层 · 发表于 2007-10-12 18:21:23

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\样44444444444444本\样本\AUTORUN.INF]
                  …………发现Spy！报告: [4]
文件信息:  大小:88  MD5:b3a76f2b7b68f329344e755966771ea0

[C:\Documents and Settings\Administrator\桌面\Virus\样44444444444444本\样本\csrss.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:81920  MD5:e6992fd5d92dd01d51dcbe186f0cc6c7

[C:\Documents and Settings\Administrator\桌面\Virus\样44444444444444本\样本\Data ADMINISTRATOR.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:81920  MD5:e6992fd5d92dd01d51dcbe186f0cc6c7

[C:\Documents and Settings\Administrator\桌面\Virus\样44444444444444本\样本\Ghost Explorer.exe]
                  …………发现Spy！报告:[1]
文件信息:  大小:2217616  MD5:22b9d7ee4690051a2cdc4f98e8651a8d

[C:\Documents and Settings\Administrator\桌面\Virus\样44444444444444本\样本\inetinfo.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:81920  MD5:e6992fd5d92dd01d51dcbe186f0cc6c7

[C:\Documents and Settings\Administrator\桌面\Virus\样44444444444444本\样本\lsass.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:81920  MD5:e6992fd5d92dd01d51dcbe186f0cc6c7

[C:\Documents and Settings\Administrator\桌面\Virus\样44444444444444本\样本\services.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:81920  MD5:e6992fd5d92dd01d51dcbe186f0cc6c7

[C:\Documents and Settings\Administrator\桌面\Virus\样44444444444444本\样本\smss.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:81920  MD5:e6992fd5d92dd01d51dcbe186f0cc6c7

[C:\Documents and Settings\Administrator\桌面\Virus\样44444444444444本\样本\winlogon.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:81920  MD5:e6992fd5d92dd01d51dcbe186f0cc6c7

[C:\Documents and Settings\Administrator\桌面\Virus\样44444444444444本\样本\Empty.pif]
                  …………发现Spy！报告:[2]
文件信息:  大小:81920  MD5:e6992fd5d92dd01d51dcbe186f0cc6c7

[C:\Documents and Settings\Administrator\桌面\Virus\样44444444444444本\样本\pagefile.pif]
                  …………发现Spy！报告: [4] [1]
文件信息:  大小:40960  MD5:6617b943f479fe3e748009948779a04b

[C:\Documents and Settings\Administrator\桌面\Virus\样44444444444444本\样本\Administrator's Setting.scr]
                  …………发现Spy！报告:[2]
文件信息:  大小:81920  MD5:e6992fd5d92dd01d51dcbe186f0cc6c7

文件数:12 病毒数:12  比重:1
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2007-10-12 18:22 编辑 ]

显示全部楼层 · 发表于 2007-10-12 18:23:57

C:\ABC\样本.rar:\样本\AUTORUN.INF - 特征码 'Win32.Small.B' 被发现
C:\ABC\样本.rar:\样本\csrss.exe - 特征码 'Email-Worm.Win32.Brontok.N' 被发现
C:\ABC\样本.rar:\样本\Data ADMINISTRATOR.exe - 特征码 'Email-Worm.Win32.Brontok.N' 被发现
C:\ABC\样本.rar:\样本\Ghost Explorer.exe - 特征码 'Trojan.Win32.Pakes.c' 被发现
C:\ABC\样本.rar:\样本\inetinfo.exe - 特征码 'Email-Worm.Win32.Brontok.N' 被发现
C:\ABC\样本.rar:\样本\lsass.exe - 特征码 'Email-Worm.Win32.Brontok.N' 被发现
C:\ABC\样本.rar:\样本\services.exe - 特征码 'Email-Worm.Win32.Brontok.N' 被发现
C:\ABC\样本.rar:\样本\smss.exe - 特征码 'Email-Worm.Win32.Brontok.N' 被发现
C:\ABC\样本.rar:\样本\winlogon.exe - 特征码 'Email-Worm.Win32.Brontok.N' 被发现
C:\ABC\样本.rar:\样本\Empty.pif - 特征码 'Email-Worm.Win32.Brontok.N' 被发现
C:\ABC\样本.rar:\样本\pagefile.pif - 特征码 'Trojan.Win32.Pakes.c' 被发现
C:\ABC\样本.rar:\样本\Administrator's Setting.scr - 特征码 'Email-Worm.Win32.Brontok.N' 被发现
C:\ABC\样本.rar

显示全部楼层 · 发表于 2007-10-12 18:24:22

怎么连Autorun.inf都报？

[ 本帖最后由 xffsfy 于 2007-10-12 18:26 编辑 ]

显示全部楼层 · 发表于 2007-10-12 18:24:27

相当老的了，基本上都是全灭

显示全部楼层 · 发表于 2007-10-12 18:29:38

微点报已知

显示全部楼层 · 发表于 2007-10-12 18:30:26

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\样本.rar
  [0] Archive type: RAR
  --> Ñù±¾\csrss.exe
   [DETECTION] Contains detection pattern of the worm WORM/Rontok.C
  --> Ñù±¾\Data ADMINISTRATOR.exe
   [DETECTION] Contains detection pattern of the worm WORM/Rontok.C
  --> Ñù±¾\Ghost Explorer.exe
   [DETECTION] Is the Trojan horse TR/VB.avf
  --> Ñù±¾\inetinfo.exe
   [DETECTION] Contains detection pattern of the worm WORM/Rontok.C
  --> Ñù±¾\lsass.exe
   [DETECTION] Contains detection pattern of the worm WORM/Rontok.C
  --> Ñù±¾\services.exe
   [DETECTION] Contains detection pattern of the worm WORM/Rontok.C
  --> Ñù±¾\smss.exe
   [DETECTION] Contains detection pattern of the worm WORM/Rontok.C
  --> Ñù±¾\winlogon.exe
   [DETECTION] Contains detection pattern of the worm WORM/Rontok.C
  --> Ñù±¾\Empty.pif
   [DETECTION] Contains detection pattern of the worm WORM/Rontok.C
  --> Ñù±¾\pagefile.pif
   [DETECTION] Is the Trojan horse TR/VB.avf
  --> Ñù±¾\Administrator's Setting.scr
   [DETECTION] Contains detection pattern of the worm WORM/Rontok.C
   [WARNING] The file was ignored!

End of the scan: 星期五 2007年10月12日  18:30
Used time: 00:20 min

The scan has been done completely.

   0 Scanning directories
   13 Files were scanned
   11 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-10-12 18:36:22

这东西在我这看一堆乱码，不太好分析
最恶心的是一直打开我的文档

显示全部楼层 · 发表于 2007-10-12 18:59:07

C:\Documents and Settings\Martin\Local Settings\Application Data\Mozilla\Firefox\Profiles\r5vy9ey1.default\Cache\E87815E6d01 » RAR » 样本\AUTORUN.INF INF/Autorun virus
C:\Documents and Settings\Martin\Local Settings\Application Data\Mozilla\Firefox\Profiles\r5vy9ey1.default\Cache\E87815E6d01 » RAR » 样本\csrss.exe Win32/Brontok.D worm
C:\Documents and Settings\Martin\Local Settings\Application Data\Mozilla\Firefox\Profiles\r5vy9ey1.default\Cache\E87815E6d01 » RAR » 样本\Data ADMINISTRATOR.exe Win32/Brontok.D worm
C:\Documents and Settings\Martin\Local Settings\Application Data\Mozilla\Firefox\Profiles\r5vy9ey1.default\Cache\E87815E6d01 » RAR » 样本\Ghost Explorer.exe a variant of Win32/Small.NAV worm
C:\Documents and Settings\Martin\Local Settings\Application Data\Mozilla\Firefox\Profiles\r5vy9ey1.default\Cache\E87815E6d01 » RAR » 样本\inetinfo.exe Win32/Brontok.D worm
C:\Documents and Settings\Martin\Local Settings\Application Data\Mozilla\Firefox\Profiles\r5vy9ey1.default\Cache\E87815E6d01 » RAR » 样本\lsass.exe Win32/Brontok.D worm
C:\Documents and Settings\Martin\Local Settings\Application Data\Mozilla\Firefox\Profiles\r5vy9ey1.default\Cache\E87815E6d01 » RAR » 样本\services.exe Win32/Brontok.D worm
C:\Documents and Settings\Martin\Local Settings\Application Data\Mozilla\Firefox\Profiles\r5vy9ey1.default\Cache\E87815E6d01 » RAR » 样本\smss.exe Win32/Brontok.D worm
C:\Documents and Settings\Martin\Local Settings\Application Data\Mozilla\Firefox\Profiles\r5vy9ey1.default\Cache\E87815E6d01 » RAR » 样本\winlogon.exe Win32/Brontok.D worm
C:\Documents and Settings\Martin\Local Settings\Application Data\Mozilla\Firefox\Profiles\r5vy9ey1.default\Cache\E87815E6d01 » RAR » 样本\Empty.pif Win32/Brontok.D worm
C:\Documents and Settings\Martin\Local Settings\Application Data\Mozilla\Firefox\Profiles\r5vy9ey1.default\Cache\E87815E6d01 » RAR » 样本\pagefile.pif a variant of Win32/Small.NAV worm
C:\Documents and Settings\Martin\Local Settings\Application Data\Mozilla\Firefox\Profiles\r5vy9ey1.default\Cache\E87815E6d01 » RAR » 样本\Administrator's Setting.scr Win32/Brontok.D worm

显示全部楼层 · 发表于 2007-10-12 19:03:45

Result: 11 malware found
Email-Worm.Win32.Brontok.a (virus)
C:\Users\Administrator\Desktop\Ñù±¾.rar\Ñù±¾\csrss.exe
C:\Users\Administrator\Desktop\Ñù±¾.rar\Ñù±¾\Data ADMINISTRATOR.exe
C:\Users\Administrator\Desktop\Ñù±¾.rar\Ñù±¾\inetinfo.exe
C:\Users\Administrator\Desktop\Ñù±¾.rar\Ñù±¾\lsass.exe
C:\Users\Administrator\Desktop\Ñù±¾.rar\Ñù±¾\services.exe
C:\Users\Administrator\Desktop\Ñù±¾.rar\Ñù±¾\smss.exe
C:\Users\Administrator\Desktop\Ñù±¾.rar\Ñù±¾\winlogon.exe
C:\Users\Administrator\Desktop\Ñù±¾.rar\Ñù±¾\Empty.pif
C:\Users\Administrator\Desktop\Ñù±¾.rar\Ñù±¾\Administrator's Setting.scr
Virus.Win32.Small.p (virus)
C:\Users\Administrator\Desktop\Ñù±¾.rar\Ñù±¾\Ghost Explorer.exe
C:\Users\Administrator\Desktop\Ñù±¾.rar\Ñù±¾\pagefile.pif

[病毒样本] 实机病毒（东西比较多，就不发MD5了）

本帖子中包含更多资源

全灭

EAV

本帖子中包含更多资源