伪装成soundman的病毒

promised

timhas266

Start of the scan: Sunday, 14 October, 2007  13:23

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\WINDOWS.rar'
C:\Documents and Settings\tim\桌面\WINDOWS.rar
  [0] Archive type: RAR
  --> WINDOWS\system32\alcwzrd.exe
      [DETECTION] Is the Trojan horse TR/Drop.Dasher.C.1
  --> WINDOWS\system32\ineters.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> WINDOWS\system32\SoundMan.exe
      [DETECTION] Contains detection pattern of the worm WORM/Mabop.A.1
  --> gx.exe
      [DETECTION] Is the Trojan horse TR/Drop.Dasher.C.1
      [INFO]      A backup was created as '475fa82a.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: Sunday, 14 October, 2007  13:23
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
      8 Files were scanned
      3 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      5 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

The EQs

C:\Documents and Settings\Don johnson\桌面\WINDOWS.rar » RAR » WINDOWS\system32\alcwzrd.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Don johnson\桌面\WINDOWS.rar » RAR » WINDOWS\system32\ineters.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Don johnson\桌面\WINDOWS.rar » RAR » WINDOWS\system32\SoundMan.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Don johnson\桌面\WINDOWS.rar » RAR » gx.exe - probably unknown NewHeur_PE virus

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\GX.EXE
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\GX.EXE
是否删除病毒程序及其衍生物?

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 533
Paranoia Database - 10451
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\gx.exe - Suspected Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\WINDOWS\1.inf - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\WINDOWS\setupapi.log - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\WINDOWS\system32\alcwzrd.exe - Suspected MalwareDetector:Win32.Generic.PSW.16
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\WINDOWS\system32\ineters.exe - Suspected MalwareDetector:Generic.PSW.16
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\WINDOWS\system32\SoundMan.exe - Suspected MalwareDetector:Generic.PSW.16
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\WINDOWS\system32\tthh3.ini - OK

7 Files scanned
0 Infected files found
4 Suspected files found
0 Files cured
0 Files deleted

woai_jolin

Scanning Log
Version of virus signature database: 2590 (20071012)
Date: 14.10.2007  Time: 13:34:50
Scanned disks, folders and files: G:\V\WINDOWS.rar
G:\V\WINDOWS.rar » RAR » WINDOWS\1.inf - is OK
G:\V\WINDOWS.rar » RAR » WINDOWS\setupapi.log - is OK
G:\V\WINDOWS.rar » RAR » WINDOWS\system32\alcwzrd.exe - probably unknown NewHeur_PE virus [7]
G:\V\WINDOWS.rar » RAR » WINDOWS\system32\ineters.exe - probably unknown NewHeur_PE virus [7]
G:\V\WINDOWS.rar » RAR » WINDOWS\system32\SoundMan.exe - probably unknown NewHeur_PE virus [7]
G:\V\WINDOWS.rar » RAR » WINDOWS\system32\tthh3.ini - is OK
G:\V\WINDOWS.rar » RAR » gx.exe - probably unknown NewHeur_PE virus [7]

Nerazzurri

deleted: virus Virus.Win32.AutoRun.ny        File: C:\Documents and Settings\acer\Desktop\WINDOWS.rar/WINDOWS\system32\alcwzrd.exe//PE_Patch.PECompact//PecBundle//PECompact
deleted: Trojan program Trojan-Dropper.Win32.Mudrop.eo        File: C:\Documents and Settings\acer\Desktop\WINDOWS.rar/gx.exe//PE_Patch//UPack

IllusionWing

exe均报
UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.3.2
HC0.rlb = 2.9.1
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\gx.exe 检测到 Packed.Generic.Modified
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\样本\WINDOWS\system32\alcwzrd.exe 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\样本\WINDOWS\system32\ineters.exe 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\样本\WINDOWS\system32\SoundMan.exe 检测到 Generic.nFile
检测到了 4 个未知的恶意程序，请上报。
任务 扫描 完成。共耗费的时间：0-00-00 00:00:00:0330，共扫描的文件数量：7，共扫描到的威胁数量：4，威胁率：57.14%，扫描速率： 21.21 文件/秒，扫描速度： 2003.63 千字节/秒，共扫描了 661.2 千字节。

睡眼朦胧

检测到：病毒 Virus.Win32.AutoRun.ny        URL: http://bbs.kafan.cn/attachment.p ... ecBundle//PECompact

红心王子

2007-10-14        15:31:22        1192347082        Administrator        3276        Sign of "Win32:Pakes-EO [Trj]" has been found in "D:\Downloads\WINDOWS.rar\WINDOWS\system32\alcwzrd.exe" file.  
2007-10-14        15:31:26        1192347086        Administrator        3276        Sign of "Win32:Pakes-EO [Trj]" has been found in "D:\Downloads\WINDOWS.rar\WINDOWS\system32\ineters.exe" file.  
2007-10-14        15:31:26        1192347086        Administrator        3276        Sign of "Win32:Pakes-EO [Trj]" has been found in "D:\Downloads\WINDOWS.rar\WINDOWS\system32\SoundMan.exe" file.  
2007-10-14        15:31:26        1192347086        Administrator        3276        Sign of "Win32:Pakes-EO [Trj]" has been found in "D:\Downloads\WINDOWS.rar\gx.exe\[Upack]\[Embedded#0995c]" file.