那个毒网 金山2008报的样本

kp2006

金山2008网页防马


2007-10-21 06:32:24 浏览器后台下载了一个文件D:\Documents and Settings\Administrator.BAY41Y578QW2WH4\Local Settings\Temporary Internet Files\Content.IE5\S7MRK9MF\window[1].exe。
2007-10-21 06:34:45 浏览器后台下载了一个文件D:\Documents and Settings\Administrator.BAY41Y578QW2WH4\Local Settings\Temporary Internet Files\Content.IE5\S7MRK9MF\window[1].exe。
2007-10-21 06:34:58 浏览器后台下载了一个文件D:\Documents and Settings\Administrator.BAY41Y578QW2WH4\Local Settings\Temporary Internet Files\Content.IE5\S7MRK9MF\window[1].exe。
2007-10-21 06:35:16 浏览器试图运行一个没有数字签名的模块D:\WINDOWS\system32\cmd.exe，已被阻止。
2007-10-21 06:35:17 浏览器后台下载了一个文件D:\Documents and Settings\Administrator.BAY41Y578QW2WH4\Local Settings\Temporary Internet Files\Content.IE5\S7MRK9MF\window[1].exe。
2007-10-21 06:36:03 浏览器后台下载了一个文件D:\Documents and Settings\Administrator.BAY41Y578QW2WH4\Local Settings\Temporary Internet Files\Content.IE5\S7MRK9MF\window[1].exe。
2007-10-21 06:37:22 浏览器试图运行一个没有数字签名的模块D:\WINDOWS\system32\cmd.exe，已被阻止

[ 本帖最后由 kp2006 于 2007-10-21 18:53 编辑 ]

tracydk

原帖由 kp2006 于 2007-10-21 18:51 发表
金山2008网页防马


2007-10-21 06:32:24 浏览器后台下载了一个文件D:\Documents and Settings\Administrator.BAY41Y578QW2WH4\Local Settings\Temporary Internet Files\Content.IE5\S7MRK9MF\window[1].exe。
...

红心王子

2007-10-21        19:10:23        1192965023        Administrator        2072        Sign of "Win32:Delf-FVX [Trj]" has been found in "D:\Downloads\桌面.rar\014[1].exe" file.  
2007-10-21        19:10:27        1192965027        Administrator        2072        Sign of "Win32:Nilage-AI [Trj]" has been found in "D:\Downloads\桌面.rar\267.exe\[Embedded#DATAINFO]" file.  
2007-10-21        19:10:27        1192965027        Administrator        2072        Sign of "Win32:Nilage-AI [Trj]" has been found in "D:\Downloads\桌面.rar\267.exe" file.  
2007-10-21        19:10:27        1192965027        Administrator        2072        Sign of "Win32:Nilage-AI [Trj]" has been found in "D:\Downloads\桌面.rar\down2[1].exe\[Embedded#DATAINFO]" file.  
2007-10-21        19:10:27        1192965027        Administrator        2072        Sign of "Win32:Nilage-AI [Trj]" has been found in "D:\Downloads\桌面.rar\down2[1].exe" file.

tracydk

原帖由 红心王子 于 2007-10-21 19:10 发表
2007-10-21        19:10:23        1192965023        Administrator        2072        Sign of "Win32:Delf-FVX " has been found in "D:\Downloads\桌面.rar\014[1].exe" file.  
2007-10-21        19:10:27        1192965027        Administrator        2072        Sign of "Win ...

怎么那么多盗号的，晕

平淡

The EQs

C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » 014[1].exe - a variant of Win32/Delf.NDV worm
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » 267.exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » down2[1].exe - probably a variant of Win32/PSW.Delf.NHI trojan

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.Autorun.ywa
病毒： Trojan.DL.Win32.Autorun.yvz

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.14.62

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 659
Paranoia Database - 48035
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\014[1].exe - Infected WIN32.BACKDOOR.AGENT.1 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\s6[1].js - Infected VIRUS.SCRIPT.9104 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\Internet.lnk - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\s3[1].js - Infected VIRUS.SCRIPT.5661 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\267.exe - Infected WIN32.TROJAN-PSW.DELF.B - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\down2[1].exe - Infected WIN32.TROJAN-PSW.DELF.B - Deleted

6 Files scanned
5 Infected files found
0 Suspected files found
0 Files cured
5 Files deleted

残缺的唯美

deleted: virus Virus.Win32.AutoRun.wd        File: C:\Users\Administrator\Desktop\×ÀÃæ.rar/014[1].exe//PE_Patch
deleted: virus Worm.Win32.QQPass.ag        File: C:\Users\Administrator\Desktop\×ÀÃæ.rar/267.exe//UPX//PEPatch
deleted: virus Worm.Win32.QQPass.ag        File: C:\Users\Administrator\Desktop\×ÀÃæ.rar/down2[1].exe//UPX//PEPatch

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\桌面.rar'
C:\Users\morgan\Documents\
  桌面.rar
    [0] Archive type: RAR
    --> 014[1].exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> s6[1].js
    --> Internet.lnk
    --> s3[1].js
    --> 267.exe
        [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> down2[1].exe
        [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!