[MD5: 61742A 327B88等]

caocao

有几个文件解压后是自动隐藏，不会弄MD5，见谅。
症状：1.启动项为c:\windows\idm.exe, 注册表run被监控，删除后又恢复该启动项。
2.定时会弹出网页，地址杀之前忘记了。
3.每个盘符下会生成io.pif,跟一个autorun.inf 启动项。
4.会杀掉360（定时检查然后杀）
5.竟然伪造一个soundman.exe在system32下，看他的版本里面的原exe名就看出马脚。
6.会破坏“显示所有文件”选项，就是选择那个复选后，再次打开，又选择“不显示隐藏文件”。
7.还有一个特征：
c:\program files\common files\services这个目录下有图片跟隐藏的svchost.exe,且在注册表run启动项里面。
具体样本见样本2。

[ 本帖最后由 caocao 于 2007-10-24 14:08 编辑 ]

j542936

还有别的特征吗？比如感染文件什么的

caocao

这个交给高手吧，我……

rasis

Begin scan in 'svchost.exe'
svchost.exe
      [DETECTION] Contains detection pattern of the worm WORM/Wogue.AB
      [WARNING]   The file was ignored!
Begin scan in '124327MM.DLL'
124327MM.DLL
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING]   The file was ignored!
Begin scan in 'camocx.dll'
Begin scan in 'caomsnima.dll'
caomsnima.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fho
      [WARNING]   The file was ignored!
Begin scan in 'IGM.exe'
IGM.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING]   The file was ignored!
Begin scan in 'IO.pif'
IO.pif
      [DETECTION] Contains detection pattern of the worm WORM/Wogue.AB
      [WARNING]   The file was ignored!
Begin scan in 'SoundMan.exe'
SoundMan.exe
      [DETECTION] Is the Trojan horse TR/Dldr.VB.bnm.1
      [WARNING]   The file was ignored!


End of the scan: 2007年10月24日  14:20
Used time: 00:02 min

The scan has been done completely.

      0 Scanning directories
      7 Files were scanned
      6 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      0 Archives were scanned
      6 Warnings
      0 Notes

啊弥陀佛

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\124327MM.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

The EQs

C:\Documents and Settings\Don johnson\桌面\样本2.rar » RAR » svchost.exe - Win32/Delf.NDL worm
C:\Documents and Settings\Don johnson\桌面\样本.rar » RAR » caomsnima.dll - Win32/PSW.OnLineGames.FHO trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar » RAR » IO.pif - Win32/Delf.NDL worm
C:\Documents and Settings\Don johnson\桌面\样本.rar » RAR » IGM.exe - Win32/PSW.Legendmir.NFF trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar » RAR » 124327MM.DLL - Win32/PSW.Legendmir.NFF trojan
C:\Documents and Settings\Don johnson\桌面\样本.rar » RAR » SoundMan.exe - probably unknown NewHeur_PE virus

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.fho        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/caomsnima.dll//UPack
detected: virus Worm.Win32.Wogue.ab        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/IO.pif//PE_Patch.PECompact//PecBundle//PECompact//PE_Patch.MaskPE
detected: Trojan program Trojan-PSW.Win32.Lmir.bnx        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/IGM.exe//ASPack
detected: Trojan program Trojan-PSW.Win32.Lmir.bnv        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/124327MM.DLL
detected: Trojan program Trojan-Downloader.Win32.VB.bnm        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/SoundMan.exe//PE_Patch.PECompact//PecBundle//PECompact
detected: virus Worm.Win32.Wogue.ab        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾2.rar/svchost.exe//PE_Patch.PECompact//PecBundle//PECompact//PE_Patch.MaskPE

yclidong

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.WoWar.acf
病毒： Worm.Win32.Wogue.ab      
病毒： Trojan.PSW.Win32.GameOnline.ep
病毒： Trojan.PSW.Win32.GameOnline.ep
病毒： Trojan.Win32.VB.yoa      
软件版本：20.15.22

平淡

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 666
Paranoia Database - 48130
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder (2)

C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\camocx.dll - Suspected TROJAN-DOWNLOADER.SMALL.2
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\caomsnima.dll - Suspected MaliciousScope:GENERIC.PSW.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\IO.pif - Suspected MaliciousScope:WIN32.GENERIC.PSW.16
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\IGM.exe - Infected WIN32.TROJAN-PSW.LMIR.A - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\124327MM.DLL - Infected WIN32.GENERIC.MALWARE.6 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\SoundMan.exe - Infected TROJAN-DOWNLOADER.ADLOAD.1 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\whowhere.bmp - OK
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\bigfoot.bmp - OK
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\svchost.exe - Suspected MaliciousScope:WIN32.GENERIC.PSW.16
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\verisign.bmp - OK

10 Files scanned
3 Infected files found
4 Suspected files found
0 Files cured
3 Files deleted