[病毒样本] 9+2

显示全部楼层 · 发表于 2007-11-8 09:05:26

Malware: Application.Adware.Savenow.G
C:\Documents and Settings\028222\桌面\1107small.rar=>SecureInstall_LOFS020701Inst.exe

Malware: BehavesLike:Trojan.ShellHook
C:\Documents and Settings\028222\桌面\1107small.rar=>down.exe

Malware: DeepScan:Generic.Malware.Sdld!!g.CF15B810
C:\Documents and Settings\028222\桌面\1107small.rar=>Winhelp.dll

Malware: GenPack:Trojan.Downloader.ACP
C:\Documents and Settings\028222\桌面\1107small.rar=>downloader.exe

Malware: Generic.Virtob.1.6C017ED8
C:\Documents and Settings\028222\桌面\1107small.rar=>dl.exe

Malware: MemScan:Trojan.Startpage.ANV
C:\Documents and Settings\028222\桌面\1107small.rar=>ms.exe

Malware: Trojan.Dropper.Microjoin.WE
C:\Documents and Settings\028222\桌面\1107small.rar=>200701250235.exe

Malware: Trojan.Elitebar.H
C:\Documents and Settings\028222\桌面\1107small.rar=>setup_file.exe

显示全部楼层 · 发表于 2007-11-8 10:07:36

广告软件名称:AdWare.Win32.Cinmus.bka
程序:
C:\PROGRAM FILES\COMMON FILES\CPUSH\UNINST.EXE
是广告软件!
已成功阻止其运行,是否要删除此文件?

广告软件名称:AdWare.Win32.BHO.nv
程序:
C:\PROGRAM FILES\COMMON FILES\CPUSH\CPUSH.DLL
是广告软件!
已成功阻止其运行,是否要删除此文件?

广告软件名称:AdWare.Win32.BHO.nv
程序:
C:\PROGRAM FILES\COMMON FILES\CPUSH\CPUSH.TMP
是广告软件!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.QQHelper.fwi
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MY_70011.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-11-8 13:04:59

真不明白，病毒的尺寸竟这么大！

显示全部楼层 · 发表于 2007-11-8 16:51:51

[0] Archive type: RAR
  --> 200701250235.exe
   [DETECTION] Contains detection pattern of the dropper DR/MicroJoiner.Gen
  --> dl.exe
   [DETECTION] Contains detection pattern of the worm WORM/Mefir.R
  --> downloader.exe
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> Winhelp.dll
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> down.exe
   [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ms.exe
   [DETECTION] Is the Trojan horse TR/StartPage.anv.5
  --> SecureInstall_LOFS020701Inst.exe
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Whenu.A.9
  --> setup_file.exe
   [DETECTION] Is the Trojan horse TR/EliteBar.H.1
  --> setup.exe
   [DETECTION] Is the Trojan horse TR/Fake.WebSpyShi.A

显示全部楼层 · 发表于 2007-11-8 23:43:53

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 812
Paranoia Database - 48490
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder

C:\Documents and Settings\Uhthn\Desktop\New Folder\200701250235.exe - Infected TROJAN-DROPPER.MICROJOIN.1 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\dl.exe - Infected WORM.MEFIR.1 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\downloader.exe - Suspected MaliciousScope:GENERIC.MALWARE.17
C:\Documents and Settings\Uhthn\Desktop\New Folder\Winhelp.dll - Infected MaliciousScope:TROJAN-DOWNLOADER.AGENT.3 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\down.exe - Infected WIN32.TROJAN-PSW.DELF.B - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\ms.exe - OK
C:\Documents and Settings\Uhthn\Desktop\New Folder\SecureInstall_LOFS020701Inst.exe - Infected TROJAN.VB.A - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\setup_file.exe - Suspected TROJAN-DOWNLOADER.AGENT.1
C:\Documents and Settings\Uhthn\Desktop\New Folder\setup.exe - Suspected TROJAN.DIALER.1
C:\Documents and Settings\Uhthn\Desktop\New Folder\14564_setup.exe - Suspected MaliciousScope:WIN32.GENERIC.MALWARE.12
C:\Documents and Settings\Uhthn\Desktop\New Folder\down_sotp.exe - Suspected MaliciousScope:WIN32.GENERIC.MALWARE.12

11 Files scanned
5 Infected files found
5 Suspected files found
0 Files disinfected
5 Files deleted