过卡巴u盘病毒

凌空十字剑

F:\u盘病毒.rar ? RAR ? RECYCLER\auto.exe - 可能是 Win32/TrojanDownloader.Flux 特洛伊木马 的变种
F:\u盘病毒.rar ? RAR ? SERVICS.EXE - 可能是 Win32/Genetik 特洛伊木马 的变种

timhas266

Start of the scan: Wednesday, 14 November, 2007  21:25

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\樣本'
C:\Documents and Settings\tim\桌面\樣本\u攫瓷馮.rar
  [0] Archive type: RAR
  --> RECYCLER\auto.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> SERVICS.EXE
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      A backup was created as 'bc325c8f.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: Wednesday, 14 November, 2007  21:25
Used time: 00:02 min

The scan has been done completely.

      1 Scanning directories
      7 Files were scanned
      1 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      6 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

16300

上传扫了下～～
AhnLab-V3 2007.11.14.1 2007.11.14 -
AntiVir 7.6.0.34 2007.11.14 TR/Crypt.NSPM.Gen
Authentium 4.93.8 2007.11.14 -
Avast 4.7.1074.0 2007.11.13 Win32:Agent-EXD
AVG 7.5.0.503 2007.11.14 Generic9.IAL
BitDefender 7.2 2007.11.14 DeepScan:Generic.Malware.FBdldspg.24860DDC
CAT-QuickHeal 9.00 2007.11.14 -
ClamAV 0.91.2 2007.11.14 -
DrWeb 4.44.0.09170 2007.11.14 Trojan.Popwin.origin
eSafe 7.0.15.0 2007.11.13 suspicious Trojan/Worm
eTrust-Vet 31.2.5294 2007.11.14 -
Ewido 4.0 2007.11.14 -
FileAdvisor 1 2007.11.14 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.4.2.54 2007.11.14 W32/Injector.A.gen!Eldorado
F-Secure 6.70.13030.0 2007.11.14 W32/Downloader.GWP
Ikarus T3.1.1.12 2007.11.14 Trojan-PWS.Win32.Agent.BU
Kaspersky 7.0.0.125 2007.11.14 -
McAfee 5162 2007.11.13 New Malware.bc
Microsoft 1.3007 2007.11.12 VirTool:Win32/Obfuscator.A
NOD32v2 2657 2007.11.14 probably a variant of Win32/TrojanDownloader.Flux
Norman 5.80.02 2007.11.14 -
Panda 9.0.0.4 2007.11.14 Suspicious file
Prevx1 V2 2007.11.14 Heuristic: Suspicious File With Persistence
Rising 20.18.20.00 2007.11.14 -
Sophos 4.23.0 2007.11.14 Mal/Behav-095
Sunbelt 2.2.907.0 2007.11.14 VIPRE.Suspicious
Symantec 10 2007.11.14 -
TheHacker 6.2.9.127 2007.11.14 -
VBA32 3.12.2.4 2007.11.11 suspected of Embedded.Trojan.Click.2085
VirusBuster 4.3.26:9 2007.11.13 Packed/NSPack
Webwasher-Gateway 6.0.1 2007.11.14 Trojan.Crypt.NSPM.Gen

harrystopet

KV报代理木马

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 866
Paranoia Database - 48728
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\1

C:\Documents and Settings\Uhthn\Desktop\1\autorun.inf - Suspected TROJAN.AUTORUN.1
C:\Documents and Settings\Uhthn\Desktop\1\desktop.ini - OK
C:\Documents and Settings\Uhthn\Desktop\1\SERVICS.EXE - Infected WIN32.VIRUS.AUTORUN.7 - Deleted
C:\Documents and Settings\Uhthn\Desktop\1\RECYCLER\auto.exe - Infected MaliciousScope:TROJAN-DOWNLOADER.AGENT.3 - Deleted
C:\Documents and Settings\Uhthn\Desktop\1\RECYCLER\desktop.ini - OK

5 Files scanned
2 Infected files found
1 Suspected files found
0 Files disinfected
2 Files deleted

k600c

本体不能突破沙盘，但可以改时间……

scottxzt

木马名称:Trojan-Downloader.Win32.Flux.ac

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\RECYCLER\AUTO.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\SERVICS.EXE
是否阻止该进程继续运行?

capsshift

红伞微点都报了已知。为什么给瑞星上报的那么慢，难道是变种？

googlehack

是木马

sam.to

Hello,

auto.exe_ - Trojan-Downloader.Win32.Agent.fck,
SERVICS.exe_ - Virus.Win32.AutoRun.adg

These files are already detected. Please update your antivirus bases.

desktop.ini

No malicious code was found in this file.

Please quote all when answering.

--
Best regards, Alexander Romanenko
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.


奇怪，又是谁把样本传给卡巴？我传给卡巴前是杀不到的