释放器？下载者？

qianwenxiang

avast报agent-jrh



不小心实机执行了一下
放出来：
c:\program files\ocdins\* -cnnic
c:\program files\common files\cpush\* -cpush
c:\program files\realtek\soundman.exe -它自己
c:\windows\temp\n个exe -有1个agent＋N-1个广告
c:\windows\system32\下面几个DLL跟sys
c:\windows\system32\drivers\下面几个sys

my_*****.exe那个程序请求联网

promised

C:\ABC\14564_setup\14564_setup.exe - 特征码 'Trojan-Dropper.Win32.Delf.HL' 被发现

promised

C:\ABC\14564_setup\14564_setup.exe
>>> File "C:\ABC\14564_setup\14564_setup.exe" has been identified as suspicious 'Sus/Dropper-R'.

qigang

RX20.20.62未杀。

sam.to

kis7不报，已上报

sam.to

Hello,

14564_setup.exe_ - Trojan-Dropper.Win32.Agent.cwc

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Namestnikov Yury
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

scottxzt

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\14564_SETUP.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\CONIME.EXE
2) C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\AD1386.EXE
3) C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\SEVENELEVEN_1.EXE
4) C:\PROGRAM FILES\BAIDU\BAR\BDBAR_TMP\BAIDUBAR.DLL
5) C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\SETUP169.EXE
6) C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\3C\CNDSV.DLL
7) C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\3C\CNPROV.SYS
8) C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\3C\CNPROVH.DLL
9) C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\3C\CONFIG.EXE
10) C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\3C\CONVS.DLL

gogo8989

FS扫描没报,主动自动防御挡住7次,沙盘查杀一个



哈哈  俺一个组策略一下就把它弄死了，
不允许在临时文件夹下运行

[ 本帖最后由 gogo8989 于 2007-12-3 02:11 编辑 ]

mofunzone

antivir解包失败