vb写的autorun[MD5: 98A0CC 991013 CCDBAB 3F647C]

显示全部楼层 · 发表于 2007-12-7 21:07:12

Starting the file scan:

Begin scan in 'E:\样本.rar'
E:\样本.rar
  [0] Archive type: RAR
  --> 1sasrv.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> SVCH0ST.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> Ilass.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-12-7 21:11:43

C:\ABC\样本.rar:\1sasrv.dll - 特征码 'Trojan-PWS.Win32.Nilage.lp' 被发现
C:\ABC\样本.rar:\twain.dll - 特征码 'Trojan-Spy.Win32.Delf.uc' 被发现
C:\ABC\样本.rar:\SVCH0ST.exe - 特征码 'Trojan-PWS.Win32.Agent.BU' 被发现
C:\ABC\样本.rar:\Ilass.exe - 特征码 'Trojan-PWS.Win32.Agent.BU' 被发现

显示全部楼层 · 发表于 2007-12-7 21:12:21

已刪除: 病毒 Virus.Win32.AutoRun.yl 檔案: C:\Documents and Settings\kato9096\桌面\167842\1sasrv.dll//NSPack
已刪除: 病毒 Virus.Win32.AutoRun.air 檔案: C:\Documents and Settings\kato9096\桌面\167842\Ilass.exe//PE_Patch//NSPack
已刪除: 病毒 Virus.Win32.AutoRun.air 檔案: C:\Documents and Settings\kato9096\桌面\167842\SVCH0ST.exe//PE_Patch//NSPack
已刪除: 病毒 Virus.Win32.AutoRun.yl 檔案: C:\Documents and Settings\kato9096\桌面\167842\twain.dll//ASPack

kis7

显示全部楼层 · 发表于 2007-12-7 21:12:53

C:\ABC\样本.rar
C:\ABC\样本.rar\1sasrv.dll
>>> Virus 'Mal/Packer' found in file C:\ABC\样本.rar\1sasrv.dll
C:\ABC\样本.rar\twain.dll
>>> Virus 'Mal/Delf-G' found in file C:\ABC\样本.rar\twain.dll
C:\ABC\样本.rar\SVCH0ST.exe
>>> Virus 'Mal/Packer' found in file C:\ABC\样本.rar\SVCH0ST.exe
C:\ABC\样本.rar\Ilass.exe
>>> Virus 'Mal/Behav-160' found in file C:\ABC\样本.rar\Ilass.exe

显示全部楼层 · 发表于 2007-12-7 21:14:18

卡巴报了

显示全部楼层 · 发表于 2007-12-7 22:56:01

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\TWAIN.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

Ilass.exe程序出错

显示全部楼层 · 发表于 2007-12-8 06:33:23

The file '1sasrv.dll' has been determined to be 'MALWARE'. Our analysts named the threat TR/Autorun.yl. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

The file 'twain.dll' has been determined to be 'MALWARE'. Our analysts named the threat TR/Autorun.yla. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

显示全部楼层 · 发表于 2007-12-8 06:50:24

C:\Users\Wesley\Desktop\样本.rar » RAR » 1sasrv.dll - Win32/AutoRun.DY worm
C:\Users\Wesley\Desktop\样本.rar » RAR » twain.dll - Win32/Spy.Delf.NEH trojan
C:\Users\Wesley\Desktop\样本.rar » RAR » SVCH0ST.exe - Win32/AutoRun.DY worm
C:\Users\Wesley\Desktop\样本.rar » RAR » Ilass.exe - Win32/AutoRun.DY worm

显示全部楼层 · 发表于 2007-12-8 07:20:26

G:\Users\Administrator\Desktop\样本.rar » RAR » 1sasrv.dll - Win32/AutoRun.DY worm
G:\Users\Administrator\Desktop\样本.rar » RAR » twain.dll - Win32/Spy.Delf.NEH trojan
G:\Users\Administrator\Desktop\样本.rar » RAR » SVCH0ST.exe - Win32/AutoRun.DY worm
G:\Users\Administrator\Desktop\样本.rar » RAR » Ilass.exe - Win32/AutoRun.DY worm

[病毒样本] vb写的autorun[MD5: 98A0CC 991013 CCDBAB 3F647C]

本帖子中包含更多资源

本帖子中包含更多资源

回复 2楼 Graybird 的帖子

ESET Smart Security