5个

显示全部楼层 · 发表于 2007-12-9 21:50:20

。。报1个

[扫描] [变形壳检测] 在 F:\Users\Administrator\Desktop\新建文件夹\071209\071209.exe 检测到 Packed.Generic.Modified

显示全部楼层 · 发表于 2007-12-9 22:10:22

全灭

显示全部楼层 · 发表于 2007-12-9 22:12:22

已刪除: 特洛伊木馬程式 Trojan-Spy.Win32.Agent.asn 檔案: C:\Documents and Settings\kato9096\桌面\168792.rar/mcdsrv16_071205.dll
已刪除: 特洛伊木馬程式 Trojan-Spy.Win32.Agent.asj 檔案: C:\Documents and Settings\kato9096\桌面\168792.rar/mcdsrv16_071209.dll
已刪除: 特洛伊木馬程式 Trojan-Spy.Win32.Agent.asm 檔案: C:\Documents and Settings\kato9096\桌面\168792.rar/mcdsrv32_071205.dll
已刪除: 特洛伊木馬程式 Trojan-Spy.Win32.Agent.ask 檔案: C:\Documents and Settings\kato9096\桌面\168792.rar/mcdsrv32_071209.dll

kis7,一个不报，已上报

显示全部楼层 · 发表于 2007-12-9 22:18:33

Hello.
New malicious software was found in the attached file. Worm.Win32.AutoRun.ch
It's detection will be included in the next update. Thank you for your help.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Maslennikov Denis
Virus Analyst, Kaspersky Lab.

Ph.: +7(495) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

显示全部楼层 · 发表于 2007-12-9 22:18:51

Virus: Win32:Agent-ICL [Trj] (3x), Win32:Delf-GEI [Trj] (2x)

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2007-12-9 23:29:51

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 1056
Paranoia Database - 49948
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder (2)

C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\071209.exe - Suspected MaliciousScope:GENERIC.MALWARE.4
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\mcdsrv16_071205.dll - Infected WIN32.TROJAN-DOWNLOADER.DELF.10 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\mcdsrv16_071209.dll - Infected WIN32.TROJAN-DOWNLOADER.DELF.10 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\mcdsrv32_071205.dll - Infected WIN32.TROJAN-DOWNLOADER.HMIR.1 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\mcdsrv32_071209.dll - Infected WIN32.TROJAN-DOWNLOADER.HMIR.1 - Deleted

5 Files scanned
4 Infected files found
1 Suspected files found
0 Files disinfected
4 Files deleted

显示全部楼层 · 发表于 2007-12-10 18:58:43

原帖由 Graybird 于 2007-12-9 18:08 发表
Starting the file scan:

Begin scan in 'E:\071209.rar'
E:\071209.rar
  [0] Archive type: RAR
  --> 071209.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> mcdsrv32_071205.dll
...

Filename	Result
071209.exe	MALWARE

The file '071209.exe' has been determined to be 'MALWARE'.
Our analysts named the threat Worm/Autorun.CH. The term "WORM/" denotes a worm that is able to spread itself for instance over the Internet (using eMail, peer-to-peer networks, IRC networks etc.).Detection is added to our virus definition file (VDF) starting with version 7.00.01.61. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

Filename	Result
mcdsrv16_071205.dll	MALWARE

The file 'mcdsrv16_071205.dll' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Spy.Agent.asn. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.01.61.

Filename	Result
mcdsrv16_071209.dll	MALWARE

The file 'mcdsrv16_071209.dll' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Spy.Agent.asj. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.01.61.

Filename	Result
mcdsrv32_071205.dll	MALWARE

The file 'mcdsrv32_071205.dll' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Spy.Agent.Asm.1. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.01.61. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

Filename	Result
mcdsrv32_071209.dll	MALWARE

The file 'mcdsrv32_071209.dll' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Spy.Agent.ask. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.01.61. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

显示全部楼层 · 发表于 2007-12-10 19:00:11

Starting the file scan:

Begin scan in 'E:\071209.rar'
E:\071209.rar
  [0] Archive type: RAR
  --> 071209.exe
   [DETECTION] Contains detection pattern of the worm WORM/Autorun.CH
  --> mcdsrv16_071205.dll
   [DETECTION] Is the Trojan horse TR/Spy.Agent.asn
  --> mcdsrv16_071209.dll
   [DETECTION] Is the Trojan horse TR/Spy.Agent.asj
  --> mcdsrv32_071205.dll
   [DETECTION] Is the Trojan horse TR/Spy.Agent.Asm.1
  --> mcdsrv32_071209.dll
   [DETECTION] Is the Trojan horse TR/Spy.Agent.ask
   [INFO]    The file was deleted!

End of the scan: 2007年12月10日  19:00
Used time: 00:21 min

The scan has been done completely.

   0 Scanning directories
   6 Files were scanned
   5 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

[病毒样本] 5个

本帖子中包含更多资源

回复 13楼 kato9096 的帖子

回复 17楼 Graybird 的帖子