一只老的。。。。

The EQs

抓的里面这只算很老的了。。。

woai_jolin

正在扫描日志
病毒库版本: 2757 (20071230)
日期: 2007-12-31  时间: 11:37:40
已扫描的磁盘、文件夹和文件: G:\mh0405.zip
G:\mh0405.zip ?ZIP ?mh0405.exe - Win32/Jalous 蠕虫 的变种 - 是已删除对象的一部分
已扫描的对象数: 2
发现的威胁数: 1
完成时间: 11:37:41  总扫描时间: 1 秒 (00:00:01)

ykz1991

Begin scan in 'D:\Virus\mh0405.exe'
D:\Virus\mh0405.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [WARNING]   The file was ignored!

曲中求

Begin scan in 'E:\病毒\mh0405.zip'
E:\病毒\mh0405.zip
  [0] Archive type: ZIP
  --> mh0405.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      A backup was created as '47a864e6.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

woai_jolin

mh0405.exe : INFECTED with W32/Malware (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: W32/Malware
    * Signature name: NO_VIRUS
    * Compressed: NO
    * TLS hooks: YES
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * Creating several executable files on hard-drive.
    * Display message box () : Message from system.
    * Drops files in %WINSYS% folder.
    * File length:       513572 bytes.
    * MD5 hash: 6a8877fa27d36ceb6c30fd4ba6e942ce.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\TEMP\update.exe.
    * Creates file C:\WINDOWS\SYSTEM32\wxptdi.sys.
    * Creates file C:\WINDOWS\TEMP\WindowsXP-KB886185-x86-chs.exe.

[ Process/window information ]
    * Attemps to Open C:\WINDOWS\TEMP\\update.exe NULL.
    * Creates process "C:\WINDOWS\TEMP\\update.exe".
    * Attemps to Open C:\WINDOWS\TEMP\\WindowsXP-KB886185-x86-chs.exe NULL.
    * Creates process "C:\WINDOWS\TEMP\\WindowsXP-KB886185-x86-chs.exe".
    * Creates a dialogbox with caption "Extracting Files".
    * Buttons found in dialogbox: "" .
    * Enumerates running processes.

[ Signature Scanning ]
    * C:\WINDOWS\TEMP\update.exe (94208 bytes) : no signature detection.
    * C:\WINDOWS\SYSTEM32\wxptdi.sys (77824 bytes) : no signature detection.
    * C:\WINDOWS\TEMP\WindowsXP-KB886185-x86-chs.exe (394472 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

红心王子

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\UPDATE.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\WXPTDI.SYS
是否删除病毒程序及其衍生物

moonsilver

rs挂了

醉一生爱妍

江民无视？

qigang

Rising20.24.60已挂，老的鸽子肉不鲜，更加不愿意吃!

moonsilver

运行后，rs报Trojan.Win32.Mnless.zyt