楼主: fwhhs
收起左侧

[病毒样本] MSN的新病毒。。

[复制链接]
scottxzt
发表于 2008-1-9 16:16:37 | 显示全部楼层
程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\PICTURE-0012.JPEG_WWW.FACEBOOK.COM
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\MSMGSLIVE.EXE
是否删除木马程序及其衍生物?
scottxzt
发表于 2008-1-9 16:23:56 | 显示全部楼层

FR

newfacebook.com.zip 70.42/70.42KB       100.00%    病毒举报      它是一个“木马”    2008-1-9 16:24:20    2008-1-9 16:24:21
a256886572008
发表于 2008-1-9 16:42:30 | 显示全部楼层
2008-01-09 16:27:39    執行應用程序      操作:允許
程序路徑:C:\WINDOWS\Explorer.EXE
檔案路徑:D:\picture-0012.JPEG_www.facebook.com
觸發規則:所有程序規則->系統程式_黑名單->*.com


2008-01-09 16:27:47    建立登錄檔值      操作:封鎖
程序路徑:D:\picture-0012.JPEG_www.facebook.com
登錄檔路徑:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
登錄檔名稱:Windows Live Messenger Servicer
登錄檔數值:msmgslive.exe
觸發規則:所有程序規則->自動執行_普通模式->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*


2008-01-09 16:27:49    建立檔案      操作:允許
程序路徑:D:\picture-0012.JPEG_www.facebook.com
檔案路徑:C:\WINDOWS\system32\msmgslive.exe
觸發規則:所有程序規則->全域設定_可執行檔案1_普通模式->*.exe

2008-01-09 16:27:57    執行應用程序      操作:允許
程序路徑:D:\picture-0012.JPEG_www.facebook.com
檔案路徑:C:\WINDOWS\system32\cmd.exe
指令列:/c del D:\PICTUR~1.COM > nul
觸發規則:所有程序規則->系統程式_黑名單->*\cmd.exe


2008-01-09 16:27:59    刪除檔案      操作:允許
程序路徑:C:\WINDOWS\system32\cmd.exe
檔案路徑:D:\picture-0012.JPEG_www.facebook.com
觸發規則:所有程序規則->全域設定_可執行檔案1->*.com

2008-01-09 16:27:51    執行應用程序      操作:允許
程序路徑:D:\picture-0012.JPEG_www.facebook.com
檔案路徑:C:\WINDOWS\system32\msmgslive.exe
觸發規則:所有程序規則->*


2008-01-09 16:27:54    建立登錄檔值      操作:封鎖
程序路徑:D:\picture-0012.JPEG_www.facebook.com
登錄檔路徑:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
登錄檔名稱:PendingFileRenameOperations
登錄檔數值:\??\D:\PICTUR~1.COM
觸發規則:所有程序規則->系統設定_普通模式->HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Session Manager


2008-01-09 16:27:56    建立登錄檔值      操作:封鎖
程序路徑:C:\WINDOWS\system32\msmgslive.exe
登錄檔路徑:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
登錄檔名稱:Windows Live Messenger Servicer
登錄檔數值:msmgslive.exe
觸發規則:所有程序規則->自動執行_普通模式->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*











look at what happaned to my room after New Years!
How long do you think it is going to take to clean this up?
Damn I really shouldn't have gotten this drunk.
No way this is really your picture... or is it?!
How do you think my new look is, Good? Bad? Ugly?
I think this was the best New Years Crew ever!
here, this is the new computer I wanna get. Nice huh?
Could this really be real?
I vaguely remember seeing this person, then woke up next to them... Oh my!
Wow this was a CRAZY night. I don't even remember it!
here, this picure is PERFECT for your desktop wallpaper.
Can I show my friends this picture of you???
hey, look at this picture from ebay. Its a necklace I want so badly.
Can you tag me in this picture on Facebook?
Is it bad if I only remember the sex, and nothing else?
Oh my this isn't you right??
this is my dream house. look at the pool. Damn!
ok, ok here. but please dont send it to noone. I dont like the way i look in that one.
This picture isn't too sexy for Facebook right?!?
It alright if I use this picture of you in my profile?
Could I throw this picture of you in my album?
Could I have really had sex with them?
hey i found your picture on hotornot.com! I swear its you!
OMG, i found ur pic on cuteornot.com! im not kidding either!!!
Is this really a pic of you?
We had sex, but it never went any further... What did I do wrong?
you don't think I had sex with them... right?
It's too bad you missed out on this party!
omg I look so dumb in this pic its funny.. dont show anyone. EVER
Would you have had a threesome with them?
Do you care if I up this picture of us to my profile?
Can I add this picture of you to my new album?
I think I found your picture on adultfriendfinder!!!
Does this look good enough for my default picture?
Look at this crazyness! Two people are making out on the table!
sry about the messup i fixed the pic! Try it one more time plz
This picture isn't too sexy for Facebook right?!?
Damn I could barely walk when someone took this pic!
HAHA! this is funnny! here, read this guys shirt.
hey did i ever show you this picture of me?
Picture editing sure is a lot of work! Look what I made.
Can I upload this picture of you to my profile?
I just found the strangest picture of you on Facebook!
You get any action on New Years? I sure did! ;)
Don't let your parents see this pic!!
This picture of you looks realllly freaky!
damn New Years was crazy, I think I had sex with this person!
Does my new style look hot?
do you think I look ugly in this pic? its one of my new ones too :(
Is it bad if I had sex with someone, and all I have is their picture?
Someone took this picture right before I passed out...
Is it bad if I had a threesome with them?
My hair looks like a bomb went off. Don't you think?
OMG look at this!!!
do you think this picture is too kinky for Myspace? tell me honestly.
Just got a new webcam, the picture I took looks great!
this picture of me looks hilarious! Dont show anyone pleaze!
look at this picture from hotornot.com , I would NOT describe any of them as HOT. lol
You wouldn't care if I uploaded this picture of us, right?
dang, this person really looks like you!
This is my dream car right here!
I can't believe I gave it up soo easy on New Years. Atleast they were hot.
Can I add this picture of you to my new album?
Oh my lord, I think we trashed the place!

[ 本帖最后由 a256886572008 于 2008-1-9 16:54 编辑 ]
sjducker
发表于 2008-1-9 16:51:38 | 显示全部楼层
Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:  bbs.kafan.cn/attachment.php?aid=181268
Information:  Is the Trojan horse TR/Crypt.XPACK.Gen  


--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 7.01.00.13, AVE 7.6.0.46, VDF 7.0.1.207
hkt988
发表于 2008-1-9 16:59:18 | 显示全部楼层
扫描报告
2008年1月9日 9:59:34 - 9:59:35
计算机名称: 3933419738F84B0
扫描类型: 扫描指定目标
目标: D:\下载文件夹\newfacebook.com.zip


--------------------------------------------------------------------------------

结果: 发现1个恶意软件
Backdoor.Win32.IRCBot.azo (病毒)
D:\下载文件夹\newfacebook.com.zip\picture-0012.JPEG_www.facebook.com




--------------------------------------------------------------------------------

统计信息
已扫描:
文件: 2
未扫描: 0
结果:
病毒: 1
间谍软件: 0
可疑对象: 0
危险软件: 0
操作:
已杀毒: 0
已重命名: 0
删除: 0
已隔离: 0
失败: 0
引导区:
已扫描: 0
受感染: 0
可疑对象: 0
已杀毒: 0


--------------------------------------------------------------------------------

选项
病毒定义版本:
病毒: 2008-01-09_01
间谍软件: 2008-01-09_01
扫描引擎:
F-Secure AVP: 7.00.171, 2008-01-09
F-Secure Libra: 2.04.01, 2008-01-09
F-Secure Orion: 1.02.37, 2008-01-09
F-Secure Draco: 1.00.35, 2007-11-28
扫描选项:
扫描指定类型的文件: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ANI AVB BAT CEO CMD LSP MAP MHT MIF PHP POT SWF WMF NWS TAR TGZ ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX
扫描压缩包内部
操作:
病毒: 扫描后询问
间谍软件: 扫描后询问

--------------------------------------------------------------------------------

版权 © 1998-2007 产品支持 | 发送病毒样本到 F-Secure
对于 F-Secure 网页上所链接的由第三方创建和发布的材料, F-Secure 不承担任何责任。 除非已通过电子邮件或 F-Secure CGI 电子邮件向任一台服务器提交材料以清楚说明情况, 您同意 通过 F-Secure 网页或硬拷贝发布已有的材料。 单击带下划线的链接,可访问 F-Secure 公共网站。此时, 系统会在专用访问统计信息中用域名记录您的访问。 此信息不会提供给任何第三方。 您同意不针对所提交的材料向我们提出诉讼。 除非您已明确说明,否则应提交材料以保证 F-Secure 针对可能在 F-Secure 产品/出版物中采用的概念, 不承担任何责任。
mytishacker
发表于 2008-1-9 17:02:06 | 显示全部楼层
那么厉害.试试去
28654621
头像被屏蔽
发表于 2008-1-9 17:03:15 | 显示全部楼层
newfacebook.com.zip>>picture-0012.JPEG_www.facebook.com        Backdoor.IRCBot.azo.rous        后门        还未处理
bgt
发表于 2008-1-9 17:16:43 | 显示全部楼层
咖啡没动静。
qigang
发表于 2008-1-9 21:33:06 | 显示全部楼层

2/1

瑞星病毒查杀结果报告

清除病毒种类列表:

病毒: Backdoor.Win32.IRCbot.wqk

MAC 地址:00:11:5B:F3:6D:69

用户来源:互联网

软件版本:20.26.22
qigang
发表于 2008-1-9 21:34:25 | 显示全部楼层

回复 7楼 冷_冷 的帖子

瑞星病毒查杀结果报告

清除病毒种类列表:

病毒: Backdoor.Win32.IRCbot.wqk

MAC 地址:00:11:5B:F3:6D:69

用户来源:互联网

软件版本:20.26.22
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-5-24 06:46 , Processed in 0.086230 second(s), 15 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表