最新磁碟机变种…

显示全部楼层 · 发表于 2008-1-15 14:45:57

样本+衍生物其中：样本和lsass.exe是一样的 netcfg.000和netcfg.dll是一样的

显示全部楼层 · 发表于 2008-1-15 14:46:47

下来看看

显示全部楼层 · 发表于 2008-1-15 14:47:42

费尔
E:\xiazai\Xorer.zip>>Xorer\ramifications\alg.exe Heuri.Suspicious.ERNM 启发式扫描已删除/隔离
E:\xiazai\Xorer.zip>>Xorer\ramifications\dnsq.dll Trojan.Kdcyy.l.lvlz.dll 木马已删除/隔离
E:\xiazai\Xorer.zip>>Xorer\ramifications\lsass.exe Trojan.Kdcyy.j.knjk 木马已删除/隔离
E:\xiazai\Xorer.zip>>Xorer\ramifications\netcfg.000 W32.Xorer.dd.skct.dll 病毒已删除/隔离
E:\xiazai\Xorer.zip>>Xorer\ramifications\netcfg.dll W32.Xorer.dd.skct.dll 病毒已删除/隔离
E:\xiazai\Xorer.zip>>Xorer\ramifications\smss.exe Heuri.Suspicious.ERNM 启发式扫描已删除/隔离
E:\xiazai\Xorer.zip>>Xorer\Sample\pagefile.pif Trojan.Kdcyy.j.knjk 木马已删除/隔离

显示全部楼层 · 发表于 2008-1-15 14:52:14

McAfee W32/Fujacks

显示全部楼层 · 发表于 2008-1-15 14:52:55

Starting the file scan:

Begin scan in 'E:\Xorer.zip'
E:\Xorer.zip
  [0] Archive type: ZIP
  --> Xorer/ramifications/AntiTool.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Mix.2
  --> Xorer/ramifications/dnsq.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> Xorer/ramifications/lsass.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> Xorer/ramifications/smss.exe
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/FSG). Please verify the origin of the file
  --> Xorer/Sample/pagefile.pif
   [DETECTION] Contains suspicious code HEUR/Malware
   [WARNING] The file was ignored!

上报~

[ 本帖最后由 Graybird 于 2008-1-15 15:01 编辑 ]

显示全部楼层 · 发表于 2008-1-15 14:53:25

nod漏了一个smss.exe

[ 本帖最后由 spaceplane 于 2008-1-15 14:57 编辑 ]

显示全部楼层 · 发表于 2008-1-15 14:53:59

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\Xorer.zip'
C:\Documents and Settings\Administrator\桌面\Xorer.zip
  [0] Archive type: ZIP
  --> Xorer/ramifications/AntiTool.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Mix.2
  --> Xorer/ramifications/dnsq.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> Xorer/ramifications/lsass.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> Xorer/ramifications/smss.exe
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/FSG). Please verify the origin of the file
  --> Xorer/Sample/pagefile.pif
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    A backup was created as '47fe5909.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-1-15 14:55:29

Scanned file: Xorer.zip - Infected
Xorer.zip/Xorer/ramifications/alg.exe - OK
Xorer.zip/Xorer/ramifications/alg.exe - OK
Xorer.zip/Xorer/ramifications/AntiTool.exe - infected by Trojan-PSW.Win32.OnLineGames.mix
Xorer.zip/Xorer/ramifications/dnsq.dll - infected by Virus.Win32.Xorer.dp
Xorer.zip/Xorer/ramifications/lsass.exe - OK
Xorer.zip/Xorer/ramifications/lsass.exe - OK
Xorer.zip/Xorer/ramifications/lsass.exe - OK
Xorer.zip/Xorer/ramifications/netcfg.000 - infected by Virus.Win32.Xorer.dd
Xorer.zip/Xorer/ramifications/netcfg.dll - infected by Virus.Win32.Xorer.dd
Xorer.zip/Xorer/ramifications/smss.exe - infected by Virus.Win32.Xorer.dq
Xorer.zip/Xorer/Sample/pagefile.pif - OK
Xorer.zip/Xorer/Sample/pagefile.pif - OK
Xorer.zip/Xorer/Sample/pagefile.pif - OK

上报..

[ 本帖最后由 kato9096 于 2008-1-15 14:58 编辑 ]

显示全部楼层 · 发表于 2008-1-15 15:14:47

D:\Downloads\样本\Xorer.zip » ZIP » Xorer/ramifications/alg.exe - probably a variant of Win32/Xorer virus
D:\Downloads\样本\Xorer.zip » ZIP » Xorer/ramifications/AntiTool.exe - probably a variant of Win32/Xorer virus
D:\Downloads\样本\Xorer.zip » ZIP » Xorer/ramifications/lsass.exe - a variant of Win32/Xorer virus
D:\Downloads\样本\Xorer.zip » ZIP » Xorer/Sample/pagefile.pif - a variant of Win32/Xorer virus

显示全部楼层 · 发表于 2008-1-15 15:15:09

最近磁碟机很火嘛，到处都是

[病毒样本] 最新磁碟机变种…

本帖子中包含更多资源