1x

qianwenxiang

感染型

Graybird

Starting the file scan:

Begin scan in 'E:\InsN90MON2.rar'
E:\InsN90MON2.rar
  [0] Archive type: RAR
  --> InsN90MON2.EXE
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING]   The file was ignored!

上报~

wangjay1980

shang bao

Hello,

InsN90MON2.exek - Trojan-Dropper.Win32.Agent.ebd

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.




> Attachment: InsN90MON2.rar

[ 本帖最后由 wangjay1980 于 2008-2-1 11:54 编辑 ]

spaceplane

AVAST和大蜘蛛都被过

Joker

A-Squared  Found nothing
AntiVir  Found HEUR/Crypted  
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found nothing
ClamAV  Found nothing
CPsecure  Found nothing
Dr.Web  Found nothing
F-Prot Antivirus  Found nothing
F-Secure Anti-Virus  Found nothing
Fortinet  Found nothing
Ikarus  Found Suspect code-parts (probable variant)  
Kaspersky Anti-Virus  Found nothing
NOD32  Found nothing
Norman Virus Control  Found nothing
Panda Antivirus  Found nothing
Rising Antivirus  Found nothing
Sophos Antivirus  Found nothing
VirusBuster  Found nothing
VBA32  Found nothing

清蒸波波面

费尔过了，上报

qianwenxiang

看来免杀效果还不错..

saga3721

程序:
C:\DOCUMENTS AND SETTINGS\X\桌面\INSN90MON2.EXE
木马程序生成以下文件:
1) C:\GLU32\MTXLEGIH.EXE
2) C:\GLU32\BPROTECT.EXE
3) C:\GLU32\BPROTECT.AXV
4) C:\GLU32\APROTECT.EXE
5) C:\WINDOWS\A3GUARD.EXE
是否删除木马程序及其衍生物?

鱼是一只我

费尔 卡巴  miss

冷冷

I:\virus\test\InsN90MON2.EXE - Suspect code-parts found (Level: 105)

        1 File scanned
          (0 Archives with 0 files)
        0 Signatures found
        1 Suspect code-part found
        Used time: 0:00.719


spRepair.exe;I:\VS\VIRUS\drive\C;可能 WIN.WORM.Virus;;
memtest.exe;I:\VS\VIRUS\drive\C\Boot;可能 WIN.WORM.Virus;;
memtest.exe$;I:\VS\VIRUS\drive\C\Boot;可能 WIN.WORM.Virus;;
IKernel.exe;I:\VS\VIRUS\drive\C\Program Files\Common Files\InstallShield\Engine\6\Intel 32;可能 WIN.WORM.Virus;;
IKernel.exe$;I:\VS\VIRUS\drive\C\Program Files\Common Files\InstallShield\Engine\6\Intel 32;可能 WIN.WORM.Virus;;
MCTOOL.EXE;I:\VS\VIRUS\drive\C\Program Files\Common Files\McAfee\Engine;可能 WIN.WORM.Virus;;
MCTOOL.EXE$;I:\VS\VIRUS\drive\C\Program Files\Common Files\McAfee\Engine;可能 WIN.WORM.Virus;;
MCTOOL.EXE;I:\VS\VIRUS\drive\C\Program Files\Common Files\McAfee\Engine\OldEngine;可能 WIN.WORM.Virus;;
MCTOOL.EXE$;I:\VS\VIRUS\drive\C\Program Files\Common Files\McAfee\Engine\OldEngine;可能 WIN.WORM.Virus;;
pipanel.exe;I:\VS\VIRUS\drive\C\Program Files\Common Files\microsoft shared\ink;可能 WIN.WORM.Virus;;
pipanel.exe$;I:\VS\VIRUS\drive\C\Program Files\Common Files\microsoft shared\ink;可能 WIN.WORM.Virus;;
msinfo32.exe;I:\VS\VIRUS\drive\C\Program Files\Common Files\microsoft shared\MSInfo;可能 WIN.WORM.Virus;;
msinfo32.exe$;I:\VS\VIRUS\drive\C\Program Files\Common Files\microsoft shared\MSInfo;可能 WIN.WORM.Virus;;
Setup.exe;I:\VS\VIRUS\drive\C\Program Files\InstallShield Installation Information\{FDB88DAF-8DA4-4226-855B-1D816F37AE58};可能 WIN.WORM.Virus;;
Setup.exe$;I:\VS\VIRUS\drive\C\Program Files\InstallShield Installation Information\{FDB88DAF-8DA4-4226-855B-1D816F37AE58};可能 WIN.WORM.Virus;;
iedw.exe;I:\VS\VIRUS\drive\C\Program Files\Internet Explorer;可能 WIN.WORM.Virus;;
iedw.exe$;I:\VS\VIRUS\drive\C\Program Files\Internet Explorer;可能 WIN.WORM.Virus;;
ieinstal.exe;I:\VS\VIRUS\drive\C\Program Files\Internet Explorer;可能 WIN.WORM.Virus;;
ieinstal.exe$;I:\VS\VIRUS\drive\C\Program Files\Internet Explorer;可能 WIN.WORM.Virus;;
ieuser.exe;I:\VS\VIRUS\drive\C\Program Files\Internet Explorer;可能 WIN.WORM.Virus;;
ieuser.exe$;I:\VS\VIRUS\drive\C\Program Files\Internet Explorer;可能 WIN.WORM.Virus;;
iexplore.exe;I:\VS\VIRUS\drive\C\Program Files\Internet Explorer;可能 WIN.WORM.Virus;;
iexplore.exe$;I:\VS\VIRUS\drive\C\Program Files\Internet Explorer;可能 WIN.WORM.Virus;;
CaptureWizard.exe;I:\VS\VIRUS\drive\C\Program Files\Movie Maker;可能 WIN.WORM.Virus;;
CaptureWizard.exe$;I:\VS\VIRUS\drive\C\Program Files\Movie Maker;可能 WIN.WORM.Virus;;
MOVIEMK.exe;I:\VS\VIRUS\drive\C\Program Files\Movie Maker;可能 WIN.WORM.Virus;;
MOVIEMK.exe$;I:\VS\VIRUS\drive\C\Program Files\Movie Maker;可能 WIN.WORM.Virus;;
VideoCameraAutoPlayManager.exe;I:\VS\VIRUS\drive\C\Program Files\Movie Maker;可能 WIN.WORM.Virus;;
VideoCameraAutoPlayManager.exe$;I:\VS\VIRUS\drive\C\Program Files\Movie Maker;可能 WIN.WORM.Virus;;
cclitesetupui.exe;I:\VS\VIRUS\drive\C\Program Files\MSN;可能 WIN.WORM.Virus;;
cclitesetupui.exe$;I:\VS\VIRUS\drive\C\Program Files\MSN;可能 WIN.WORM.Virus;;
stacsv64.exe;I:\VS\VIRUS\drive\C\Program Files\SigmaTel\C-Major Audio\WDM;可能 WIN.WORM.Virus;;
stacsv64.exe$;I:\VS\VIRUS\drive\C\Program Files\SigmaTel\C-Major Audio\WDM;可能 WIN.WORM.Virus;;
sttray64.exe;I:\VS\VIRUS\drive\C\Program Files\SigmaTel\C-Major Audio\WDM;可能 WIN.WORM.Virus;;
sttray64.exe$;I:\VS\VIRUS\drive\C\Program Files\SigmaTel\C-Major Audio\WDM;可能 WIN.WORM.Virus;;
suhlp64.exe;I:\VS\VIRUS\drive\C\Program Files\SigmaTel\C-Major Audio\WDM;可能 WIN.WORM.Virus;;
suhlp64.exe$;I:\VS\VIRUS\drive\C\Program Files\SigmaTel\C-Major Audio\WDM;可能 WIN.WORM.Virus;;
WinCal.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Calendar;可能 WIN.WORM.Virus;;
WinCal.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Calendar;可能 WIN.WORM.Virus;;
WinCollab.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Collaboration;可能 WIN.WORM.Virus;;
WinCollab.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Collaboration;可能 WIN.WORM.Virus;;
MpCmdRun.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Defender;可能 WIN.WORM.Virus;;
MpCmdRun.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Defender;可能 WIN.WORM.Virus;;
MSASCui.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Defender;可能 WIN.WORM.Virus;;
MSASCui.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Defender;可能 WIN.WORM.Virus;;
wab.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Mail;可能 WIN.WORM.Virus;;
wab.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Mail;可能 WIN.WORM.Virus;;
wabmig.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Mail;可能 WIN.WORM.Virus;;
wabmig.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Mail;可能 WIN.WORM.Virus;;
WinMail.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Mail;可能 WIN.WORM.Virus;;
WinMail.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Mail;可能 WIN.WORM.Virus;;
setup_wm.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
setup_wm.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmlaunch.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmlaunch.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmpconfig.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmpconfig.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmpenc.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmpenc.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmplayer.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmplayer.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmpnetwk.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmpnetwk.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmpnscfg.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmpnscfg.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmprph.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmprph.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmpshare.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
wmpshare.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
WMPSideShowGadget.exe;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
WMPSideShowGadget.exe$;I:\VS\VIRUS\drive\C\Program Files\Windows Media Player;可能 WIN.WORM.Virus;;
BProtect.Axv;I:\VS\VIRUS\drive\C\vwipxspx;可能 WIN.WORM.Virus;;
BProtect.exe;I:\VS\VIRUS\drive\C\vwipxspx;可能 WIN.WORM.Virus;;

[ 本帖最后由 冷_冷 于 2008-2-1 12:05 编辑 ]