Agent-exd [trj]

显示全部楼层 · 发表于 2008-2-10 13:50:14

ACCESS DENIED
The requested URL could not be retrieved

--------------------------------------------------------------------------------

While trying to retrieve the URL: http://bbs.kafan.cn/attachment.php?aid=198584

The folowing error was encountered:

The requested object is INFECTED. The following viruses Backdoor.Win32.Agent.dku were found

Please contact your service provider if you feel this is incorrect.

--------------------------------------------------------------------------------

Generated Sun Feb 10 13:48:31 2008 by Kaspersky Anti-Virus 7.0

咔吧直接阻止了，就不详细测试了。呵呵，楼上的企鹅好小哦

显示全部楼层 · 发表于 2008-2-10 14:47:13

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.IMMSG.Win32.TBMSG.yjo
病毒： Worm.Win32.AvKiller.cz

用户来源：互联网

软件版本：20.30.60

显示全部楼层 · 发表于 2008-2-10 15:48:23

McAfee ProcKill-KnlKillP

显示全部楼层 · 发表于 2008-2-10 16:13:44

F:\virus\Data09.rar » RAR » 3.exe » UPX v12_m2 » ZIP » 3.exe - probably a variant of Win32/TrojanDownloader.Flux trojan
F:\virus\Data09.rar » RAR » 3.exe » ZIP » 3.exe - probably a variant of Win32/TrojanDownloader.Flux trojan

显示全部楼层 · 发表于 2008-2-10 16:14:24

E:\virus\Data09.rar » RAR » 3.exe » UPX v12_m2 » ZIP » 3.bat - is OK
E:\virus\Data09.rar » RAR » 3.exe » UPX v12_m2 » ZIP » 3.exe - probably a variant of Win32/TrojanDownloader.Flux trojan - was a part of the deleted object
E:\virus\Data09.rar » RAR » 3.exe » UPX v12_m2 » ZIP » 3.vbs - is OK
E:\virus\Data09.rar » RAR » 3.exe » UPX v12_m2 » ZIP » knlps.exe » PECompact v1.68 - is OK
E:\virus\Data09.rar » RAR » 3.exe » ZIP » 3.bat - is OK
E:\virus\Data09.rar » RAR » 3.exe » ZIP » 3.exe - probably a variant of Win32/TrojanDownloader.Flux trojan - was a part of the deleted object
E:\virus\Data09.rar » RAR » 3.exe » ZIP » 3.vbs - is OK
E:\virus\Data09.rar » RAR » 3.exe » ZIP » knlps.exe » PECompact v1.68 - is OK
E:\virus\Data09.rar » RAR » 1.exe » UPX v12_m2 » ZIP » 1.vbs - is OK
E:\virus\Data09.rar » RAR » 1.exe » UPX v12_m2 » ZIP » knlps.exe » PECompact v1.68 - is OK
E:\virus\Data09.rar » RAR » 1.exe » UPX v12_m2 » ZIP » 1.exe » UPX v12_m2 - is OK
E:\virus\Data09.rar » RAR » 1.exe » UPX v12_m2 » ZIP » 1.bat - is OK
E:\virus\Data09.rar » RAR » 1.exe » ZIP » 1.vbs - is OK
E:\virus\Data09.rar » RAR » 1.exe » ZIP » knlps.exe » PECompact v1.68 - is OK
E:\virus\Data09.rar » RAR » 1.exe » ZIP » 1.exe » UPX v12_m2 - is OK
E:\virus\Data09.rar » RAR » 1.exe » ZIP » 1.bat - is OK
E:\virus\Data09.rar » RAR » 3.exe - probably a variant of Win32/TrojanDownloader.Flux trojan - was a part of the deleted object
E:\virus\Data09.rar » RAR » 3.exe » UPX v12_m2 - probably a variant of Win32/TrojanDownloader.Flux trojan - was a part of the deleted object
E:\virus\Data09.rar - probably a variant of Win32/TrojanDownloader.Flux trojan - deleted - quarantined

显示全部楼层 · 发表于 2008-2-10 16:18:42

2008-2-10 16:24:13 Kernel File 'E:\virus\Data09\1.exe' was sent to ESET for analysis.

显示全部楼层 · 发表于 2008-2-10 16:41:24

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.IMMSG.Win32.TBMSG.yjo
病毒： Worm.Win32.AvKiller.cz

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.30.60

显示全部楼层 · 发表于 2008-2-10 17:20:55

FS
结果: 发现2个恶意软件
Backdoor.Win32.Agent.dku (病毒)
C:\Documents and Settings\GUNDAM\桌面\Data09.rar\3.exe\3.exe
Trojan-Clicker.Win32.Agent.qe (病毒)
C:\Documents and Settings\GUNDAM\桌面\Data09.rar\1.exe\1.exe

--------------------------------------------------------------------------------

发现危险软件
RiskTool.Win32.PsKill.v (riskware)
C:\Documents and Settings\GUNDAM\桌面\Data09.rar\3.exe\knlps.exe
C:\Documents and Settings\GUNDAM\桌面\Data09.rar\1.exe\knlps.exe

--------------------------------------------------------------------------------

统计信息
已扫描:
文件: 11
未扫描: 0
结果:
病毒: 2
间谍软件: 0
可疑对象: 0
危险软件: 2

显示全部楼层 · 发表于 2008-2-11 07:00:01

Starting the file scan:

Begin scan in 'E:\virus\Data09.rar'
E:\virus\Data09.rar
  [0] Archive type: RAR
  --> 3.exe
   [DETECTION] Contains detection pattern of the dropper DR/KillAV.GU
   [1] Archive type: ZIP SFX (self extracting)
   --> 3.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
   --> knlps.exe
      [DETECTION] Contains detection pattern of the SPR/Tool.PsKill.V program
  --> 1.exe
   [DETECTION] Contains detection pattern of the dropper DR/KillAV.GU
   [1] Archive type: ZIP SFX (self extracting)
   --> knlps.exe
      [DETECTION] Contains detection pattern of the SPR/Tool.PsKill.V program
   --> 1.exe
      [DETECTION] Is the Trojan horse TR/Click.Agent.PY
   [WARNING] The file was ignored!

[病毒样本] Agent-exd [trj]

17/2