email中的毒网(附病毒样本)2

显示全部楼层 · 发表于 2008-2-13 20:01:43

安過年了送你張新春賀卡粉搞笑ㄛ http://www.twnets.com 記得一定要回復哦

卡巴:
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.Maran.uq 檔案: C:\Documents and Settings\kato9096\桌面\movies1.scr//data.rar/server.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.qkk 檔案: C:\Documents and Settings\kato9096\桌面\movies1.scr//data.rar/servel.exe

不报一个，上报

[ 本帖最后由 kato9096 于 2008-2-13 20:53 编辑 ]

显示全部楼层 · 发表于 2008-2-13 20:02:47

江民1

显示全部楼层 · 发表于 2008-2-13 20:04:01

Begin scan in 'D:\BOOK\movies1.rar'
D:\BOOK\movies1.rar
  [0] Archive type: RAR
--> movies1.scr
   [1] Archive type: RAR SFX (self extracting)
   --> server.exe
      [DETECTION] Is the Trojan horse TR/PSW.Maran.UG
   --> servel.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-2-13 20:08:51

Begin scan in 'D:\病毒样本\index.html'
D:\病毒样本\
  index.html
[0] Archive type: RAR SFX (self extracting)
--> server.exe
      [DETECTION] Is the Trojan horse TR/PSW.Maran.UG
      [WARNING] Infected files in archives cannot be repaired!
--> servel.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1.gif
      [WARNING] The file was ignored!

这只体内有三个.....

[ 本帖最后由 rappar 于 2008-2-13 20:11 编辑 ]

显示全部楼层 · 发表于 2008-2-13 20:16:39

謝謝，我上报.gif

显示全部楼层 · 发表于 2008-2-13 20:21:45

D:\download\index.rar>>server.exe TrojanPSW.OnlineGames.cvo.xaai 木马还未处理
D:\download\index.rar>>servel.exe Packer.VmpPacker.a.lppw 可疑程序还未处理
D:\download\movies1.rar>>movies1.scr>>server.exe TrojanPSW.OnlineGames.cvo.xaai 木马还未处理
D:\download\movies1.rar>>movies1.scr>>servel.exe Packer.VmpPacker.a.lppw 可疑程序还未处理

显示全部楼层 · 发表于 2008-2-13 20:26:04

IK
I:\virus\movies1.rar:\movies1.scr\server.exe - Signature 'Trojan-PWS.Win32.Maran.uq' found
I:\virus\movies1.rar:\movies1.scr\servel.exe - Signature 'Trojan-PWS.Win32.OnLineGames.qkk' found
I:\virus\movies1.rar:\movies1.scr\1.gif
I:\virus\movies1.rar:\movies1.scr
I:\virus\movies1.rar

5 Files scanned
(1 Archiv with 4 files)
2 Signatures found
0 Suspect code-parts found
Used time: 0:00.172

显示全部楼层 · 发表于 2008-2-13 20:27:51

程序:
C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\D\MY DOCUMENTS\MOVIES1.SCR
木马程序生成以下文件:
1) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\C\WINDOWS\SYSTEM32\SERVER.EXE
2) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\C\WINDOWS\SYSTEM32\OD3MDI.DLL
3) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\C\WINDOWS\SYSTEM32\SERVEL.EXE
4) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\C\WINDOWS\DEBUG\B831406A9770.DLL
是否删除木马程序及其衍生物?

微点报未知间谍程序，但警告有D延迟。

显示全部楼层 · 发表于 2008-2-13 20:42:57

FS MISS

显示全部楼层 · 发表于 2008-2-13 20:53:47

Hello.
No malicious software was found in the attached file.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Vyacheslav Zakorzhevsky
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

gif是No malicious software

[病毒样本] email中的毒网(附病毒样本)2

本帖子中包含更多资源

本帖子中包含更多资源

回复 4楼 rappar 的帖子