dubious as x2

显示全部楼层 · 发表于 2008-2-15 12:51:29

>http://404dnserror.net
>>http://xscanner.spyshredderscann ... 522_MHw1fHx8fHx8fA_ (.exe)
>>http://xscanner.spyshredderscanner.com/setup/mae/webinst.cab
>>www.spy-shredder.com （文字信息）
>>>http://www.spy-shredder.com/download.php ,不过下载不了东西..只是要付钱..

显示全部楼层 · 发表于 2008-2-15 12:53:04

data15-2.rar>RAR>webinst.cab>CAB>webinst.dll - Win32/TrojanDropper.Agent.NIC 特洛伊木马 - 是已删除对象的一部分

显示全部楼层 · 发表于 2008-2-15 12:53:20

Start of the scan: 2008年2月15日星期五  12:53

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本\data15-2.rar'
C:\Documents and Settings\Administrator\桌面\样本\data15-2.rar
  [0] Archive type: RAR
  --> install_1522_MHw1fHx8fHx8fA_.exe
   [DETECTION] Is the Trojan horse TR/Renos.36808
--> webinst.cab
   [1] Archive type: CAB (Microsoft)
   --> webinst.dll
      [DETECTION] Is the Trojan horse TR/Renos.42440
   [INFO]    The file was deleted!

End of the scan: 2008年2月15日星期五  12:53
Used time: 00:08 min

The scan has been done completely.

   0 Scanning directories
   5 Files were scanned
   2 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   2 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-15 12:55:06

结果: 发现2个恶意软件
not-virus:Hoax.Win32.Renos.avd (病毒)
C:\Documents and Settings\GUNDAM\桌面\data15-2.rar\install_1522_MHw1fHx8fHx8fA_.exe
not-virus:Hoax.Win32.Renos.atv (病毒)
C:\Documents and Settings\GUNDAM\桌面\data15-2.rar\webinst.cab\webinst.dll

显示全部楼层 · 发表于 2008-2-15 12:55:39

恶意程序名称:Hoax.Win32.Renos.mq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\INSTALL_1522_MHW1FHX8FHX8FA_.EXE
是恶意程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-2-15 12:57:14

又来了。。。又是 Windows Defender 有反应金山沉默。。。

显示全部楼层 · 发表于 2008-2-15 12:58:08

detected: malware not-virus:Hoax.Win32.Renos.avd URL: http://bbs.kafan.cn/attachment.p ... MHw1fHx8fHx8fA_.exe
detected: malware not-virus:Hoax.Win32.Renos.atv URL: http://bbs.kafan.cn/attachment.p ... //PE_Patch.UPX//UPX

显示全部楼层 · 发表于 2008-2-15 13:36:31

Scan Log
Version of virus signature database: 2876 (20080214)
Date: 2008/2/15 Time: 13:33:07
Scanned disks, folders and files: G:\v\install_1522_MHw1fHx8fHx8fA_.exe;G:\v\setup.inf;G:\v\webinst.dll
G:\v\install_1522_MHw1fHx8fHx8fA_.exe - is OK
G:\v\setup.inf - is OK
G:\v\webinst.dll - Win32/TrojanDropper.Agent.NIC trojan
Number of scanned objects: 3
Number of threats found: 1
Time of completion: 13:33:14 Total scanning time: 7 sec (00:00:07)

显示全部楼层 · 发表于 2008-2-15 13:54:09

ACCESS DENIED
The requested URL could not be retrieved

--------------------------------------------------------------------------------

While trying to retrieve the URL: http://bbs.kafan.cn/attachment.php?aid=201100

The folowing error was encountered:

The requested object is INFECTED. The following viruses not-virus:Hoax.Win32.Renos.avd were found

Please contact your service provider if you feel this is incorrect.

--------------------------------------------------------------------------------

Generated Fri Feb 15 13:53:04 2008 by Kaspersky Anti-Virus 7.0

显示全部楼层 · 发表于 2008-2-15 15:06:18

恶意程序名称:Hoax.Win32.Renos.mq

程序:
C:\DOCUMENTS AND SETTINGS\ZH\桌面\INSTALL_1522_MHW1FHX8FHX8FA_.EXE
是恶意程序!
已成功阻止其运行,是否要删除此文件?

[病毒样本] dubious as x2

本帖子中包含更多资源