nod用户中毒了，分离出一些奇怪的数字文件

moonsilver

nod用户中毒了，分离出一些奇怪的数字文件

[ 本帖最后由 moonsilver 于 2008-2-15 13:23 编辑 ]

clovedsm

leonfg

结果: 发现4个恶意软件
AdWare.Win32.BHO.mj (adware)

• C:\Documents and Settings\GUNDAM\桌面\hotunist.exe.rar\hotunist.exe.重命名
• C:\Documents and Settings\GUNDAM\桌面\新建文件夹.rar\85

AdWare.Win32.Agent.cp (adware)

• C:\Documents and Settings\GUNDAM\桌面\新建文件夹.rar\82

AdWare.Win32.BHO.ca (adware)

• C:\Documents and Settings\GUNDAM\桌面\新建文件夹.rar\84

[ 本帖最后由 leonfg 于 2008-2-15 13:27 编辑 ]

wangjay1980

detected: adware not-a-virus:AdWare.Win32.Agent.cp        File: C:\Documents and Settings\Owner\×ÀÃæ\н¨Îļþ¼Ð.rar/82//NSPack
detected: adware not-a-virus:AdWare.Win32.BHO.ca        File: C:\Documents and Settings\Owner\×ÀÃæ\н¨Îļþ¼Ð.rar/84//NSPack
detected: adware not-a-virus:AdWare.Win32.BHO.mj        File: C:\Documents and Settings\Owner\×ÀÃæ\н¨Îļþ¼Ð.rar/85//NSPack
detected: adware not-a-virus:AdWare.Win32.BHO.mj        File: C:\Documents and Settings\Owner\×ÀÃæ\hotunist.exe.rar/hotunist.exe.ÖØÃüÃû//NSPack

挪威的冬天

信息        2008-02-15  13:26:18        您此次查毒共查出1个病毒以及危险代码                       
信息        2008-02-15  13:26:18        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件11个                       
信息        2008-02-15  13:26:18        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
风险程序        2008-02-15  13:26:18        C:\Users\挪威的冬天\Desktop\hotunist.exe.rar\hotunist.exe.重命名        Win32.Adware.Agent.cp.984064        跳过，未处理

clovedsm

原exe也是同样结论

woai_jolin

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

hotunist.exe : INFECTED with W32/Suspicious_N.gen (Signature: W32/BHO.BKY)


[ DetectionInfo ]
    * Sandbox name: W32/Suspicious_N.gen
    * Signature name: W32/BHO.BKY
    * Compressed: YES
    * TLS hooks: NO
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * File length:       385035 bytes.
    * MD5 hash: e65fc8913fc250532c8bdcb999d986f9.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

[ 本帖最后由 woai_jolin 于 2008-2-15 13:33 编辑 ]

hshhua01

Begin scan in 'D:\BOOK\新建文件夹.rar'
D:\BOOK\新建文件夹.rar
  [0] Archive type: RAR
  --> 84
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Bho.CA.31
  --> 85
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Bho.MJ
      [INFO]      The file was deleted!
Begin scan in 'D:\BOOK\hotunist.exe.rar'
D:\BOOK\hotunist.exe.rar
  [0] Archive type: RAR
  --> hotunist.exe.ÖØÃüÃû
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/ActiveSearch.U
      [INFO]      The file was deleted!

ytsm_112

呵呵。。。。

fishx

NOD....