virus

tonger2003

woai_jolin

Scan Log
Version of virus signature database: 2876 (20080214)
Date: 2008/2/15  Time: 13:21:42
Scanned disks, folders and files: G:\v\download6.exe;G:\v\download5.exe;G:\v\download4.exe;G:\v\download3.exe;G:\v\download2.exe;G:\v\download1.exe;G:\v\download.exe
G:\v\download6.exe - is OK
G:\v\download5.exe - is OK
G:\v\download4.exe - is OK
G:\v\download3.exe - is OK
G:\v\download2.exe - is OK
G:\v\download1.exe - is OK
G:\v\download.exe - probably a variant of Win32/TrojanDownloader.Dadobra.FX trojan
Number of scanned objects: 7
Number of threats found: 1
Time of completion: 13:21:42  Total scanning time: 0 sec (00:00:00)

woai_jolin

2008/2/15 13:23:14        Kernel        File  'G:\v\v.rar' was sent to ESET for analysis.

hshhua01

Begin scan in 'D:\BOOK\桌面.rar'
D:\BOOK\桌面.rar
  [0] Archive type: RAR
  --> download3.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> download4.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> download5.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> download6.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> download.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> download1.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> download2.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING]   The file was ignored!


End of the scan: 2008年2月15日  13:25
Used time: 00:09 min

The scan has been done completely.

      0 Scanning directories
      8 Files were scanned
      7 viruses and/or unwanted programs were found

woai_jolin

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

download.exe : Not detected by Sandbox (Signature: W32/DLoader.CSJN)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: W32/DLoader.CSJN
    * Compressed: NO
    * TLS hooks: YES
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * File length:        16384 bytes.
    * MD5 hash: 90231d4e358d1db600978563d2c8b3ac.

[ Changes to filesystem ]
    * Creates file C:\baidu.gif.

[ Network services ]
    * Downloads file from as C:\baidu.gif.
    * Connects to "www.baidu.com" on port 80.
    * Opens URL: .

[ Signature Scanning ]
    * C:\baidu.gif (4096 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

[ 本帖最后由 woai_jolin 于 2008-2-15 13:30 编辑 ]

wangjay1980

detected: virus Heur.Downloader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/download3.exe
detected: virus Heur.Downloader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/download4.exe//PE_Patch.EPProt
detected: virus Heur.Downloader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/download5.exe//PE_Patch.EPProt
detected: virus Heur.Downloader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/download6.exe//PE_Patch.EPProt
detected: Trojan program Trojan-Downloader.Win32.Banload.hna        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/download.exe
detected: virus Heur.Downloader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/download1.exe
detected: virus Heur.Downloader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/download2.exe


Hello.
Trojan-Downloader.Win32.Small.ikr
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.
-----------------
Regards, Yury Nesmachny
Virus Analyst, Kaspersky Lab.

Ph.: +7(495) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com

[ 本帖最后由 wangjay1980 于 2008-2-15 14:46 编辑 ]

红心王子

木马名称:Trojan-Downloader.Win32.Small.jib

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\DOWNLOAD.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

挪威的冬天

信息 2008-02-15  13:29:04 您此次查毒清除了4个病毒   
信息 2008-02-15  13:29:04 您此次查毒共查出4个病毒以及危险代码   
信息 2008-02-15  13:29:04 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件8个   
信息 2008-02-15  13:29:04 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒   
病毒 2008-02-15  13:29:04 C:\Users\挪威的冬天\Desktop\桌面.rar\download2.exe Win32.Troj.Downloader.ad.16384 清除成功
病毒 2008-02-15  13:29:04 C:\Users\挪威的冬天\Desktop\桌面.rar\download1.exe Win32.Troj.Downloader.ad.16384 清除成功
病毒 2008-02-15  13:29:04 C:\Users\挪威的冬天\Desktop\桌面.rar\download.exe Win32.Troj.Downloader.ad.16384 清除成功
病毒 2008-02-15  13:29:04 C:\Users\挪威的冬天\Desktop\桌面.rar\download3.exe Win32.Troj.Downloader.ad.16384 清除成功

sharkkong

已检测到: 病毒 Heur.Downloader （变种）        URL: http://bbs.kafan.cn/attachment.php?aid=201126//download3.exe
已检测到: 病毒 Heur.Downloader （变种）        URL: http://bbs.kafan.cn/attachment.p ... xe//PE_Patch.EPProt
已检测到: 病毒 Heur.Downloader （变种）        URL: http://bbs.kafan.cn/attachment.p ... xe//PE_Patch.EPProt
已检测到: 病毒 Heur.Downloader （变种）        URL: http://bbs.kafan.cn/attachment.p ... xe//PE_Patch.EPProt
已检测到: 木马程序 Trojan-Downloader.Win32.Banload.hna        URL: http://bbs.kafan.cn/attachment.php?aid=201126//download.exe
已检测到: 病毒 Heur.Downloader （变种）        URL: http://bbs.kafan.cn/attachment.php?aid=201126//download1.exe
已检测到: 病毒 Heur.Downloader （变种）        URL: http://bbs.kafan.cn/attachment.php?aid=201126//download2.exe

sam.to

6楼和9楼有没有上报?