19 x DNSCHANGER

qianwenxiang

85.255.121.162/download/10(*).exe
(*) = 00 to 21

wangjay1980

19

detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1012.exe
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1014.exe
detected: Trojan program Trojan.Win32.DNSChanger.aum        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1016.exe
detected: Trojan program Trojan.Win32.DNSChanger.aum        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1017.exe
detected: Trojan program Trojan.Win32.DNSChanger.aum        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1019.exe
detected: Trojan program Trojan.Win32.DNSChanger.atu        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1020.exe
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1021.exe
detected: Trojan program Trojan.Win32.DNSChanger.aum        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1015.exe
detected: Trojan program Trojan.Win32.DNSChanger.aum        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1013.exe
detected: Trojan program Trojan.Win32.DNSChanger.aum        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1011.exe
detected: Trojan program Trojan.Win32.DNSChanger.acs        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1000.exe
detected: Trojan program Trojan.Win32.DNSChanger.acs        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1001.exe
detected: Trojan program Trojan.Win32.DNSChanger.acs        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1002.exe
detected: Trojan program Trojan.Win32.DNSChanger.acs        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1003.exe
detected: Trojan program Trojan.Win32.DNSChanger.acs        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1005.exe
detected: Trojan program Trojan.Win32.DNSChanger.acs        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1006.exe
detected: Trojan program Trojan.Win32.DNSChanger.acs        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1008.exe
detected: Trojan program Trojan.Win32.DNSChanger.aum        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1009.exe
detected: Trojan program Trojan.Win32.DNSChanger.aum        File: C:\Documents and Settings\Owner\×ÀÃæ\DNSCHANGER.rar/1010.exe



Hello,

1012.exe_ - Trojan.Win32.DNSChanger.ayf,
1014.exe_ - Trojan.Win32.DNSChanger.ayd,
1021.exe_ - Trojan.Win32.DNSChanger.aye

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: DNSCHANGER.rar

[ 本帖最后由 wangjay1980 于 2008-2-26 21:34 编辑 ]

伊の星

Begin scan in 'C:\Documents and Settings\etly\桌面\DNSCHANGER.rar'
C:\Documents and Settings\etly\桌面\DNSCHANGER.rar
  [0] Archive type: RAR
  --> 1012.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1016.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1017.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1019.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1020.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1015.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1013.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1011.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1000.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1001.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1002.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1003.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1005.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1006.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1008.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1009.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '4817006e.qua'!


End of the scan: 2008年2月26日  20:03
Used time: 00:23 min

The scan has been done completely.

      0 Scanning directories
     20 Files were scanned
     16 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

allinwonderi

[Scanning : C:\Test]


C:\Test\DNSCHANGER.rar<RAR>:1000.exe <- Trojan.Dnschanger.Acs : No action
C:\Test\DNSCHANGER.rar<RAR>:1001.exe <- Trojan.Dnschanger.Acs : No action
C:\Test\DNSCHANGER.rar<RAR>:1002.exe <- Trojan.Dnschanger.Acs : No action
C:\Test\DNSCHANGER.rar<RAR>:1003.exe <- Trojan.Dnschanger.Aco : No action
C:\Test\DNSCHANGER.rar<RAR>:1005.exe <- Trojan.Dnschanger.Acs : No action
C:\Test\DNSCHANGER.rar<RAR>:1006.exe <- Trojan.Dnschanger.Acs : No action
C:\Test\DNSCHANGER.rar<RAR>:1008.exe <- Trojan.Dnschanger.Acs : No action



Scanned objects : 20

Infected objects : 7

xiaoxmj

信息        2008-02-26  20:11:16        您此次查毒共查出16个病毒以及危险代码                       
信息        2008-02-26  20:11:16        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件20个                       
信息        2008-02-26  20:11:16        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1010.exe        Win32.Troj.DNSChanger.au.76800        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1009.exe        Win32.Troj.DNSChanger.au.76800        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1008.exe        Win32.Troj.DNSChanger.ap.73700        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1006.exe        Win32.Troj.DNSChanger.ap.73700        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1005.exe        Win32.Troj.DNSChanger.ap.73700        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1003.exe        Win32.Troj.DNSChanger.ap.73700        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1002.exe        Win32.Troj.DNSChanger.ap.73700        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1001.exe        Win32.Troj.DNSChanger.ap.73700        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1000.exe        Win32.Troj.DNSChanger.ap.73700        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1011.exe        Win32.Troj.DNSChanger.au.76800        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1013.exe        Win32.Troj.DNSChanger.au.76800        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1015.exe        Win32.Troj.DNSChanger.au.76800        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1020.exe        Win32.Troj.DNSChanger.au.76800        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1019.exe        Win32.Troj.DNSChanger.au.76800        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1017.exe        Win32.Troj.DNSChanger.au.76800        跳过，未处理       
病毒        2008-02-26  20:11:16        C:\Documents and Settings\Administrator\桌面\DNSCHANGER.rar\1016.exe        Win32.Troj.DNSChanger.au.76800        跳过，未处理       
信息        2008-02-26  20:11:08        金山毒霸主程序启动查毒过程，查毒方式：命令行查毒                       
信息        2008-02-26  20:11:07        金山毒霸主程序 启动                       
信息        2008-02-26  19:38:34        金山毒霸主程序 退出

testhawk

Scan Log
Version of virus signature database: 2902 (20080226)
Date: 2008-2-26  Time: 20:32:34
Scanned disks, folders and files: C:\DNSCHANGER.rar
C:\DNSCHANGER.rar » RAR » 1016.exe - Win32/TrojanDownloader.Zlob.BPQ trojan
C:\DNSCHANGER.rar » RAR » 1017.exe - Win32/TrojanDownloader.Zlob.BPQ trojan
C:\DNSCHANGER.rar » RAR » 1019.exe - Win32/TrojanDownloader.Zlob.BPQ trojan
C:\DNSCHANGER.rar » RAR » 1020.exe - Win32/TrojanDownloader.Zlob.BPQ trojan
C:\DNSCHANGER.rar » RAR » 1015.exe - Win32/TrojanDownloader.Zlob.BPQ trojan
C:\DNSCHANGER.rar » RAR » 1013.exe - Win32/TrojanDownloader.Zlob.BPQ trojan
C:\DNSCHANGER.rar » RAR » 1011.exe - Win32/TrojanDownloader.Zlob.BNY trojan
C:\DNSCHANGER.rar » RAR » 1000.exe - probably a variant of Win32/TrojanDownloader.Zlob.BFI trojan
C:\DNSCHANGER.rar » RAR » 1001.exe - probably a variant of Win32/TrojanDownloader.Zlob.BFI trojan
C:\DNSCHANGER.rar » RAR » 1002.exe - probably a variant of Win32/TrojanDownloader.Zlob.BFI trojan
C:\DNSCHANGER.rar » RAR » 1003.exe - probably a variant of Win32/TrojanDownloader.Zlob.BFI trojan
C:\DNSCHANGER.rar » RAR » 1005.exe - probably a variant of Win32/TrojanDownloader.Zlob.BFI trojan
C:\DNSCHANGER.rar » RAR » 1006.exe - probably a variant of Win32/TrojanDownloader.Zlob.BFI trojan
C:\DNSCHANGER.rar » RAR » 1008.exe - probably a variant of Win32/TrojanDownloader.Zlob.BFI trojan
C:\DNSCHANGER.rar » RAR » 1009.exe - Win32/TrojanDownloader.Zlob.BNY trojan
C:\DNSCHANGER.rar » RAR » 1010.exe - Win32/TrojanDownloader.Zlob.BNY trojan
Number of scanned objects: 19
Number of threats found: 16
Time of completion: 20:32:40  Total scanning time: 6 sec (00:00:06)
2008-2-26 20:35:24    Real-time file system protection    file    C:\1014.exe    probably a variant of Win32/Nuwar worm    cleaned by deleting - quarantined
2008-2-26 20:36:08    Real-time file system protection    file    C:\1021.exe    probably a variant of Win32/Nuwar worm    cleaned by deleting - quarantined   
扫描bug居然还没解决............
实际查杀18个,漏1012.exe

[ 本帖最后由 testhawk 于 2008-2-26 20:43 编辑 ]

spaceplane

BD 16

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.DNSChanger.giv

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.33.12

wolffshen

FS结果: 找到 16 恶意软件
Trojan.Win32.DNSChanger.acs (病毒)
D:\Virus\Test\1000.exe 操作: 删除
D:\Virus\Test\1001.exe 操作: 删除
D:\Virus\Test\1002.exe 操作: 删除
D:\Virus\Test\1003.exe 操作: 删除
D:\Virus\Test\1005.exe 操作: 删除
D:\Virus\Test\1006.exe 操作: 删除
D:\Virus\Test\1008.exe 操作: 删除
Trojan.Win32.DNSChanger.aum (病毒)
D:\Virus\Test\1009.exe 操作: 删除
D:\Virus\Test\1010.exe 操作: 删除
D:\Virus\Test\1011.exe 操作: 删除
D:\Virus\Test\1013.exe 操作: 删除
D:\Virus\Test\1015.exe 操作: 删除
D:\Virus\Test\1016.exe 操作: 删除
D:\Virus\Test\1017.exe 操作: 删除
D:\Virus\Test\1019.exe 操作: 删除
Trojan.Win32.DNSChanger.atu (病毒)
D:\Virus\Test\1020.exe 操作: 删除

悠柚

D:\TDdownload\DNSCHANGER.rar>RAR>1016.exe - Win32/TrojanDownloader.Zlob.BPQ 特洛伊木马
D:\TDdownload\DNSCHANGER.rar>RAR>1017.exe - Win32/TrojanDownloader.Zlob.BPQ 特洛伊木马
D:\TDdownload\DNSCHANGER.rar>RAR>1019.exe - Win32/TrojanDownloader.Zlob.BPQ 特洛伊木马
D:\TDdownload\DNSCHANGER.rar>RAR>1020.exe - Win32/TrojanDownloader.Zlob.BPQ 特洛伊木马
D:\TDdownload\DNSCHANGER.rar>RAR>1015.exe - Win32/TrojanDownloader.Zlob.BPQ 特洛伊木马
D:\TDdownload\DNSCHANGER.rar>RAR>1013.exe - Win32/TrojanDownloader.Zlob.BPQ 特洛伊木马
D:\TDdownload\DNSCHANGER.rar>RAR>1011.exe - Win32/TrojanDownloader.Zlob.BNY 特洛伊木马
D:\TDdownload\DNSCHANGER.rar>RAR>1000.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马 的变种
D:\TDdownload\DNSCHANGER.rar>RAR>1001.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马 的变种
D:\TDdownload\DNSCHANGER.rar>RAR>1002.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马 的变种
D:\TDdownload\DNSCHANGER.rar>RAR>1003.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马 的变种
D:\TDdownload\DNSCHANGER.rar>RAR>1005.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马 的变种
D:\TDdownload\DNSCHANGER.rar>RAR>1006.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马 的变种
D:\TDdownload\DNSCHANGER.rar>RAR>1008.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马 的变种
D:\TDdownload\DNSCHANGER.rar>RAR>1009.exe - Win32/TrojanDownloader.Zlob.BNY 特洛伊木马
D:\TDdownload\DNSCHANGER.rar>RAR>1010.exe - Win32/TrojanDownloader.Zlob.BNY 特洛伊木马
16ge