19 x DNSCHANGER

显示全部楼层 · 发表于 2008-2-26 21:27:47

Scan Started Tue Feb 26 21:30:58 2008
-------------------------------------------------------------------------------

D:\TDdownload\1009.exe: Trojan.DNSChanger-2902 FOUND
D:\TDdownload\1010.exe: Trojan.DNSChanger-2902 FOUND
D:\TDdownload\1011.exe: Trojan.DNSChanger-2902 FOUND
D:\TDdownload\1013.exe: Trojan.DNSChanger-2902 FOUND
D:\TDdownload\1015.exe: Trojan.DNSChanger-2902 FOUND
D:\TDdownload\1016.exe: Trojan.DNSChanger-2902 FOUND
D:\TDdownload\1017.exe: Trojan.DNSChanger-2902 FOUND
D:\TDdownload\1019.exe: Trojan.DNSChanger-2902 FOUND
D:\TDdownload\1020.exe: Trojan.DNSChanger-2902 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 217363
Engine version: 0.92
Scanned directories: 0
Scanned files: 19
Skipped non-executable files: 0
Infected files: 9

Data scanned: 1.36 MB
Time: 8.687 sec (0 m 8 s)
--------------------------------------
Completed
--------------------------------------
9ge

显示全部楼层 · 发表于 2008-2-26 21:28:22

tarting the file scan:

Begin scan in 'D:\TDdownload\1021.exe'
D:\TDdownload\1021.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
   [INFO]    The fund was classified as suspicious.
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1000.exe'
D:\TDdownload\1000.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1001.exe'
D:\TDdownload\1001.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1002.exe'
D:\TDdownload\1002.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1003.exe'
D:\TDdownload\1003.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1005.exe'
D:\TDdownload\1005.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1006.exe'
D:\TDdownload\1006.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1008.exe'
D:\TDdownload\1008.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1009.exe'
D:\TDdownload\1009.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1010.exe'
D:\TDdownload\1010.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The fund was classified as suspicious.
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1011.exe'
D:\TDdownload\1011.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1012.exe'
D:\TDdownload\1012.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1013.exe'
D:\TDdownload\1013.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1014.exe'
D:\TDdownload\1014.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
   [INFO]    The fund was classified as suspicious.
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1015.exe'
D:\TDdownload\1015.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1016.exe'
D:\TDdownload\1016.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1017.exe'
D:\TDdownload\1017.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1019.exe'
D:\TDdownload\1019.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!
Begin scan in 'D:\TDdownload\1020.exe'
D:\TDdownload\1020.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [WARNING] The file was ignored!

End of the scan: 2008年2月26日星期二  21:31
Used time: 00:08 min

The scan has been done completely.

   0 Scanning directories
   19 Files were scanned
   16 viruses and/or unwanted programs were found
   3 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   0 Archives were scanned
   19 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-26 21:30:08

===================================================================================================
手动扫描器 7.0.0.10

NSE revision 5.91.10
nvcbin.def revision 5.90.00 of 2008/02/25 07:04:57 (1324899 variants)
nvcmacro.def revision 5.90.00 of 2008/02/04 16:47:24 (20430 variants)
Total number of variants: 1345329
===================================================================================================

   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------

- Scanning drive: D:\
- Scanning system areas of drive: D:\
- Scanning files matching: D:\TDdownload\1020.exe
   1625 ms D:\TDdownload\1020.exe                                     Virus W32/Malware ()
- Scanning files matching: D:\TDdownload\1021.exe
   297 ms D:\TDdownload\1021.exe
- Scanning files matching: D:\TDdownload\1000.exe
   234 ms D:\TDdownload\1000.exe
- Scanning files matching: D:\TDdownload\1001.exe
   188 ms D:\TDdownload\1001.exe
- Scanning files matching: D:\TDdownload\1002.exe
   188 ms D:\TDdownload\1002.exe
- Scanning files matching: D:\TDdownload\1003.exe
   344 ms D:\TDdownload\1003.exe
- Scanning files matching: D:\TDdownload\1005.exe
   250 ms D:\TDdownload\1005.exe
- Scanning files matching: D:\TDdownload\1006.exe
   219 ms D:\TDdownload\1006.exe
- Scanning files matching: D:\TDdownload\1008.exe
   687 ms D:\TDdownload\1008.exe
- Scanning files matching: D:\TDdownload\1009.exe
   1266 ms D:\TDdownload\1009.exe                                     Virus W32/Malware ()
- Scanning files matching: D:\TDdownload\1010.exe
   1640 ms D:\TDdownload\1010.exe                                     Virus W32/Malware ()
- Scanning files matching: D:\TDdownload\1011.exe
   1281 ms D:\TDdownload\1011.exe                                     Virus W32/Malware ()
- Scanning files matching: D:\TDdownload\1012.exe
   297 ms D:\TDdownload\1012.exe
- Scanning files matching: D:\TDdownload\1013.exe
   1265 ms D:\TDdownload\1013.exe                                     Virus W32/Malware ()
- Scanning files matching: D:\TDdownload\1014.exe
   875 ms D:\TDdownload\1014.exe
- Scanning files matching: D:\TDdownload\1015.exe
   1312 ms D:\TDdownload\1015.exe                                     Virus W32/Malware ()
- Scanning files matching: D:\TDdownload\1016.exe
   1281 ms D:\TDdownload\1016.exe                                     Virus W32/Malware ()
- Scanning files matching: D:\TDdownload\1017.exe
   1266 ms D:\TDdownload\1017.exe                                     Virus W32/Malware ()
- Scanning files matching: D:\TDdownload\1019.exe
   1250 ms D:\TDdownload\1019.exe                                     Virus W32/Malware ()

===================================================================================================

The scanning started: 2008/02/26 21:32:16
            ended: 2008/02/26 21:32:40

Scanning results:
Total number of files found..............................:    19
Number of files scanned..................................:    19
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    0
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    9

Copyright (c) 1993-2007 Norman ASA.

显示全部楼层 · 发表于 2008-2-26 21:35:28

Hello,

1012.exe_ - Trojan.Win32.DNSChanger.ayf,
1014.exe_ - Trojan.Win32.DNSChanger.ayd,
1021.exe_ - Trojan.Win32.DNSChanger.aye

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: DNSCHANGER.rar

显示全部楼层 · 发表于 2008-2-27 07:55:20

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\DNSCHANGER.rar'
C:\Documents and Settings\Administrator\My Documents\
  DNSCHANGER.rar
[0] Archive type: RAR
--> 1012.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1014.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING] Infected files in archives cannot be repaired!
--> 1016.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1017.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1019.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1020.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1021.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING] Infected files in archives cannot be repaired!
--> 1015.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1013.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1011.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1000.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1001.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1002.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1003.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1005.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1006.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1008.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1009.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 1010.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
   [WARNING] The file was ignored!
  DNSCHANGER.rar:Zone.Identifier

End of the scan: 2003年2月26日  15:54
Used time: 00:05 min

The scan has been done completely.

   0 Scanning directories
   21 Files were scanned
   16 viruses and/or unwanted programs were found
   3 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   5 Files not concerned
   1 Archives were scanned
   20 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-27 08:59:41

eset 16
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1016.exe - Win32/TrojanDownloader.Zlob.BPQ 特洛伊木马
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1017.exe - Win32/TrojanDownloader.Zlob.BPQ 特洛伊木马
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1019.exe - Win32/TrojanDownloader.Zlob.BPQ 特洛伊木马
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1020.exe - Win32/TrojanDownloader.Zlob.BPQ 特洛伊木马
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1015.exe - Win32/TrojanDownloader.Zlob.BPQ 特洛伊木马
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1013.exe - Win32/TrojanDownloader.Zlob.BPQ 特洛伊木马
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1011.exe - Win32/TrojanDownloader.Zlob.BNY 特洛伊木马
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1000.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马的变种
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1001.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马的变种
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1002.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马的变种
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1003.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马的变种
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1005.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马的变种
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1006.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马的变种
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1008.exe - 可能是 Win32/TrojanDownloader.Zlob.BFI 特洛伊木马的变种
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1009.exe - Win32/TrojanDownloader.Zlob.BNY 特洛伊木马
C:\Documents and Settings\软件学院\桌面\DNSCHANGER.rar>RAR>1010.exe - Win32/TrojanDownloader.Zlob.BNY 特洛伊木马

显示全部楼层 · 发表于 2008-2-27 14:31:09

beta5，

Begin scan in 'C:\Documents and Settings\haha\桌面\DNSCHANGER.rar'
C:\Documents and Settings\haha\桌面\DNSCHANGER.rar
  [0] Archive type: RAR
  --> 1012.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1014.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
  --> 1016.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1017.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1019.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1020.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1021.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
  --> 1015.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1013.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1011.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1000.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1001.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1002.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1003.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1005.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1006.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1008.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1009.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1010.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    A backup was created as '481803ff.qua'  ( QUARANTINE )

End of the scan: 2008年2月27日  14:31
Used time: 00:03 min

The scan has been done completely.

   0 Scanning directories
   20 Files were scanned
   16 viruses and/or unwanted programs were found
   3 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   4 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-27 17:12:53

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.Win32.DNSChanger.giv

用户来源：互联网

软件版本：20.33.20

7个

显示全部楼层 · 发表于 2008-2-28 17:22:49

一不小心解压了，还剩了一个，直接上报了。。。。

[病毒样本] 19 x DNSCHANGER

本帖子中包含更多资源