一小包

显示全部楼层 · 发表于 2008-2-29 12:46:50

从某帖挖来的

样本：

显示全部楼层 · 发表于 2008-2-29 12:48:55

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.ied 檔案: C:\Documents and Settings\kato9096\桌面\210787.rar/0034\ad.exe//stream//data0001
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.BHO.aai 檔案: C:\Documents and Settings\kato9096\桌面\210787.rar/0034\ad7291.exe//stream//data0001
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Virtumonde.gen 檔案: C:\Documents and Settings\kato9096\桌面\210787.rar/0034\is150018.exe
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.irm 檔案: C:\Documents and Settings\kato9096\桌面\210787.rar/0034\wr-1-565.exe//PE_Patch.Upolyx//PE_Patch.UPX//UPX

不报的上报卡巴

显示全部楼层 · 发表于 2008-2-29 12:50:34

Begin scan in 'E:\VIRUS\0034.rar'
E:\VIRUS\0034.rar
  [0] Archive type: RAR
  --> 0034\ad.exe
   [DETECTION] Contains detection pattern of the dropper DR/Dldr.Small.ied
  --> 0034\Feb2008.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.20480
  --> 0034\is150018.exe
   [DETECTION] Is the Trojan horse TR/Vundo.Gen
  --> 0034\my_70229.exe
   [DETECTION] Is the Trojan horse TR/Downloader.Gen
  --> 0034\wr-1-565.exe
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
   [WARNING] The file was ignored!

End of the scan: 2008年2月29日  12:50
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   10 Files were scanned
   5 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   5 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-29 13:05:09

ESS报了两个广告的

显示全部楼层 · 发表于 2008-2-29 13:06:06

D:\病毒测试\未解压样本\0034.rar » RAR » 0034\ad7291.exe » NSIS » Uninst.exe - Win32/Adware.Cinmus application
D:\病毒测试\未解压样本\0034.rar » RAR » 0034\is150018.exe - Win32/Adware.Virtumonde application

显示全部楼层 · 发表于 2008-2-29 13:16:09

Hello,

adv579.exed - Trojan-Downloader.Win32.Small.itf,
dodolook446.exed - Trojan-Downloader.Win32.Small.itg,
my_70229.exed - Trojan-Downloader.Win32.QQHelper.aoe,
sta.exed - Trojan-PSW.Win32.OnLineGames.sgz

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Feb2008.exed, Feb2008.ini

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

显示全部楼层 · 发表于 2008-2-29 13:18:41

显示全部楼层 · 发表于 2008-2-29 13:21:10

FS报了四个!
Scanning Report
29 February 2008 13:20:34 - 13:20:37
Computer name: PUMA-PC
Scanning type: Scan target
Target: C:\Users\Administrator\Desktop\0034.rar

--------------------------------------------------------------------------------

Result: 4 malware found
Trojan-Downloader.Win32.Small.ied (virus)
C:\Users\Administrator\Desktop\0034.rar\0034\ad.exe
AdWare.Win32.BHO.aai (adware)
C:\Users\Administrator\Desktop\0034.rar\0034\ad7291.exe
AdWare.Win32.Virtumonde.gen (adware)
C:\Users\Administrator\Desktop\0034.rar\0034\is150018.exe
Trojan-Downloader.Win32.Small.irm (virus)
C:\Users\Administrator\Desktop\0034.rar\0034\wr-1-565.exe

--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 10
Not scanned: 0
Result:
Viruses: 2
Spyware: 2
Suspicious items: 0
Riskware: 0
Actions:
Disinfected: 0
Renamed: 0
Deleted: 0
Quarantined: 0
Failed: 0
Boot Sectors:
Scanned: 0
Infected: 0
Suspicious items: 0
Disinfected: 0

--------------------------------------------------------------------------------

Options
Definitions version:
Viruses: 2008-02-29_01
Spyware: 2008-02-29_01
Scanning Engines:
F-Secure AVP: 7.00.171, 2008-02-29
F-Secure Libra: 2.04.01, 2008-02-28
F-Secure Orion: 1.02.38, 2008-02-29
F-Secure Draco: 1.00.35, 2008-02-13
Scanning options:
Scan all files
Scan inside archives
Actions:
Viruses: Quarantine and delete
Spyware: Quarantine and delete

显示全部楼层 · 发表于 2008-2-29 13:35:04

uploaded to eset

显示全部楼层 · 发表于 2008-2-29 13:42:22

D:\download\0034.rar>>0034\ad.exe TrojanDropper.Uwfvtb.bvjj.arc 木马还未处理
D:\download\0034.rar>>0034\is150018.exe Adware.Virtumonde.gen.gisz 广告程序还未处理
D:\download\0034.rar>>0034\wr-1-565.exe TrojanDownloader.Small.irm.ozit 木马还未处理

[病毒样本] 一小包

本帖子中包含更多资源

本帖子中包含更多资源