Autorun+Downloader

qianwenxiang

Autorun+Downloader
动作肯定是..


下载
http://777.za123.cn/cc/999.exe
http://www.009911.cn/tt/list.htm (BASE64,textbox显示不出来..处理掉ASCII>130的字符后发现链接)

PS.列面里面那些CNNIC、小i机器人伴侣、脱兔什么的我就没有下载了,不慎把AlexaBar下载进去了..这个基本可以54

http://www.amcc.cn
http://www.pceggs.cn/pgComDefault.aspx?ID=2912 这毒。。难道是刷DD的东西。。
http://777.za123.cn/cc/999.exe
http://777.za123.cn/cc8/installalexa.exe
http://images.sohu.net/softwareunion/4/ad6026.exe
http://skype.tom.com/download/union/0000110/00011000387/skypeclient.exe
http://777.za123.cn/cc8/88down.exe
http://777.za123.cn/cc8/down2008.exe
http://gdgs.my2.21ld.com/cc8/tuotu_silent_u1212.exe
http://down.ete.cn/cnnic_new/cnnic_1029.exe
http://777.za123.cn/cc8/setup-226.exe
http://images.sohu.net/softwareunion/4/ad6022.exe
http://777.za123.cn/cc8/636.exe
http://777.za123.cn/cc8/setupol_3247_0265.exe
http://down.ete.cn/xiaoi/slientinstall.exe
http://777.za123.cn/cc8/xiaoialerts_install.exe
http://down.ete.cn/kaba/kaba_1004.exe
下载列表结束。。省略一大拖刷流量的站点

sam.to

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.fvz        檔案: C:\Documents and Settings\kato9096\桌面\Data05.rar/kaba_1004.exe//data0002
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Baser.bd        檔案: C:\Documents and Settings\kato9096\桌面\Data05.rar/down2008.exe
已刪除: 特洛伊木馬程式 Trojan-Spy.Win32.Pophot.zp        檔案: C:\Documents and Settings\kato9096\桌面\Data05.rar/999.exe//PE_Patch//UPack
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.BHO.acv        檔案: C:\Documents and Settings\kato9096\桌面\Data05.rar/ad6026.exe//stream//data0001
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.dus        檔案: C:\Documents and Settings\kato9096\桌面\Data05.rar/88down.exe//PE_Patch//UPack
已刪除: 病毒 Virus.Win32.AutoRun.ahz        檔案: C:\Documents and Settings\kato9096\桌面\Data05.rar/down200802.exe
已刪除: 廣告軟體 not-a-virus:AdWare.Win32.BHO.acv        檔案: C:\Documents and Settings\kato9096\桌面\Data05.rar/ad6022.exe//stream
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.ctt        檔案: C:\Documents and Settings\kato9096\桌面\Data05.rar/636.exe//ASPack


8，上报卡巴

挪威的冬天

信息        2008-03-05  19:49:52        您此次查毒共查出6个病毒以及危险代码                       
信息        2008-03-05  19:49:52        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件20个                       
信息        2008-03-05  19:49:52        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
风险程序        2008-03-05  19:49:52        D:\Desktop\Data05.rar\setup-226.exe        Win32.MalWare.OCINS.b.1454080        跳过，未处理       
病毒        2008-03-05  19:49:50        D:\Desktop\Data05.rar\636.exe        Win32.TrojDownloader.Delf.139264        清除成功       
病毒        2008-03-05  19:49:49        D:\Desktop\Data05.rar\down200802.exe        Win32.Troj.Autorun.17423        清除成功       
病毒        2008-03-05  19:49:49        D:\Desktop\Data05.rar\88down.exe        Win32.Troj.Unknown.197632        清除成功       
病毒        2008-03-05  19:49:49        D:\Desktop\Data05.rar\installalexa.exe        Win32.Hack.Unk00000A00.1515520        清除成功       
病毒        2008-03-05  19:49:49        D:\Desktop\Data05.rar\999.exe        Win32.Troj.SpyT.nh.925696        清除成功

hshhua01

Begin scan in 'D:\BOOK\Data05.rar'
D:\BOOK\Data05.rar
  [0] Archive type: RAR
  --> down2008.exe
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
  --> 999.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
  --> installalexa.exe
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/AlexaB.Dll.1
  --> ad6026.exe
      [DETECTION] Contains detection pattern of the dropper DR/BHO.acv.13
  --> 88down.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> down200802.exe
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
  --> setup-226.exe
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Cdn.B.1
  --> ad6022.exe
      [DETECTION] Contains detection pattern of the dropper DR/BHO.acv.16
  --> 636.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING]   The file was ignored!


End of the scan: 2008年3月5日星期三  19:50
Used time: 00:09 min

The scan has been done completely.

      0 Scanning directories
     12 Files were scanned
      9 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.Autorun.yxk
病毒： Trojan.Clicker.Win32.PopHot.ga
病毒： Trojan.Win32.Undef.djy   
病毒： Trojan.Win32.Undef.djy   
病毒： Backdoor.Win32.BAC.a     
病毒： Trojan.DL.Win32.Delf.ctt

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.34.22

wangjay1980

下载一堆流氓

gho

2008-3-5 20:51:33        gho        1504        Sign of "Win32:Adware-gen [Adw]" has been found in "D:\Data05\kaba_1004.exe" file.  
2008-3-5 20:51:47        gho        1504        Sign of "Win32:Delf-FVX [Trj]" has been found in "D:\Data05\down2008.exe" file.  
2008-3-5 20:51:51        gho        1504        Sign of "Win32:Agent-ICL [Trj]" has been found in "D:\Data05\999.exe\[Upack]" file.  
2008-3-5 20:51:54        gho        1504        Sign of "Win32:Agent-ICL [Trj]" has been found in "D:\Data05\installalexa.exe\[Upack]" file.  
2008-3-5 20:51:58        gho        1504        Sign of "Win32:Delf-ECV [Trj]" has been found in "D:\Data05\88down.exe\[Upack]" file.  
2008-3-5 20:52:01        gho        1504        Sign of "Win32:Delf-FVX [Trj]" has been found in "D:\Data05\down200802.exe\[UPX]" file.  
2008-3-5 20:52:05        gho        1504        Sign of "Win32:Adloader-KU [Trj]" has been found in "D:\Data05\636.exe\[ASPack]" file.

sam.to

Hello,

installalexa.exe3 - not-a-virus:AdWare.Win32.AlexaBar.z

This file is an Advertizing Tool, It's detection will be included in the next
update of extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

setup-226.exe2, setupol_3247_0265.exe2

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

wangjay1980

哈哈，那两个估计CNNIC

leonfg

ESET 7
C:\Documents and Settings\软件学院\桌面\Data05.rar > RAR > down2008.exe - 可能是 Win32/Delf.NDV 蠕虫 的变种
C:\Documents and Settings\软件学院\桌面\Data05.rar > RAR > 999.exe - Win32/Spy.Delf.NHF 特洛伊木马 的变种
C:\Documents and Settings\软件学院\桌面\Data05.rar > RAR > ad6026.exe > NSIS > Uninst.exe - Win32/Adware.Cinmus 应用程序
C:\Documents and Settings\软件学院\桌面\Data05.rar > RAR > 88down.exe - 可能是 Win32/Genetik 特洛伊木马 的变种
C:\Documents and Settings\软件学院\桌面\Data05.rar > RAR > down200802.exe - 可能是 Win32/Delf.NDV 蠕虫 的变种
C:\Documents and Settings\软件学院\桌面\Data05.rar > RAR > ad6022.exe > NSIS > Uninst.exe - Win32/Adware.Cinmus 应用程序
C:\Documents and Settings\软件学院\桌面\Data05.rar > RAR > 636.exe - 可能是 Win32/TrojanDownloader.Delf 特洛伊木马 的变种