Trojan-Downloader.Win32.Delf.epw X2

显示全部楼层 · 发表于 2008-3-9 19:53:09

信息 1984-03-09  19:53:08 您此次查毒清除了3个病毒
信息 1984-03-09  19:53:08 您此次查毒共查出3个病毒以及危险代码
信息 1984-03-09  19:53:08 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件8个
信息 1984-03-09  19:53:08 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 1984-03-09  19:53:08 D:\Desktop\mm.rar\mm.ex2e Win32.Packed.MaskPE 清除成功
病毒 1984-03-09  19:53:08 D:\Desktop\2.rar\.exe2 Win32.TrojDownloader.Delf.43008 清除成功
病毒 1984-03-09  19:53:08 D:\Desktop\2.rar\update.exe3 Win32.TrojDownloader.Delf.43008 清除成功

显示全部楼层 · 发表于 2008-3-9 20:00:02

Begin scan in 'C:\Documents and Settings\haha\桌面\2.rar'
C:\Documents and Settings\haha\桌面\2.rar
  [0] Archive type: RAR
  --> update.exe3
   [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
  --> .exe2
   [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
   [INFO]    A backup was created as '4845d18f.qua'  ( QUARANTINE )

显示全部楼层 · 发表于 2008-3-9 20:01:36

Begin scan in 'C:\Documents and Settings\haha\桌面\mm.rar'
C:\Documents and Settings\haha\桌面\mm.rar
  [0] Archive type: RAR
  --> mm.ex2e
   [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
   [INFO]    A backup was created as '4801d225.qua'  ( QUARANTINE )

显示全部楼层 · 发表于 2008-3-9 21:40:07

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:update.exe3 <- Heur.Win32.I : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:update.exe3<UPack>:update.exe3<DLLRES>:IFTDLL0.exe <- Trojan.Downloader.Delf.Epw : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:.exe2 <- Heur.Win32.I : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:.exe2<UPack>:.exe2<DLLRES>:IFTDLL0.exe <- Trojan.Downloader.Delf.Epw : No action

Scanned objects : 8

Infected objects : 4

显示全部楼层 · 发表于 2008-3-9 21:40:55

[Found downloader] <W32/Banload.B.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->update.exe3
[Found downloader] <W32/Banload.B.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->.exe2

显示全部楼层 · 发表于 2008-3-9 22:46:05

原帖由 流清泉 于 2008-3-9 18:06 发表
来个
http://lx112112.kki.cn/mm.exe

Hello,

mm.ex2e - Trojan-PSW.Win32.OnLineGames.tmh

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Mikhail Bulgakov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

显示全部楼层 · 发表于 2008-3-10 02:44:18

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\2.rar'
C:\Documents and Settings\Administrator\My Documents\
  2.rar
[0] Archive type: RAR
   --> update.exe3
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
            [WARNING] Infected files in archives cannot be repaired!
   --> .exe2
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/Dldr.Delf.epw.1
            [WARNING] Infected files in archives cannot be repaired!
   [NOTE]    The file was deleted!

End of the scan: 2008年3月9日  10:44
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   3 Files were scanned
   2 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   2 Warnings
   1 Notes

显示全部楼层 · 发表于 2008-3-10 02:44:57

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\mm.exe'
C:\TDDOWNLOAD\
  mm.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: Runtime Packed
      --> Object
   [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
   [NOTE]    The file was deleted!

End of the scan: 2008年3月9日  10:44
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   1 Files were scanned
   1 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   0 Files not concerned
   0 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2008-3-10 05:24:49

Norton 2008

Unresolved Threats:
Downloader
Virus ID: 26637
Type: Compressed
Risk: High (High Stealth, High Removal, High Performance, High Privacy)
Categories: Virus
State: Remove Failed
-----------
1 File
[.exe2] inside of [d:\test\2.rar] - Infected

显示全部楼层 · 发表于 2008-3-10 07:20:21

SYMANTEC PASS

[病毒样本] Trojan-Downloader.Win32.Delf.epw X2

浏览过的版块