[病毒样本] 7x

显示全部楼层 · 发表于 2008-3-11 19:07:21

Begin scan in 'F:\7.rar'
F:\7.rar
  [0] Archive type: RAR
  --> setup_axplugin.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> update.exe
   [DETECTION] Is the Trojan horse TR/Spy.Banker.jbk
  --> sub.exe
   [DETECTION] Contains suspicious code HEUR/Malware
--> MSACP32.cab
   [1] Archive type: CAB (Microsoft)
   --> MSACP32.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/123Mania.D
  --> 123DownloadsUK.exe
   [DETECTION] Contains detection pattern of the dial-up program DIAL/Generic
  --> ddos.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> setup.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Zlob.iwt.2
   [INFO]    A backup was created as '484868e5.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-3-11 19:13:27

D:\download\7.rar>>MSACP32.cab>>MSACP32.dll Adware.123Mania.d.thgf.dll 广告程序还未处理

显示全部楼层 · 发表于 2008-3-11 19:24:03

detected: Trojan program Trojan-Spy.Win32.Banker.jbk File: C:\Documents and Settings\Owner\×ÀÃæ\7.rar/update.exe
detected: adware not-a-virus:AdWare.Win32.123Mania.d File: C:\Documents and Settings\Owner\×ÀÃæ\7.rar/MSACP32.cab/MSACP32.dll//PE_Patch.UPX//UPX
detected: auto-dialer not-a-virus:Porn-Dialer.Win32.DialWeb File: C:\Documents and Settings\Owner\×ÀÃæ\7.rar/123DownloadsUK.exe//UPX
detected: Trojan program Trojan-Spy.Win32.Agent.boz File: C:\Documents and Settings\Owner\×ÀÃæ\7.rar/ddos.exe
detected: Trojan program Trojan-Downloader.Win32.Zlob.iwt File: C:\Documents and Settings\Owner\×ÀÃæ\7.rar/setup.exe//PE_Patch.UPX//UPX

TO KL

显示全部楼层 · 发表于 2008-3-11 19:58:58

ESET 4
C:\Documents and Settings\GUNDAM\桌面\7.rar » RAR » update.exe - Win32/Spy.Banker.OQT trojan
C:\Documents and Settings\GUNDAM\桌面\7.rar » RAR » MSACP32.cab » CAB » MSACP32.dll - Win32/Adware.123Mania application
C:\Documents and Settings\GUNDAM\桌面\7.rar » RAR » 123DownloadsUK.exe - a variant of Win32/Dialer.generic application
C:\Documents and Settings\GUNDAM\桌面\7.rar » RAR » setup.exe - Win32/TrojanDownloader.Zlob.BRB trojan

显示全部楼层 · 发表于 2008-3-11 20:08:22

[Found security risk] <W32/Downldr2.BDUU (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\7.rar->update.exe
[Found possible security risk] <W32/Heuristic-162!Eldorado (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\7.rar->sub.exe->(Aspack)->(PE_Patch.MaskPE)
[Found possible virus] <W32/Dialer-Adult-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\7.rar->123DownloadsUK.exe->(UPX)

---------------------------------------------------------------------
Scan ended: 2008-3-11, 20:07:55
Duration: 0:00:10

Scan result:

Scanned files:    6
Infected objects:    3
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-3-11 20:08:57

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\7.rar<RAR>:update.exe <- Trojan.Spy.Banker.Jbk : No action

Scanned objects : 16

Infected objects : 1

显示全部楼层 · 发表于 2008-3-11 20:23:27

信息 2008-03-11  20:22:51 您此次查毒共查出2个病毒以及危险代码
信息 2008-03-11  20:22:51 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件15个
信息 2008-03-11  20:22:51 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
风险程序 2008-03-11  20:22:51 D:\Desktop\7.rar\123DownloadsUK.exe Win32.RiskWare.DialerDialWe.90112 跳过，未处理
病毒 2008-03-11  20:22:49 D:\Desktop\7.rar\sub.exe Win32.Packed.MaskPE 清除成功

显示全部楼层 · 发表于 2008-3-11 20:26:07

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Dialer.Win32.DialWeb.a

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.35.12

[病毒样本] 7x

本帖子中包含更多资源

18/1