今天发现的新病毒!很多杀软不报!

chabosh

今天发现的新病毒!很多杀软不报!
文件 explorer.exe 接收于 2008.03.13 03:35:40 (CET)

反病毒引擎	版本	最后更新	扫描结果
AhnLab-V3	2008.3.12.0	2008.03.12	-
AntiVir	7.6.0.73	2008.03.12	-
Authentium	4.93.8	2008.03.13	-
Avast	4.7.1098.0	2008.03.12	-
AVG	7.5.0.516	2008.03.12	Generic9.BIQX
BitDefender	7.2	2008.03.13	Trojan.Downloader.Agent.ZDF
CAT-QuickHeal	9.50	2008.03.12	-
ClamAV	0.92.1	2008.03.13	-
DrWeb	4.44.0.09170	2008.03.12	-
eSafe	7.0.15.0	2008.03.09	-
eTrust-Vet	31.3.5610	2008.03.13	-
Ewido	4.0	2008.03.12	-
FileAdvisor	1	2008.03.13	-
Fortinet	3.14.0.0	2008.03.12	-
F-Prot	4.4.2.54	2008.03.12	-
F-Secure	6.70.13260.0	2008.03.13	W32/Downloader
Ikarus	T3.1.1.20	2008.03.13	Worm.Win32.Downloader.am
Kaspersky	7.0.0.125	2008.03.13	Worm.Win32.Downloader.fi
McAfee	5250	2008.03.12	-
Microsoft	1.3301	2008.03.12	-
NOD32v2	2943	2008.03.13	probably unknown NewHeur_PE virus
Norman	5.80.02	2008.03.12	W32/Downloader
Panda	9.0.0.4	2008.03.12	-
Prevx1	V2	2008.03.13	-
Rising	20.35.22.00	2008.03.12	-
Sophos	4.27.0	2008.03.13	-
Sunbelt	3.0.930.0	2008.03.05	-
Symantec	10	2008.03.13	-
TheHacker	6.2.92.244	2008.03.12	-
VBA32	3.12.6.2	2008.03.13	suspected of Win32.Trojan.Downloader (http://...)
VirusBuster	4.3.26:9	2008.03.12	-
Webwasher-Gateway	6.6.2	2008.03.13	-

hahacomcn

to vlab~

chabosh

发现以下问题：


找到可疑开机程序：UPXDND ( C:\WINDOWS\upxdnd.exe)
找到可疑开机程序：WINSYSM ( C:\WINDOWS\49400M.exe)
找到可疑应用初始化程序：bauhgnem.dll,eohsom.dll,fyom.dll,sauhad.dll,ijougiemnaw.dll,taijoad.dll,lnaixnauhqq.dll,idtj.dll,vhqq.dll,atgnehz.dll,rsqq.dll,tsqc.dll,vauyiqvlnaix.dll,wq.dll,fmxh.dll,cty.dll,pahzij.dll,jz.dll,bz.dll,pyomielnux.dll,mhtd.dll,qnefnaib.dll,ej.dll,uixauh.dll,hjiq.dll,kiluw.dll,dsfg.dll,yqhs.dll,oaijihzeuyouhz.dll,jemnaw.dll,cuhad.dll,laixuhz.dll,rfhx.dll,mnauygniqaixnaij.dll,oqnauhc.dll,xjxr.dll,utiemnaw.dll,sve.dll,wininat.dll,gnolnait.dll,zadnew.dll,htwx.dll,knaixnauhuoyizqq.dll,duygnef.dll,gmx.dll,nadgnohiac.dll,agzg.dll,qlihzouhgnfe.dll,bchib.dll,tzm.dll,r2.dll,slcs.dll,xptyj.dll,xhtd.dll,qq.dll,sfhx.dll,gnaixnauhqq.dll,3auhad.dll,oadnew.dll,iemnaw.dll,qcsct.dll,oadgnohiac.dll,iqnauhc.dll,aixauh.dll,ddtj.dll,nuygnef.dll,uohsom.dll,gnefnaib.dll,ijiq.dll,hjxr.dll,naijoad.dll,naixuhz.dll,nahzij.dll,fmxh.dll,zqhs.dll,jsfg.dll,utgnehz.dll,uyom.dll,wtiemnaw.dll,uyomielnux.dll,vlihzouhgnfe.dll,2ty.dll,nauhgnem.dll,auhad.dll,rj.dll,hz.dll,naijihzeuyouhz.dll,xhqq.dll,jmx.dll,dgzg.dll,gsqq.dll,fz.dll,gnaixnauhuoyizqq.dll,gnolnait.dll,jsqc.dll,dqncj.dll,eve.dll,2nauygniqaixnaij.dll,niluw.dll,ijougiemnaw.dll,wtwx.dll,jghf.dll,msd.dll,asj.dll,her.dll,awf.dll,,msosmhfp01.dll
找到未知IE插件：C:\Program Files\Internet Explorer\PLUGINS\Ns_Sys55.Sys
找到未知文件执行挂钩：{3be976db-b807-4251-81e8-38997856f675}(C:\WINDOWS\system32\fCBDCBD1033.dll)
找到未知文件执行挂钩：{D29DCEE0-457B-45A2-A92D-741B95B7723B}(C:\Program Files\Internet Explorer\PLUGINS\Ns_Sys55.Sys)
找到未知文件执行挂钩：{b85e14e1-c041-4181-ad89-44a1da432fd9}(C:\WINDOWS\system32\ayCBDCBD1039.dll)
找到未知文件执行挂钩：{d9a0e8e6-e1f0-4b21-a09e-22e6e189fd7a}(C:\WINDOWS\system32\ffFKKFKK1047.dll)
找到未知文件执行挂钩：{5d965c11-4200-44fc-8fd8-6897bccc5d75}(C:\WINDOWS\system32\ffNNBNNB1033.dll)
找到未知文件执行挂钩：{1DB3C525-5271-46F7-887A-D4E1ADAA7632}(C:\WINDOWS\system32\hfrdzx.dll)
找到未知文件执行挂钩：{45AADFAA-DD36-42AB-83AD-0521BBF58C24}(C:\WINDOWS\system32\zjydcx.dll)
找到未知文件执行挂钩：{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}(C:\WINDOWS\system32\hhrdxd.dll)

WinSysM
AVPSrv

发现的生成物

hahacomcn

Begin scan in 'C:\Documents and Settings\haha\桌面\bingdu.rar'
C:\Documents and Settings\haha\桌面\bingdu.rar
  [0] Archive type: RAR
  --> bingdu\WSockDrv32.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> bingdu\upxdnd.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> bingdu\jylvvibi.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> bingdu\AVPSrv.exE
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.tcq.4
  --> bingdu\DbgHlp32.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.TJR.9
  --> bingdu\AtiSrv.exe
      [DETECTION] Contains detection pattern of the rootkit RKIT/HideProcess.B
      [INFO]      A backup was created as '484699e1.qua'  ( QUARANTINE )


End of the scan: 2008年3月13日  11:03
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
      8 Files were scanned
      6 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:

leonfg

ESET全K！
C:\Documents and Settings\GUNDAM\桌面\explorer.rar » RAR » explorer.exe - probably unknown NewHeur_PE virus

C:\Documents and Settings\GUNDAM\桌面\bingdu.rar » RAR » bingdu\WSockDrv32.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\bingdu.rar » RAR » bingdu\upxdnd.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\bingdu.rar » RAR » bingdu\jylvvibi.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\bingdu.rar » RAR » bingdu\AVPSrv.exE - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\bingdu.rar » RAR » bingdu\DbgHlp32.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\bingdu.rar » RAR » bingdu\AtiSrv.exe - probably a variant of Win32/TrojanDownloader.Agent.NWE trojan

spaceplane

http://research.sunbelt-software.com/ViewMalware.aspx?id=3474021

SW-27

可以上报吗？

chabosh

同一台电脑上的!又找到一个!

1688388728

发现病毒: Worm.Win32.Downloader.fi

An attempt was made to open an infected file.

File: explorer.exe
Directory: D:\样本\explorer

kiki

文件没报，生成物报了


[CONTROL]
VERSION=2008-2-3

[DOWN]
NEWVERSION=
1=http://www.52gol.com/xx/soc1.exe
2=http://www.52gol.com/xx/soc2.exe
3=http://www.52gol.com/xx/soc3.exe
4=http://www.52gol.com/xx/soc4.exe
5=http://www.52gol.com/xx/soc5.exe
6=http://www.52gol.com/xx/soc6.exe
7=http://www.52gol.com/xx/soc7.exe
8=http://www.52gol.com/xx/soc8.exe
9=http://www.52gol.com/xx/soc9.exe
10=http://www.52gol.com/xx/soc10.exe
11=http://www.52gol.com/xx/soc11.exe
12=http://www.52gol.com/xx/soc12.exe
13=http://www.52gol.com/xx/soc13.exe
14=http://www.52gol.com/xx/soc14.exe
15=http://www.52gol.com/xx/soc15.exe
16=http://www.52gol.com/xx/soc16.exe
17=http://www.52gol.com/xx/soc17.exe
18=http://www.52gol.com/xx/soc18.exe
19=http://www.52gol.com/xx/soc19.exe
20=http://www.52gol.com/xx/soc20.exe
21=http://www.52gol.com/xx/soc21.exe
22=http://www.52gol.com/xx/soc22.exe
23=http://www.52gol.com/xx/soc23.exe
24=http://www.52gol.com/xx/soc24.exe
25=http://www.52gol.com/xx/soc25.exe

[ 本帖最后由 kiki 于 2008-3-13 12:18 编辑 ]