U盘的毒

显示全部楼层 · 发表于 2008-3-17 15:37:22

U盘的毒

显示全部楼层 · 发表于 2008-3-17 15:38:58

C:\Documents and Settings\Don johnson\桌面\Autorun.rar » RAR » cool.exe - probably a variant of Win32/TrojanDownloader.Delf.OBY trojan

显示全部楼层 · 发表于 2008-3-17 15:41:24

原来是木马下载器啊~~

显示全部楼层 · 发表于 2008-3-17 15:44:05

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\Autorun.rar'
C:\Documents and Settings\Administrator\My Documents\
  Autorun.rar
[0] Archive type: RAR
--> Autorun.inf
--> cool.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-3-17 15:59:20

下载的木马

显示全部楼层 · 发表于 2008-3-17 16:07:35

E:\VIRUS\Autorun18.rar » RAR » cool.exe - probably a variant of Win32/TrojanDownloader.Delf.OBY trojan
E:\VIRUS\Autorun18.rar » RAR » 2.exe - a variant of Win32/StartPage.NHW trojan
E:\VIRUS\Autorun18.rar » RAR » 6.exe » NSIS » 286.exe - error reading archive
E:\VIRUS\Autorun18.rar » RAR » 4.exe » NSIS » InsShell.exe - error reading archive

显示全部楼层 · 发表于 2008-3-17 16:08:37

Begin scan in 'E:\VIRUS\Autorun18.rar'
E:\VIRUS\Autorun18.rar
  [0] Archive type: RAR
  --> cool.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 2.exe
   [DETECTION] Contains suspicious code HEUR/Malware

显示全部楼层 · 发表于 2008-3-17 16:13:41

#1:
Kaspersky Virus Scanner

Scanned file: Autorun.rar
Autorun.rar/Autorun.inf - OK
Autorun.rar/cool.exe - OK
Autorun.rar/cool.exe - OK
Autorun.rar/cool.exe - OK

#5:
Kaspersky Virus Scanner

Scanned file: Autorun(2).rar - Infected
Autorun(2).rar/Autorun.inf - OK
Autorun(2).rar/cool.exe - OK
Autorun(2).rar/cool.exe - OK
Autorun(2).rar/cool.exe - OK
Autorun(2).rar/2.exe - infected by Trojan-Downloader.Win32.Agent.lbb
Autorun(2).rar/emsf.bat - OK
Autorun(2).rar/6.exe/stream/Script - OK
Autorun(2).rar/6.exe/stream/data0001 - OK
Autorun(2).rar/6.exe/stream Unknown format NSIS
Autorun(2).rar/6.exe/stream/data0002/data0001 - OK
Autorun(2).rar/6.exe/stream/data0002/data0002 - OK
Autorun(2).rar/6.exe/stream/data0002/data0003 - OK
Autorun(2).rar/6.exe/stream/data0002/data0004 - OK
Autorun(2).rar/6.exe/stream/data0002 - OK
Autorun(2).rar/6.exe/stream - OK
Autorun(2).rar/6.exe - OK
Autorun(2).rar/4.exe/stream/Script - OK
Autorun(2).rar/4.exe/stream Unknown format NSIS
Autorun(2).rar/4.exe/stream/data0001 - infected by not-a-virus:AdWare.Win32.Boran.eb

上报

显示全部楼层 · 发表于 2008-3-17 16:47:59

http://research.sunbelt-software.com/ViewMalware.aspx?id=3533469

显示全部楼层 · 发表于 2008-3-17 17:05:35

微点砍掉

[病毒样本] U盘的毒

本帖子中包含更多资源

本帖子中包含更多资源

回复 5楼小白鼠的帖子

回复 5楼小白鼠的帖子

本帖子中包含更多资源

[病毒样本] U盘的毒

本帖子中包含更多资源

本帖子中包含更多资源

回复 5楼 小白鼠 的帖子

回复 5楼 小白鼠 的帖子

本帖子中包含更多资源

回复 5楼小白鼠的帖子

回复 5楼小白鼠的帖子