[病毒样本] 4

显示全部楼层 · 发表于 2008-3-28 13:54:11

Kaspersky Virus Scanner

Scanned file: 7.rar
7.rar/mipikq.sys - OK
7.rar/mipikq.sys - OK
7.rar/mipikq.dll - OK

Kaspersky Virus Scanner

Scanned file: 6.rar
6.rar/autorun.inf - OK
6.rar/MSDOS.bat - OK
6.rar/MSDOS.bat - OK
6.rar/MSDOS.bat - OK
6.rar/windows.ext - OK
6.rar/windows.ext - OK
6.rar/windows.ext - OK

上报卡巴

Hello,

autorun.inf

No malicious code was found in this file.

mipikq.dll - Backdoor.Win32.PcClient.cgf,
mipikq.sys4 - Backdoor.Win32.PcClient.cgg,
MSDOS.bat_, windows.ext4 - Worm.Win32.Otwycal.b

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Namestnikov Yury
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-3-28 15:22 编辑 ]

显示全部楼层 · 发表于 2008-3-28 13:58:43

[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> c:\test\6.rar->MSDOS.bat4->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> c:\test\6.rar->windows.ext4->(UPack)

显示全部楼层 · 发表于 2008-3-28 14:04:32

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\6.rar'
C:\Documents and Settings\Administrator\My Documents\
  6.rar
[0] Archive type: RAR
--> autorun.inf
   --> MSDOS.bat4
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
   --> windows.ext4
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
   [WARNING] The file was ignored!
  6.rar:Zone.Identifier
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\7.rar'
C:\Documents and Settings\Administrator\My Documents\
  7.rar
[0] Archive type: RAR
--> mipikq.sys4
--> mipikq.dll
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Pcclient.buu Backdoor server programs
   [WARNING] The file was ignored!
  7.rar:Zone.Identifier

End of the scan: 2008年3月27日  23:04
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   9 Files were scanned
   3 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   6 Files not concerned
   2 Archives were scanned
   2 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-3-28 14:05:33

D:\Documents and Settings\EKINCHENG\桌面\6.rar » RAR » MSDOS.bat4 - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\6.rar » RAR » windows.ext4 - probably a variant of Win32/Genetik trojan

显示全部楼层 · 发表于 2008-3-28 14:12:54

信息 2008-03-28  14:12:48 您此次查毒清除了1个病毒
信息 2008-03-28  14:12:48 您此次查毒共查出1个病毒以及危险代码
信息 2008-03-28  14:12:48 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件9个
信息 2008-03-28  14:12:48 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-03-28  14:12:48 D:\Desktop\7.rar\mipikq.dll Win32.Troj.PcClientT.cz.95812 清除成功

显示全部楼层 · 发表于 2008-3-28 14:43:21

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.Win32.Undef.dth

用户来源：互联网

软件版本：20.37.40

显示全部楼层 · 发表于 2008-3-28 19:45:25

全歼
[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\6.rar<RAR>:MSDOS.bat4<UPack>:MSDOS.bat4<DLLRES>:res0.exe <- Trojan.Downloader.Delf.Fsd : No action
C:\Documents and Settings\All Users\Documents\Test\6.rar<RAR>:windows.ext4<UPack>:windows.ext4<DLLRES>:res0.exe <- Trojan.Downloader.Delf.Fsd : No action
C:\Documents and Settings\All Users\Documents\Test\7.rar<RAR>:mipikq.sys4 <- Trojan.Rbot.Ecn : No action
C:\Documents and Settings\All Users\Documents\Test\7.rar<RAR>:mipikq.dll <- Trojan.Rbot.Ecn : No action

Scanned objects : 11

Infected objects : 4

显示全部楼层 · 发表于 2008-3-28 21:12:35

只有一个

显示全部楼层 · 发表于 2008-3-28 21:16:47

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Undef.dth

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.37.42

显示全部楼层 · 发表于 2008-3-28 23:42:48

费尔：

第一包
E:\病毒\7.rar>>mipikq.dll Trojan.Agent.ahjo.avpa.dll 木马还未处理

第二包
E:\病毒\6.rar>>autorun.inf INF.Autorun.d 病毒还未处理
E:\病毒\6.rar>>MSDOS.bat4 Trojan.Cap832723.igoa 木马还未处理
E:\病毒\6.rar>>windows.ext4 Trojan.Cap832723.igoa 木马还未处理

[病毒样本] 4

本帖子中包含更多资源

回复 6楼 kkgh 的帖子

11/1