肉鸡里新收的文件，可能是malware。另外问下有人用肉鸡收样本么？

显示全部楼层 · 发表于 2008-4-9 13:20:40

C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>0c2b109db1785d9740072ab22f37b75a.bin RootKit.Mnless.ku.xsdr 木马还未处理
C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>1d870d6db7b798181e8ee03c7a60fd09.bin Suspicious.RootKit.Obscure.a.muhw 木马还未处理
C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>3e8bd10b9647eefafdc058ae29f7df61.bin Trojan.VB.Small.ael.hwzh 木马还未处理
C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>72ea80693d102e2529e966f9e34ce69b.bin W32.Hitapop.ttwx.dll 病毒还未处理
C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>8c1870ed046471abda6b65edbb02b273.bin W32.Hitapop.ttwx.dll 病毒还未处理
C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>d55da6a1f754dba8a2c4bb8dca72ddcf.bin TrojanHijack.Explor.4512.wpiv 木马还未处理

显示全部楼层 · 发表于 2008-4-9 14:19:45

3813438  61b5ca6bb43eaf1df...bc.bin  31.7 KB  MALWARE
3813439  3e8bd10b9647eefaf...61.bin  32 KB  DAMAGED FILE (UNKNOWN)
3813440  3e175fd611fa96bba...be.bin  33.65 KB  MALWARE
3807602  d55da6a1f754dba8a...cf.bin  36 KB  MALWARE
3813441  0c2b109db1785d974...5a.bin  24.66 KB  MALWARE
3813442  8c1870ed046471abd...73.bin  27 KB  MALWARE
3813443  72ea80693d102e252...9b.bin  27 KB  MALWARE
3813444  1d870d6db7b798181...09.bin  28.13 KB  MALWARE

显示全部楼层 · 发表于 2008-4-9 14:29:55

C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>61b5ca6bb43eaf1df4b93573879b8dbc.bin Heuri.Possible/Packed 启发式扫描还未处理
C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>3e8bd10b9647eefafdc058ae29f7df61.bin Trojan.VB.Small.ael.hwzh 木马还未处理
C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>3e175fd611fa96bbade9bb105c8acebe.bin Heuri.Possible/Packed 启发式扫描还未处理
C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>d55da6a1f754dba8a2c4bb8dca72ddcf.bin TrojanHijack.Explor.4512.wpiv 木马还未处理
C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>0c2b109db1785d9740072ab22f37b75a.bin RootKit.Mnless.ku.xsdr 木马还未处理
C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>8c1870ed046471abda6b65edbb02b273.bin W32.Hitapop.ttwx.dll 病毒还未处理
C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>72ea80693d102e2529e966f9e34ce69b.bin W32.Hitapop.ttwx.dll 病毒还未处理
C:\Documents and Settings\Administrator\桌面\maybe malware.rar>>1d870d6db7b798181e8ee03c7a60fd09.bin Suspicious.RootKit.Obscure.a.muhw 木马还未处理

显示全部楼层 · 发表于 2008-4-9 19:44:44

对象: 61b5ca6bb43eaf1df4b93573879b8dbc.bin
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\maybe_malware.rar
Status: 已发现病毒
病毒: Trojan.Agent.BDV (BD 引擎)
对象: 3e175fd611fa96bbade9bb105c8acebe.bin
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\maybe_malware.rar
Status: 已发现病毒
病毒: Trojan.Agent.BDV (BD 引擎)
对象: 8c1870ed046471abda6b65edbb02b273.bin
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\maybe_malware.rar
Status: 已发现病毒
病毒: Trojan.Hitpop.1 (BD 引擎)
对象: 72ea80693d102e2529e966f9e34ce69b.bin
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\maybe_malware.rar
Status: 已发现病毒
病毒: Trojan.Hitpop.1 (BD 引擎)

显示全部楼层 · 发表于 2008-4-9 19:55:49

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： RootKit.Win32.Mnless.ku
病毒： Trojan.Clicker.Win32.PopHot.dsf
病毒： Suspicious.RootKit.Win32.Obscure.a

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.39.22

显示全部楼层 · 发表于 2008-4-9 20:49:09

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\maybe malware.rar<RAR>:61b5ca6bb43eaf1df4b93573879b8dbc.bin <- Variant:Trojan.Vb.Ait : No action
C:\Documents and Settings\All Users\Documents\Test\maybe malware.rar<RAR>:3e175fd611fa96bbade9bb105c8acebe.bin <- Variant:Trojan.Vb.Ait : No action
C:\Documents and Settings\All Users\Documents\Test\maybe malware.rar<RAR>:0c2b109db1785d9740072ab22f37b75a.bin <- Downloader.Hmir.Bdu : No action

Scanned objects : 11

Infected objects : 3

显示全部楼层 · 发表于 2008-4-9 20:49:44

[Found security risk] <W32/SYStroj.B.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\maybe malware.rar->1d870d6db7b798181e8ee03c7a60fd09.bin

---------------------------------------------------------------------
Scan ended: 2008-4-9, 20:49:36
Duration: 0:00:06

Scan result:

Scanned files:    6
Infected objects:    1
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-4-9 22:56:08

avast found Win32:Hmir-F

显示全部楼层 · 发表于 2008-4-11 12:05:49

业余得够专业用肉鸡收毒

显示全部楼层 · 发表于 2008-4-11 13:16:09

病毒: Trojan-Clicker.Win32.VB.amr (2x), Trojan-Downloader.Win32.Hmir.btd
文件: 00022704.php
目录: C:\Documents and Settings\All Users\Application Data\Avira\Avira Premium Security Suite\TEMP\WEBGUARD
进程: avesvc.exe

[病毒样本] 肉鸡里新收的文件，可能是malware。另外问下有人用肉鸡收样本么？

费尔居然也能启发2个。。

11/4