[病毒样本] 7

显示全部楼层 · 发表于 2008-4-18 11:16:08

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.abag 檔案: C:\Documents and Settings\kato9096\桌面\複製 -病毒2.rar/DbgHlp32.exe//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.yxl 檔案: C:\Documents and Settings\kato9096\桌面\複製 -病毒2.rar/mfchlp32.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.zea 檔案: C:\Documents and Settings\kato9096\桌面\複製 -病毒2.rar/MsIMMs32.exE//PE_Patch//UPack//PE_Patch
已刪除: 特洛伊木馬程式 Backdoor.Win32.Small.cla 檔案: C:\Documents and Settings\kato9096\桌面\複製 -micross25.rar/micross25.exe//PE_Patch//PE-Armor

上报卡巴

Hello,

b3b4f3ed78981391171.bat_,
b3b4f3ed78981486609.bat_,
d2b282ef026d1448906.bat_,
_uninsep.bat_

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Dmitry Shvetsov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-4-18 12:55 编辑 ]

显示全部楼层 · 发表于 2008-4-18 11:17:25

C:\Documents and Settings\Don johnson\桌面\病毒2.rar » RAR » DbgHlp32.exe2 - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\病毒2.rar » RAR » mfchlp32.exe2 - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\病毒2.rar » RAR » MsIMMs32.exE2 - probably a variant of Win32/PSW.OnLineGames.NFL trojan

显示全部楼层 · 发表于 2008-4-18 11:18:09

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\micross25'
C:\Documents and Settings\Administrator\My Documents\micross25\
  b3b4f3ed78981391171.bat2
  b3b4f3ed78981486609.bat2
  d2b282ef026d1448906.bat2
  DbgHlp32.exe2
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
  mfchlp32.exe2
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.Online.cfb
         [WARNING] Infected files in archives cannot be repaired!
   [NOTE]    The file was deleted!
  micross25.exe2
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [NOTE]    The file was deleted!
  MsIMMs32.exE2
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
  _uninsep.bat2

End of the scan: 2008年4月17日  20:18
Used time: 00:04 min

The scan has been done completely.

   2 Scanning directories
   8 Files were scanned
   4 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   4 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   4 Files not concerned
   0 Archives were scanned
   1 Warnings
   4 Notes

显示全部楼层 · 发表于 2008-4-18 11:18:38

E:\病毒\病毒2.rar » RAR » DbgHlp32.exe2 - probably a variant of Win32/PSW.OnLineGames.NFL trojan
E:\病毒\病毒2.rar » RAR » mfchlp32.exe2 - probably a variant of Win32/PSW.OnLineGames.NFL trojan
E:\病毒\病毒2.rar » RAR » MsIMMs32.exE2 - probably a variant of Win32/PSW.OnLineGames.NFL trojan

显示全部楼层 · 发表于 2008-4-18 11:25:36

[发现后门]?<W32/Backdoor2.AALB (确切)> C:\Documents and Settings\Administrator\桌面\micross25\micross25.exe2
[已删除] C:\Documents and Settings\Administrator\桌面\micross25\micross25.exe2
[发现安全风险? <W32/Injector.A.gen!Eldorado (not disinfectable, 普通)> C:\Documents and Settings\Administrator\桌面\病毒2\DbgHlp32.exe2
[已隔离] C:\Documents and Settings\Administrator\桌面\病毒2\DbgHlp32.exe2
[发现安全风险? <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)> C:\Documents and Settings\Administrator\桌面\病毒2\mfchlp32.exe2->(UPack)
[已隔离] C:\Documents and Settings\Administrator\桌面\病毒2\mfchlp32.exe2->(UPack)
[发现安全风险? <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)> C:\Documents and Settings\Administrator\桌面\病毒2\MsIMMs32.exE2->(UPack)
[已隔离] C:\Documents and Settings\Administrator\桌面\病毒2\MsIMMs32.exE2->(UPack)

显示全部楼层 · 发表于 2008-4-18 11:41:23

信息 2008-04-18  11:40:58 您此次查毒清除了4个病毒
信息 2008-04-18  11:40:58 您此次查毒共查出4个病毒以及危险代码
信息 2008-04-18  11:40:58 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件13个
信息 2008-04-18  11:40:58 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-04-18  11:40:58 D:\Desktop\micross25.rar\micross25.exe2 Win32.Hack.Small.344064 清除成功
病毒 2008-04-18  11:40:58 D:\Desktop\2¡¶¾2.rar\MsIMMs32.exE2 Win32.Hack.UpackT.a.15981 清除成功
病毒 2008-04-18  11:40:58 D:\Desktop\2¡¶¾2.rar\mfchlp32.exe2 Win32.PSWTroj.OnLineGames.17276 清除成功
病毒 2008-04-18  11:40:58 D:\Desktop\2¡¶¾2.rar\DbgHlp32.exe2 Win32.Troj.OnlineGameT.bd.65697 清除成功

显示全部楼层 · 发表于 2008-4-18 12:55:27

Hello,

b3b4f3ed78981391171.bat_,
b3b4f3ed78981486609.bat_,
d2b282ef026d1448906.bat_,
_uninsep.bat_

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Dmitry Shvetsov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

显示全部楼层 · 发表于 2008-4-18 13:16:45

显示全部楼层 · 发表于 2008-4-18 17:03:11

发现未知间谍软件，是否删除？
程序:
E:\DBGHLP32.EXE
木马程序生成以下文件:
1) C:\WINDOWS\DBGHLP32.EXE
2) C:\WINDOWS\SYSTEM32\DBGHLP32.DLL
是否删除木马程序及其衍生物?

木马名称:Backdoor.Win32.Small.xx

程序:
E:\MICROSS25.EXE2
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-4-18 18:27:42

SEP只报了两个Infostealer.Gampass

[病毒样本] 7

本帖子中包含更多资源

4

本帖子中包含更多资源