几个样本，大家可以看看。

显示全部楼层 · 发表于 2008-4-20 21:43:31

原帖由 tvuser2007 于 2008-4-20 21:41 发表

但是如果设置好了主防规则也是很好用的~[:1:]

问题机器一般使用的是默认的设置。

显示全部楼层 · 发表于 2008-4-20 21:45:02

C:\Documents and Settings\Don johnson\桌面\zheijnj.rar » RAR » zheijnj.exe - probably a variant of Win32/TrojanDownloader.QQHelper.KX trojan
C:\Documents and Settings\Don johnson\桌面\qdrv.rar » RAR » qdrv.dll - Win32/Adware.Boran application
C:\Documents and Settings\Don johnson\桌面\taxfd.rar » RAR » taxfd.exe - probably a variant of Win32/Adware.Agent application

显示全部楼层 · 发表于 2008-4-20 21:49:12

Begin scan in 'C:\Documents and Settings\桌面\qdrv.rar'
C:\Documents and Settings\桌面\qdrv.rar
  [0] Archive type: RAR
  --> qdrv.dll
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Boran.EJ
   [NOTE]    The file was deleted!
Begin scan in 'C:\Documents and Settings\桌面\taxfd.rar'
C:\Documents and Settings\桌面\taxfd.rar
  [0] Archive type: RAR
  --> taxfd.exe
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Agent.adh
   [NOTE]    The file was deleted!
Begin scan in 'C:\Documents and Settings\桌面\710a.rar'
C:\Documents and Settings\桌面\710a.rar
  [0] Archive type: RAR
  --> 710a.exe
   [DETECTION] Is the Trojan horse TR/Agent.49152
   [NOTE]    The file was deleted!
Begin scan in 'C:\Documents and Settings\桌面\zheijnj.rar'
C:\Documents and Settings\桌面\zheijnj.rar
  [0] Archive type: RAR
  --> zheijnj.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-4-20 22:21:40

小红伞杀一个,微点杀了两个,只有一个微点不报

显示全部楼层 · 发表于 2008-4-20 22:28:59

Hello,

710a.exe_ - Trojan.Win32.Agent.kmx,
zheijnj.exe_ - Trojan.Win32.Obfuscated.yp

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: virus.zip

>
>

显示全部楼层 · 发表于 2008-4-20 22:34:35

那个不报的我,我运行了,不能删除 ,最后用暴力删除的删了

显示全部楼层 · 发表于 2008-4-21 10:30:00

D:\firefox download\zheijnj.rar > RAR > zheijnj.exe - 可能是 Win32/TrojanDownloader.QQHelper.KX 特洛伊木马的变种 - 是已删除对象的一部分
D:\firefox download\qdrv.rar > RAR > qdrv.dll - Win32/Adware.Boran 应用程序 - 是已删除对象的一部分
D:\firefox download\taxfd.rar > RAR > taxfd.exe - 可能是 Win32/Adware.Agent 应用程序的变种 - 是已删除对象的一部分
D:\firefox download\710a.rar > RAR > 710a.exe - 正常
D:\firefox download\710a.rar:Zone.Identifier - 正常

显示全部楼层 · 发表于 2008-4-21 10:31:03

2008-4-21 10:32:54 内核文件 'D:\firefox download\710a.rar' 已发送到 ESET 进行分析。

显示全部楼层 · 发表于 2008-4-21 10:39:15

微点仅报了远程连接，拒绝连接后没发现有添加启动项哦。。

C:\WINDOWS\1C.TMP
协议类型:TCP
本地地址:0.0.0.0
本地端口:3648
远端地址:219.148.34.7(河北·石家庄)
远端端口:80

显示全部楼层 · 发表于 2008-4-21 11:44:36

木马名称:Trojan-PSW.Win32.OnLineGame.hky
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\QDRV\QDRV.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

广告软件名称:AdWare.Win32.Agent.bsl
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TAXFD\TAXFD.EXE
是广告软件!
已成功阻止其运行,是否要删除此文件?

[病毒样本] 几个样本，大家可以看看。

3

本帖子中包含更多资源