U盘病毒

显示全部楼层 · 发表于 2008-4-21 17:18:26

映像劫持，联网，驱动，关闭冰刃，sreng等工具，gmer在非安全模式下也会被他的进程守护打败。幸好还有个狙剑，靠狙剑的主防控制他的两个进程，用gmer删掉文件。

[ 本帖最后由袋鼠吱吱于 2008-4-21 17:19 编辑 ]

显示全部楼层 · 发表于 2008-4-21 17:22:05

Scanned file: zip.rar
zip.rar/oubnmt.exe - OK
zip.rar/mktltpi.exe - OK
zip.rar/ose.exe - OK
zip.rar/jcfshej.exe - OK
zip.rar/oreans32.sys - OK

上报卡巴

显示全部楼层 · 发表于 2008-4-21 17:24:49

Begin scan in 'E:\VIRUS\zip.rar'
E:\VIRUS\zip.rar
  [0] Archive type: RAR
  --> oubnmt.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
  --> mktltpi.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
  --> jcfshej.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [WARNING] The file was ignored!

End of the scan: 2008年4月21日  17:22
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   6 Files were scanned
   3 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-4-21 17:24:56

[Found security risk] <W32/AutoRun.B.gen!Eldorado (not disinfectable, generic)> C:\test\zip.rar->oubnmt.exe
[Found security risk] <W32/AutoRun.B.gen!Eldorado (not disinfectable, generic)> C:\test\zip.rar->mktltpi.exe
[Found security risk] <W32/AutoRun.B.gen!Eldorado (not disinfectable, generic)> C:\test\zip.rar->jcfshej.exe

显示全部楼层 · 发表于 2008-4-21 17:25:29

C:\Documents and Settings\Don johnson\桌面\zip.rar » RAR » oubnmt.exe - probably a variant of Win32/Delf.NDF worm
C:\Documents and Settings\Don johnson\桌面\zip.rar » RAR » mktltpi.exe - probably a variant of Win32/Delf.NDF worm
C:\Documents and Settings\Don johnson\桌面\zip.rar » RAR » jcfshej.exe - probably a variant of Win32/Delf.NDF worm

显示全部楼层 · 发表于 2008-4-21 17:26:17

21:04:2008 17:23:51 SEARCHTASK "USER_DEFINED" started...
scan item: E:\VIRUS\zip
Directory scanned(filestreams): E:\VIRUS\zip
File scanned: E:\VIRUS\zip\jcfshej.exe - SIGNATURE FOUND "Trojan-Spy.Win32.Delf.ma"
File scanned: E:\VIRUS\zip\mktltpi.exe - SIGNATURE FOUND "Trojan-Spy.Win32.Delf.ma"
File scanned: E:\VIRUS\zip\oreans32.sys
File scanned: E:\VIRUS\zip\ose.exe
File scanned: E:\VIRUS\zip\oubnmt.exe - SIGNATURE FOUND "Trojan-Spy.Win32.Delf.ma"
21:04:2008 17:23:51 SEARCHTASK "USER_DEFINED" FINISHED...
----------------------------------------------------
Directories scanned: 1
Files scanned: 5
Virus found: 3
----------------------------------------------------

显示全部楼层 · 发表于 2008-4-21 17:27:30

D:\firefox download\zip.rar > RAR > oubnmt.exe - 可能是 Win32/Delf.NDF 蠕虫的变种 - 是已删除对象的一部分
D:\firefox download\zip.rar > RAR > mktltpi.exe - 可能是 Win32/Delf.NDF 蠕虫的变种 - 是已删除对象的一部分
D:\firefox download\zip.rar > RAR > ose.exe - 正常
D:\firefox download\zip.rar > RAR > jcfshej.exe - 可能是 Win32/Delf.NDF 蠕虫的变种 - 是已删除对象的一部分
D:\firefox download\zip.rar > RAR > oreans32.sys - 正常

显示全部楼层 · 发表于 2008-4-21 17:52:04

已删除：木马程序 Trojan-Downloader.Win32.Losabel.gk 文件: D:\临时文件\zip.rar/oubnmt.exe
已删除：木马程序 Trojan-Downloader.Win32.Losabel.gk 文件: D:\临时文件\zip.rar/mktltpi.exe
已删除：木马程序 Trojan-Downloader.Win32.Losabel.gk 文件: D:\临时文件\zip.rar/jcfshej.exe

显示全部楼层 · 发表于 2008-4-21 18:04:28

里头有三个是一样的

显示全部楼层 · 发表于 2008-4-21 18:14:05

这个过微点有点困难，装微点的朋友看下

[病毒样本] U盘病毒

本帖子中包含更多资源

IK