3:偽JPG和BMP图标

显示全部楼层 · 发表于 2008-4-22 21:38:55

上报卡巴

Hello,

a.exe_ - Trojan-PSW.Win32.Magania.lsk,
b.scr_, c.scr_ - Trojan.BAT.KillAV.iz

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-4-23 18:58 编辑 ]

显示全部楼层 · 发表于 2008-4-22 21:42:54

信息 2008-04-22  21:42:49 您此次查毒共查出5个病毒以及危险代码
信息 2008-04-22  21:42:49 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件39个
信息 2008-04-22  21:42:49 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-04-22  21:42:49 D:\Desktop\3\3\c.scr3\BindFile\未命名.scr\BindFile\SvrTray.exe Win32.Hack.Huigezi.cz 跳过，未处理
病毒 2008-04-22  21:42:49 D:\Desktop\3\3\c.scr3\BindFile\未命名.scr\BindFile\jxonline.exe\BindFile\SvrTray.exe Win32.Hack.Huigezi.cz 跳过，未处理
病毒 2008-04-22  21:42:49 D:\Desktop\3\3\b.scr2\BindFile\未命名.scr\BindFile\SvrTray.exe Win32.Hack.Huigezi.cz 跳过，未处理
病毒 2008-04-22  21:42:49 D:\Desktop\3\3\b.scr2\BindFile\未命名.scr\BindFile\jxonline.exe\BindFile\SvrTray.exe Win32.Hack.Huigezi.cz 跳过，未处理
病毒 2008-04-22  21:42:49 D:\Desktop\3\3\a.exe2\BindFile\29.exe Win32.Hack.NSAnti.ge 跳过，未处理

显示全部楼层 · 发表于 2008-4-22 21:47:30

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Packer.Win32.Mian007.a
病毒： Backdoor.Win32.Gpigeon2007.mfx

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.41.12

显示全部楼层 · 发表于 2008-4-22 21:56:43

TO AB

显示全部楼层 · 发表于 2008-4-22 21:59:05

McAfee只殺了一隻

显示全部楼层 · 发表于 2008-4-22 22:00:14

C:\Documents and Settings\Don johnson\桌面\3\3\b.scr2 » RAR » 未命名.scr » RAR » jxonline.exe » RAR » SvrTray.exe - probably a variant of Win32/Hupigon trojan
C:\Documents and Settings\Don johnson\桌面\3\3\b.scr2 » RAR » 未命名.scr » RAR » SvrTray.exe - probably a variant of Win32/Hupigon trojan
C:\Documents and Settings\Don johnson\桌面\3\3\c.scr3 » RAR » 未命名.scr » RAR » jxonline.exe » RAR » SvrTray.exe - probably a variant of Win32/Hupigon trojan
C:\Documents and Settings\Don johnson\桌面\3\3\c.scr3 » RAR » 未命名.scr » RAR » SvrTray.exe - probably a variant of Win32/Hupigon trojan

显示全部楼层 · 发表于 2008-4-22 22:57:26

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\3'
C:\Documents and Settings\Administrator\My Documents\3\3\
  a.exe2
[0] Archive type: RAR SFX (self extracting)
   --> ﾦﾶﾼwﾱeﾺﾩﾵe.exe
      [1] Archive type: RAR SFX (self extracting)
      --> ﾦﾶﾼwﾱeﾺﾩﾵe.jpg
--> 29.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [NOTE]    The file was deleted!
  b.scr2
[0] Archive type: RAR SFX (self extracting)
--> ser.bat
--> ser.vbs
--> ￎﾴￃￃ￻.jpg
   --> ￎﾴￃￃ￻.scr
      [1] Archive type: RAR SFX (self extracting)
      --> ser.bat
      --> jxonline.exe
      [2] Archive type: RAR SFX (self extracting)
      --> ser.bat
      --> ser.vbs
      --> jx.exe
      --> SvrTray.exe
         [3] Archive type: RSRC
         --> Object
      --> SvrTray.exe
      [2] Archive type: RSRC
      --> Object
   [NOTE]    The file was deleted!
  c.scr3
[0] Archive type: RAR SFX (self extracting)
--> ser.bat
--> ser.vbs
   --> ￎﾴￃￃ￻.scr
      [1] Archive type: RAR SFX (self extracting)
      --> ser.bat
      --> jxonline.exe
      [2] Archive type: RAR SFX (self extracting)
      --> ser.bat
      --> ser.vbs
      --> jx.exe
      --> SvrTray.exe
         [3] Archive type: RSRC
         --> Object
      --> SvrTray.exe
      [2] Archive type: RSRC
      --> Object
--> ￎﾴￃￃ￻.jpg
   [NOTE]    The file was deleted!

End of the scan: 2008年4月22日  07:57
Used time: 00:04 min

The scan has been done completely.

   2 Scanning directories
   28 Files were scanned
   5 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   3 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   23 Files not concerned
   8 Archives were scanned
   0 Warnings
   3 Notes

显示全部楼层 · 发表于 2008-4-22 23:08:52

程序:
D:\3\C.SCR
木马程序生成以下文件:
1) C:\WINDOWS\SVCHOCT.EXE
2) C:\WINDOWS\SVCHOCT.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-4-22 23:16:21

[Found backdoor] <W32/Hupigon.A.gen!Eldorado (not disinfectable, generic)> C:\test\3\b.scr2->(RAR)->未命名.scr->(RAR)->jxonline.exe->(RAR)->SvrTray.exe->rsrcPE
[Found backdoor] <W32/Hupigon.A.gen!Eldorado (not disinfectable, generic)> C:\test\3\b.scr2->(RAR)->未命名.scr->(RAR)->SvrTray.exe->rsrcPE
[Found backdoor] <W32/Hupigon.A.gen!Eldorado (not disinfectable, generic)> C:\test\3\c.scr3->(RAR)->未命名.scr->(RAR)->jxonline.exe->(RAR)->SvrTray.exe->rsrcPE
[Found backdoor] <W32/Hupigon.A.gen!Eldorado (not disinfectable, generic)> C:\test\3\c.scr3->(RAR)->未命名.scr->(RAR)->SvrTray.exe->rsrcPE

显示全部楼层 · 发表于 2008-4-23 00:59:28

卡巴无视

[病毒样本] 3:偽JPG和BMP图标

本帖子中包含更多资源

31/5