再接再厉~SXS.exe病毒样本

Kitman

Start of the scan: 2008年5月1日  20:29

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\virus.rar'
Begin scan in 'C:\Documents and Settings\Administrator\桌面\sxs.rar'
C:\Documents and Settings\Administrator\桌面\sxs.rar
  [0] Archive type: RAR
  --> sxs\sxs.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSAnti.Gen
  --> sxs\autorun.inf
      [DETECTION] Is the Trojan horse TR/PWS.Banker.71
      [NOTE]      A backup was created as '488cb831.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
Sent to Aviralab

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\sxs'
C:\Documents and Settings\Administrator\My Documents\sxs\
  autorun.inf
      [DETECTION] Is the Trojan horse TR/PWS.Banker.71
      [NOTE]      The file was deleted!
  SVOHOST.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQRob.FZ.5
      [NOTE]      The file was deleted!
  SVOHOST.EXE-2FA3EB46.pf
  sxs.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQRob.FZ.5
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\My Documents\sxs\sxs\
  autorun.inf
      [DETECTION] Is the Trojan horse TR/PWS.Banker.71
      [NOTE]      The file was deleted!
  sxs.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSAnti.Gen
      [NOTE]      The file was deleted!
  除了c盘其他分区都有隐藏的sxs文件.txt


End of the scan: 2008年5月1日  07:49
Used time: 00:04 min

The scan has been done completely.

      2 Scanning directories
      7 Files were scanned
      5 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      5 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      0 Archives were scanned
      0 Warnings
      5 Notes

红心王子

木马名称:Trojan-PSW.Win32.QQPass.aza

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIR\SXS\SXS.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.QQPass.ahr

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIR\SVOHOST.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.QQPass.ahr

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIR\SXS.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

hj5abc

Sign of "Win32:Trojan-gen {Other}" has been found in "F:\system32.rar\SVOHOST.exe" file.  
Sign of "Win32:Trojan-gen {Other}" has been found in "F:\sxs.rar\sxs.exe" file.  
Sign of "VBS:Malware-gen" has been found in "F:\sxs.rar\autorun.inf" file.