9

sam.to

不报的已上报卡巴

已刪除: 病毒 Worm.Win32.AutoRun.dld        檔案: C:\Documents and Settings\kato9096\桌面\7.exe2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Losabel.iq        檔案: C:\Documents and Settings\kato9096\桌面\9.exe2//PE_Patch.PECompact//PecBundle//PECompact

Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.
-----------------
Regards, Namestnikov Yury
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com

[ 本帖最后由 kato9096 于 2008-5-3 20:33 编辑 ]

The EQs

C:\Documents and Settings\Don Johnson\桌面\9.zip » ZIP » 5.exe2 - probably unknown NewHeur_PE virus
C:\Documents and Settings\Don Johnson\桌面\9.zip » ZIP » 6.exe2 - probably unknown NewHeur_PE virus
C:\Documents and Settings\Don Johnson\桌面\9.zip » ZIP » 7.exe2 - a variant of Win32/Mypis.AH virus
C:\Documents and Settings\Don Johnson\桌面\9.zip » ZIP » 9.exe2 - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don Johnson\桌面\9.zip » ZIP » 1.exe2 - probably a variant of Win32/Genetik trojan

wangjay1980

K

红心王子

蠕虫名称:Worm.Win32.AutoRun.bzo

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\7.EXE2
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

allinwonderi

[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\9.zip<ZIP>:5.exe2<UPack>:5.exe2<DLLRES>:1.exe<UPX>:1.exe <- Trojan.Dropper.Small.Bkq : No action
C:\Documents and Settings\All Users\Documents\Test\9.zip<ZIP>:5.exe2<UPack>:5.exe2<DLLRES>:1.exe<UPX>:1.exe<DLLRES>:res0.exe <- Trojan.Clicker.Small.Ug : No action
C:\Documents and Settings\All Users\Documents\Test\9.zip<ZIP>:5.exe2<UPack>:5.exe2<DLLRES>:1.exe<UPX>:1.exe<DLLRES>:res3.exe <- Trojan.Clicker.Small.Uh : No action
C:\Documents and Settings\All Users\Documents\Test\9.zip<ZIP>:7.exe2<UPack>:7.exe2 <- W32.Dr.Agent.Bsv : No action



Scanned objects : 22

Infected objects : 4

allinwonderi

Found possible security risk]        <W32/Heuristic-210!Eldorado (damaged, not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\9.zip->5.exe2->(UPack)
[Found downloader]        <W32/Downloader.D.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\9.zip->8.exe2
[Found possible security risk]        <W32/Heuristic-210!Eldorado (damaged, not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\9.zip->7.exe2->(UPack)
[Found downloader]        <W32/Downloader.N.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\All Users\Documents\Test\9.zip->9.exe2->(PecBundle)->(PECompact)->(PecBundle)->(Klone.AF)
[Found possible security risk]        <W32/Heuristic-210!Eldorado (not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\9.zip->1.exe2->(UPX)->(Klone.AF)

---------------------------------------------------------------------
Scan ended:        2008-5-2, 20:05:27
Duration:        0:00:02

Scan result:

Scanned files:                 6
Infected objects:         5
Disinfected objects:         0
Quarantined files:         0
---------------------------------------------------------------------

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Dropper.Win32.Agent.zjs  
病毒： Suspicious.Trojan.Win32.VBDownLoader.a

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.42.40

微点卫士

蠕虫名称:Worm.Win32.AutoRun.bzo

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\桌面\7.EXE2
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Dropper.Win32.Small.bmu

程序:
C:\WINDOWS\SVCHOS.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\桌面\5.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SVCPOS.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\桌面\1.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\EXPLORE.EXE
2) C:\WINDOWS\SYSTEM32\DRIVERS\BEEP.SYS
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\桌面\8.EXE
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\桌面\8.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\桌面\9.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\VISTAA.EXE
2) C:\WINDOWS\SYSTEM32\VISTAA.EXE
是否删除木马程序及其衍生物?


2,3是死的

28654621

D:\download\9.zip>>5.exe2        Dropper.Agent.zjs.ctcq        病毒        还未处理
D:\download\9.zip>>6.exe2        Heuri.Suspicious.ERNM        启发式扫描        还未处理
D:\download\9.zip>>8.exe2        TrojanDownloader.Gen.wuky        木马        还未处理
D:\download\9.zip>>7.exe2        Worm.Cekar.A.cleg        病毒        还未处理
D:\download\9.zip>>1.exe2        Trojan.Yzprkv.lnqy        木马        还未处理

hj5abc

4

Sign of "Win32:Small-KAZ [Trj]" has been found in "F:\9.zip\5.exe2\[Upack]\[Embedded#URLMM]\[UPX]" file.  
Sign of "Win32:Agent-URN [Trj]" has been found in "F:\9.zip\6.exe2\[FSG]" file.  
Sign of "Win32:AutoRun-ACK [Wrm]" has been found in "F:\9.zip\7.exe2\[Upack]" file.  
Sign of "Win32:Agent-UWD [Trj]" has been found in "F:\9.zip\1.exe2\[UPX]" file.