Rookit,downloader,Trojan

显示全部楼层 · 发表于 2008-5-5 00:09:27

部分主流杀软不报

[ 本帖最后由 yk1234 于 2008-6-20 08:38 编辑 ]

显示全部楼层 · 发表于 2008-5-5 00:25:10

不好意思，打包太多，大家如果发现没报的就直接上报，不必一个一个文件的回复了。

显示全部楼层 · 发表于 2008-5-5 02:26:38

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\rookit'
C:\Documents and Settings\morgan\My Documents\rookit\
  acpidisk.sys
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [NOTE]    The file was deleted!
  apcdli.sys
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [NOTE]    The file was deleted!
  beep.sys
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.nsq
   [NOTE]    The file was deleted!
  cdfview.dll
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/Dldr.Agent.nsq
         [WARNING] Infected files in archives cannot be repaired!
   [NOTE]    The file was deleted!
  d.exe
  d81.dll
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/BDSearch.1.18
   [NOTE]    The file was deleted!
  dodolook652.exe
  e21.exe
   [DETECTION] Contains detection pattern of the dropper DR/Drop.Agent.qoa.2
   [NOTE]    The file was deleted!
  ntfs32p.dll
   [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
   [NOTE]    The file was deleted!

End of the scan: 2008年5月4日  11:26
Used time: 00:04 min

The scan has been done completely.

   1 Scanning directories
   9 Files were scanned
   7 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   7 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   0 Archives were scanned
   1 Warnings
   7 Notes

显示全部楼层 · 发表于 2008-5-5 02:26:58

剩下两个nsis。。
吐血上报中。。

显示全部楼层 · 发表于 2008-5-5 07:46:46

信息 2008-05-05  07:46:30 您此次查毒清除了3个病毒
信息 2008-05-05  07:46:30 您此次查毒共查出4个病毒以及危险代码
信息 2008-05-05  07:46:30 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件19个
信息 2008-05-05  07:46:30 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
风险程序 2008-05-05  07:46:30 D:\Desktop\rookit.rar\acpidisk.sys Win32.Adware.CinmusT.by.181252 跳过，未处理
病毒 2008-05-05  07:46:27 D:\Desktop\rookit.rar\apcdli.sys Win32.Troj.CinmusT.dm.198212 清除成功
病毒 2008-05-05  07:46:25 D:\Desktop\downloader.rar\cdfview.dll Win32.Troj.OnlineGames.aw.106496 清除成功
病毒 2008-05-05  07:46:24 D:\Desktop\downloader.rar\beep.sys Win32.TrojDownloader.Agent.16384 清除成功

显示全部楼层 · 发表于 2008-5-5 07:53:52

木马名称:Trojan-Downloader.Win32.Agent.skx

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\BEEP.SYS
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-5-5 10:10:50

第四个为特洛伊木马，其余为广告软件。卡巴8.0.0.357报。

显示全部楼层 · 发表于 2008-5-5 10:15:52

Scan Log
Version of virus signature database: 3073 (20080505)
Date: 2008-5-5 Time: 10:17:17
Scanned disks, folders and files: D:\firefox download\d81.rar;D:\firefox download\downloader.rar;D:\firefox download\ntfs32p.rar;D:\firefox download\rookit.rar;D:\firefox download\dodolook652.rar;D:\firefox download\d.rar
D:\firefox download\d81.rar » RAR » d81.dll - is OK
D:\firefox download\d81.rar:Zone.Identifier - is OK
D:\firefox download\downloader.rar » RAR » beep.sys - Win32/PSW.OnLineGames.OAC trojan - was a part of the deleted object
D:\firefox download\downloader.rar » RAR » cdfview.dll - probably a variant of Win32/Genetik trojan - was a part of the deleted object
D:\firefox download\ntfs32p.rar » RAR » ntfs32p.dll » PECompact v2.xx - is OK
D:\firefox download\ntfs32p.rar:Zone.Identifier - is OK
D:\firefox download\rookit.rar » RAR » acpidisk.sys - probably a variant of Win32/Adware.Cinmus application - was a part of the deleted object
D:\firefox download\rookit.rar » RAR » apcdli.sys - is OK
D:\firefox download\dodolook652.rar » RAR » dodolook652.exe » NSIS » Entries.bin - is OK
D:\firefox download\dodolook652.rar » RAR » dodolook652.exe » NSIS » Strings.txt - is OK
D:\firefox download\dodolook652.rar » RAR » dodolook652.exe » NSIS » System.dll - is OK
D:\firefox download\dodolook652.rar » RAR » dodolook652.exe » NSIS » 8.exe » NSIS » Entries.bin - is OK
D:\firefox download\dodolook652.rar » RAR » dodolook652.exe » NSIS » 8.exe » NSIS » Strings.txt - is OK
D:\firefox download\dodolook652.rar » RAR » dodolook652.exe » NSIS » 8.exe » NSIS » System.dll - is OK
D:\firefox download\dodolook652.rar » RAR » dodolook652.exe » NSIS » 8.exe » NSIS » DoSSSetup.dll - is OK
D:\firefox download\dodolook652.rar » RAR » dodolook652.exe » NSIS » 8.exe » NSIS » acpidisk.sys - probably a variant of Win32/Adware.Cinmus application - was a part of the deleted object
D:\firefox download\dodolook652.rar » RAR » e21.exe » NSIS » Entries.bin - is OK
D:\firefox download\dodolook652.rar » RAR » e21.exe » NSIS » Strings.txt - is OK
D:\firefox download\dodolook652.rar » RAR » e21.exe » NSIS » mscomfix16.exe - a variant of Win32/TrojanDownloader.QQHelper.NEZ trojan - was a part of the deleted object
D:\firefox download\dodolook652.rar » RAR » e21.exe » NSIS » an.exe - is OK
D:\firefox download\d.rar » RAR » d.exe » NSIS » Entries.bin - is OK
D:\firefox download\d.rar » RAR » d.exe » NSIS » Strings.txt - is OK
D:\firefox download\d.rar » RAR » d.exe » NSIS » System.dll - is OK
D:\firefox download\d.rar » RAR » d.exe » NSIS » 12.exe » NSIS » Entries.bin - is OK
D:\firefox download\d.rar » RAR » d.exe » NSIS » 12.exe » NSIS » Strings.txt - is OK
D:\firefox download\d.rar » RAR » d.exe » NSIS » 12.exe » NSIS » System.dll - is OK
D:\firefox download\d.rar » RAR » d.exe » NSIS » 12.exe » NSIS » DoSSSetup.dll - is OK
D:\firefox download\d.rar » RAR » d.exe » NSIS » 12.exe » NSIS » acpidisk.sys - probably a variant of Win32/Adware.Cinmus application - was a part of the deleted object
Number of scanned objects: 28
Number of threats found: 6
Number of cleaned objects: 6
Time of completion: 10:17:32 Total scanning time: 15 sec (00:00:15)

显示全部楼层 · 发表于 2008-5-5 20:07:13

显示全部楼层 · 发表于 2008-5-5 20:09:27

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Undef.fzh

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.43.02

[病毒样本] Rookit,downloader,Trojan

本帖子中包含更多资源

本帖子中包含更多资源

36/3