禽兽病毒样本

capsshift

什么毒啊，这么差，每个杀软都能杀。

sharkkong

PRODNAME1
PRODNAME2
访问被拒绝
找不到所请求的 URL

在尝试检索 URL 时:

http://bbs.kafan.cn/attachment.php?aid=
259353&k=78fce92ea02f548a04bf5f68a793844
c&t=1210229573

遇到了下列错误:

所请求的对象已被感染了下列病毒: Virus.Win32.AutoRun.su


如果您认为这是不正确的,请联系您的服务提供商。
生成于:
Thu May 08 14:53:53 2008
Kaspersky Internet Security 2009

失翼天使

已受感染 文件 c:\docume~1\admini~1\桌面\新建文~1\autorun.inf
已移除 特洛伊木马 BAT/AutoRun.AE
已受感染 文件 c:\docume~1\admini~1\桌面\新建文~1\niu.exe
已移除 病毒 Suspicious_F.gen

tanlimo

创建windows\system32\crsss.exe

主要行为：
windows\system32\crsss.exe

Attempt to set value Cache within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\
Attempt to set value Cookies within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\

windows\system32\reg.exe

Attempt to set value crsss within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Attempt to create new key HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate\
Attempt to create new key HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\
Attempt to set value CheckedValue within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\
Attempt to delete key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\
Attempt to set value Text within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN\
Attempt to set value CheckedValue within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN\
Attempt to delete key HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}\
Attempt to create new key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe\
Attempt to create new key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\
Attempt to create new key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\
Attempt to create new key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe\
Attempt to create new key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe\
Attempt to create new key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe\
Attempt to create new key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe\
略..........

windows\system32\conime.exe

Attempt to attach to the thread input of the C:\WINDOWS\System32\CSRSS.EXE
Attempt to detach from the thread input of the C:\WINDOWS\System32\CSRSS.EXE

Palkia

在 C:\Documents and Settings\Administrator\桌面\20071029221124879.rar->新建文件夹 (2)\autorun.inf 中发现 Trojan/INF.ck 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\20071029221124879.rar->新建文件夹 (2)\niu.exe 中发现 Trojan/KillAV.ag 病毒, 已删除

wangjay1980

楼主今天让我们重温了老毒

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Worm.Win32.Autorun.iqo   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.43.32

allinwonderi

[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\20071029221124879.rar<RAR>:niu.exe<FSG>:niu.exe <- Trojan.Autorun.Su : No action



Scanned objects : 4

Infected objects : 1

BING126

McAfee    autorun.inf   Generic!atr
                niu.exe     QHosts-14