看看这个样本,

显示全部楼层 · 发表于 2008-5-8 15:09:20

这病毒会破坏u盘等移动存储所有.exe的文件,且不能修复

显示全部楼层 · 发表于 2008-5-8 15:11:18

Starting the file scan:

Begin scan in 'E:\AV\bingdu.rar'
E:\AV\bingdu.rar
  [0] Archive type: RAR
  --> bingdu\explorcr.exe
   [DETECTION] Contains detection pattern of the worm WORM/Autorun.cns.1
  --> bingdu\ha_cpu-z.exe
   [DETECTION] Contains detection pattern of the worm WORM/Autorun.cns.1
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-5-8 15:11:22

卡巴斯基互联网安全套装 7.0

The requested URL http://bbs.kafan.cn/attachment.p ... 59&t=1210230636 is infected with Worm.Win32.AutoRun.cns virus

显示全部楼层 · 发表于 2008-5-8 15:11:40

C:\Documents and Settings\Administrator\桌面\bingdu.rar>>bingdu\AutoRun.inf INF.Autorun.b 病毒还未处理
C:\Documents and Settings\Administrator\桌面\bingdu.rar>>bingdu\explorcr.exe TrojanDownloader.AutoIt.co.oxnp 木马还未处理
C:\Documents and Settings\Administrator\桌面\bingdu.rar>>bingdu\ha_cpu-z.exe TrojanDownloader.AutoIt.co.oxnp 木马还未处理

显示全部楼层 · 发表于 2008-5-8 15:14:16

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\bingdu.rar'
C:\Documents and Settings\morgan\My Documents\
  bingdu.rar
[0] Archive type: RAR
--> bingdu\AutoRun.inf
--> bingdu\explorcr.exe
      [DETECTION] Contains detection pattern of the worm WORM/Autorun.cns.1
--> bingdu\ha_cpu-z.exe
      [DETECTION] Contains detection pattern of the worm WORM/Autorun.cns.1
   [NOTE]    The file was deleted!

End of the scan: 2008年5月8日  00:14
Used time: 00:03 min

The scan has been done completely.

   0 Scanning directories
   4 Files were scanned
   2 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2008-5-8 15:31:58

蠕虫名称:Worm.Win32.AutoRun.asb

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\BINGDU\EXPLORCR.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

蠕虫名称:Worm.Win32.AutoRun.asb

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\BINGDU\HA_CPU-Z.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-5-8 15:49:40

金山 0

信息 2008-05-08  15:49:26 您此次查毒清除了1个病毒
信息 2008-05-08  15:49:26 您此次查毒共查出1个病毒以及危险代码
信息 2008-05-08  15:49:26 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件8个
信息 2008-05-08  15:49:26 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-05-08  15:49:25 D:\Desktop\bingdu.rar\bingdu\AutoRun.inf VBS.AutoRun.xj.139 清除成功

显示全部楼层 · 发表于 2008-5-8 15:50:27

EAV

D:\病毒样本\bingdu.rar > RAR > bingdu\AutoRun.inf - Win32/Autoit.CA 蠕虫
D:\病毒样本\bingdu.rar > RAR > bingdu\explorcr.exe - Win32/Autoit.CA 蠕虫
D:\病毒样本\bingdu.rar > RAR > bingdu\ha_cpu-z.exe - Win32/Autoit.CA 蠕虫

显示全部楼层 · 发表于 2008-5-8 15:57:55

W32.SillyDC
病毒 ID: 11498
类型: 已压缩
风险: 高 (高隐蔽性，高清除可能，高性能，高隐私)
类别: 病毒
状态: 删除失败
-----------
1 文件
[explorcr.exe] 位于[d:\users\ekincheng\desktop\bingdu.rar] - 已感染

W32.SillyDC
病毒 ID: 11498
类型: 已压缩
风险: 高 (高隐蔽性，高清除可能，高性能，高隐私)
类别: 病毒
状态: 删除失败
-----------
1 文件
[ha_cpu-z.exe] 位于[d:\users\ekincheng\desktop\bingdu.rar] - 已感染

显示全部楼层 · 发表于 2008-5-8 16:17:45

已受感染文件 c:\docume~1\admini~1\桌面\bingdu\explorcr.exe
已移除特洛伊木马 AutoRun.DGH
已受感染文件 c:\docume~1\admini~1\桌面\bingdu\autorun.inf
已移除特洛伊木马 BAT/Autorun.AY
已受感染文件 c:\docume~1\admini~1\桌面\bingdu\ha_cpu-z.exe
已移除特洛伊木马 AutoRun.DGH

[病毒样本] 看看这个样本,

本帖子中包含更多资源