ghost.exe病毒

youba

各盘根目录生成 ghost.exe autorun.inf 具体现象不明，总体导致电脑很不稳定。

Starting the file scan:

Begin scan in 'E:\AV\ghost病毒样本.rar'
E:\AV\ghost病毒样本.rar
  [0] Archive type: RAR
  --> ghost.exe
      [DETECTION] Contains detection pattern of the worm WORM/Delf.BG.1
      [NOTE]      The file was deleted!

a87750530

红伞查杀

Avira AntiVir Premium
of the scan: 2008年5月8日  15:27

Starting the file scan:

Begin scan in 'C:\Documents and Settings\cxsh\桌面\ghost病毒样本.rar'
C:\Documents and Settings\cxsh\桌面\ghost病毒样本.rar
  [0] Archive type: RAR
  --> ghost.exe
      [DETECTION] Contains detection pattern of the worm WORM/Delf.BG.1
      [NOTE]      A backup was created as '4891abcb.qua'  ( QUARANTINE )
      [NOTE]      The file was successfully wiped!
      [NOTE]      The file was deleted!


End of the scan: 2008年5月8日  15:27
Used time: 00:03 min

[ 本帖最后由 a87750530 于 2008-5-8 15:32 编辑 ]

红心王子

蠕虫名称:Worm.Win32.Delf.bt

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\GHOST.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

gallant2006

厉害，，不知道什么东西！看看！

shixinlong044

太没意思了，我的诺顿刚装的，还是一月份的库，都能杀掉

挪威的冬天

信息        2008-05-08  15:44:41        您此次查毒清除了1个病毒                       
信息        2008-05-08  15:44:41        您此次查毒共查出1个病毒以及危险代码                       
信息        2008-05-08  15:44:41        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件3个                       
信息        2008-05-08  15:44:41        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-05-08  15:44:41        D:\Desktop\ghost2¡¶¾Ñù±¾.rar\ghost.exe        Worm.Delf.bg.17089        清除成功

郁冰兰雪

EAV

D:\病毒样本\ghost病毒样本.rar > RAR > ghost.exe - Win32/Delf.BG 蠕虫

失翼天使

发现文件， C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.188\ghost.exe，已感染 W32/PWStealerX.AHX

tanlimo

运行后先每个盘生成autorun.inf和ghost.exe，向windows\system下写conime.exe，最后用ghost.exe.bat删除自身

主要行为：
Attempt to open process C:\WINDOWS\System32\SERVICES.EXE
Attempt to open process C:\WINDOWS\System32\WINLOGON.EXE
Attempt to open process C:\WINDOWS\System32\WINLOGON.EXE
Attempt to open process C:\WINDOWS\System32\CSRSS.EXE
Attempt to open process C:\WINDOWS\System32\ALG.EXE
.........
Attempt to detach from the thread input of the C:\WINDOWS\System32\CSRSS.EXE
Attempt to attach to the thread input of the C:\WINDOWS\System32\CSRSS.EXE

Attempt to write into file C:\Program Files\Thunder Network\Thunder\Thunder.exe
Attempt to write into file C:\Program Files\WinRAR\WinRAR.exe
Attempt to create new file C:\ghost.exe
.......
Attempt to create new file C:\autorun.inf
.......

[ 本帖最后由 tanlimo 于 2008-5-8 17:06 编辑 ]