[病毒样本] Two

显示全部楼层 · 发表于 2008-5-22 21:21:38

给ＴＦ了

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).
Contains characteristics of an identified security risk.

The following files were created in the system:

#	Filename(s)	File Size	File MD5	Alias
1	%ProgramFiles%\Common Files\CPUSH\cpush.dll	180,224 bytes	0x2DDEFAC81AF1815AD9E4408F6838088A	not-a-virus:AdWare.Win32.BHO.bba [Kaspersky Lab] Adware.CPush [Symantec] AdClicker-BJ [McAfee]
2	%ProgramFiles%\Common Files\CPUSH\Uninst.exe	33,055 bytes	0x805C90E5AF7EDDBC52D5030A1D8BD2CA	(not available)
3	[file and pathname of the sample #1]	130,629 bytes	0xCCAD2FDB076598495C61D8A1E7200D48	not-a-virus:AdWare.Win32.BHO.bba [Kaspersky Lab]

http://www.threatexpert.com/report.aspx?md5=ccad2fdb076598495c61d8a1e7200d48

[ 本帖最后由电影结束了于 2008-5-22 21:55 编辑 ]

显示全部楼层 · 发表于 2008-5-22 21:54:53

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\untra.rar<RAR>:untra.exe3<NSIS>:cpush.dll <- Adware.Bho.Bba : No action

Scanned objects : 81

Infected objects : 1

显示全部楼层 · 发表于 2008-5-22 21:55:13

MISS

显示全部楼层 · 发表于 2008-5-23 04:52:30

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\100038'
C:\Documents and Settings\morgan\My Documents\100038\
  100038.exe2
  untra.exe3
   [DETECTION] Contains detection pattern of the dropper DR/BHO.bba.32
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-5-23 10:54:00

江民0

显示全部楼层 · 发表于 2008-5-23 11:49:31

egin scan in 'C:\Documents and Settings\Administrator\桌面\untra.rar'
C:\Documents and Settings\Administrator\桌面\untra.rar
  [0] Archive type: RAR
  --> untra.exe3
   [DETECTION] Contains detection pattern of the dropper DR/BHO.bba.32
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2008-5-23 11:51:14

2008-05-23 11:48:37 文件保护(创建文件) 操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\untra.exe
文件路径:C:\Program Files\Common Files\CPUSH\Uninst.exe

2008-05-23 11:48:37 注册表保护(创建注册表值) 操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\untra.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
注册表名称:CPushSetup

显示全部楼层 · 发表于 2008-5-23 11:55:35

2008-05-23 11:53:43 文件保护(创建文件) 操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\100038.exe
文件路径:C:\windows\system32\Coopen.scr

显示全部楼层 · 发表于 2008-5-23 11:59:15

We received the following archive files:

File ID  Filename Size (Byte) Result
25026184  100038.rar 946.35 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename Size (Byte) Result
25026185  100038.exe2  962.13 KB  UNDER ANALYSIS

显示全部楼层 · 发表于 2008-5-23 17:03:35

广告软件名称:AdWare.Win32.BHO.asz
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\桌面\CPUSH.DLL
是广告软件!
已成功阻止其运行,是否要删除此文件?

[病毒样本] Two

ArcaVir2008

F-Prot 4.4.4

第二个文件修改成EXE运行

第一个文件,看是没啥问题,安装中拦截

上报分析

本帖子中包含更多资源