从隔壁转来一堆能感染WORD文档的毒毒们

显示全部楼层 · 发表于 2008-6-8 00:25:35

症状：点击图片文件和WORD 文档后（其他文件没试过）会把原文件名的后缀改为EXE 执行文件

中了EXE的文件我没有再点过

C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>Function.rar>>Function.dll>>SOLA.BAT Virus.BAT.Agent.af.rdpd 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>Function.rar>>Function.dll>>scan.bat Virus.BAT.Agent.af.ormd 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>Function.rar>>Function.dll>>infect.bat Virus.BAT.Agent.af.sysm 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>Function.rar>>Function.dll>>Autorun.inf Virus.BAT.Agent.af.pvef 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>Function.rar>>Function.dll>>TENBATSU.BAT Virus.BAT.Agent.af.ctgn 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>Function.rar>>Function.dll>>RecentInf.bat Virus.BAT.Agent.af.mqhp 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>Function.rar>>Function.dll>>LocalScan.bat Virus.BAT.Agent.af.bfps 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>Function.rar>>Function.dll>>readlnk.bat Virus.BAT.Agent.af.rnin 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>SOLA.rar>>SOLA\Function.dll>>SOLA.BAT Virus.BAT.Agent.af.rdpd 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>SOLA.rar>>SOLA\Function.dll>>scan.bat Virus.BAT.Agent.af.ormd 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>SOLA.rar>>SOLA\Function.dll>>infect.bat Virus.BAT.Agent.af.sysm 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>SOLA.rar>>SOLA\Function.dll>>Autorun.inf Virus.BAT.Agent.af.pvef 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>SOLA.rar>>SOLA\Function.dll>>TENBATSU.BAT Virus.BAT.Agent.af.ctgn 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>SOLA.rar>>SOLA\Function.dll>>RecentInf.bat Virus.BAT.Agent.af.mqhp 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>SOLA.rar>>SOLA\Function.dll>>LocalScan.bat Virus.BAT.Agent.af.bfps 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>SOLA.rar>>SOLA\Function.dll>>readlnk.bat Virus.BAT.Agent.af.rnin 病毒还未处理
C:\Documents and Settings\  \桌面\通过U盘感染Word文档.rar>>SOLA.rar>>SOLA\SOLA.BAT Virus.BAT.Agent.af.rdpd 病毒还未处理

显示全部楼层 · 发表于 2008-6-8 00:32:51

已刪除: 病毒 Virus.BAT.Agent.af 檔案: C:\Documents and Settings\kato9096\獢\?朞?U?䀹??㜁ord?﹝.rar/Function.rar/Function.dll/SOLA.BAT
已刪除: 病毒 Virus.BAT.Agent.af 檔案: C:\Documents and Settings\kato9096\獢\?朞?U?䀹??㜁ord?﹝.rar/Function.rar/Function.dll/scan.bat
已刪除: 病毒 Virus.BAT.Agent.af 檔案: C:\Documents and Settings\kato9096\獢\?朞?U?䀹??㜁ord?﹝.rar/Function.rar/Function.dll/infect.bat
已刪除: 病毒 Virus.BAT.Agent.af 檔案: C:\Documents and Settings\kato9096\獢\?朞?U?䀹??㜁ord?﹝.rar/Function.rar/Function.dll/Autorun.inf
已刪除: 病毒 Virus.BAT.Agent.af 檔案: C:\Documents and Settings\kato9096\獢\?朞?U?䀹??㜁ord?﹝.rar/Function.rar/Function.dll/TENBATSU.BAT
已刪除: 病毒 Virus.BAT.Agent.af 檔案: C:\Documents and Settings\kato9096\獢\?朞?U?䀹??㜁ord?﹝.rar/Function.rar/Function.dll/RecentInf.bat
已刪除: 病毒 Virus.BAT.Agent.af 檔案: C:\Documents and Settings\kato9096\獢\?朞?U?䀹??㜁ord?﹝.rar/Function.rar/Function.dll/LocalScan.bat
已刪除: 病毒 Virus.BAT.Agent.af 檔案: C:\Documents and Settings\kato9096\獢\?朞?U?䀹??㜁ord?﹝.rar/Function.rar/Function.dll/readlnk.bat
已刪除: 病毒 Virus.BAT.Agent.af 檔案: C:\Documents and Settings\kato9096\獢\?朞?U?䀹??㜁ord?﹝.rar/SOLA.rar/SOLA\Function.dll
已刪除: 病毒 Virus.BAT.Agent.af 檔案: C:\Documents and Settings\kato9096\獢\?朞?U?䀹??㜁ord?﹝.rar/SOLA.rar/SOLA\SOLA.BAT

to kl

显示全部楼层 · 发表于 2008-6-8 00:39:11

to pc security labs

显示全部楼层 · 发表于 2008-6-8 01:57:20

2008-6-8 2:00:02 已删除: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\SOLA.BAT
2008-6-8 2:00:02 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\SOLA.BAT
2008-6-8 2:00:02 已删除: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\Function.dll
2008-6-8 2:00:02 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\Function.dll/readlnk.bat
2008-6-8 2:00:02 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\Function.dll/LocalScan.bat
2008-6-8 2:00:02 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\Function.dll/RecentInf.bat
2008-6-8 2:00:02 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\Function.dll/TENBATSU.BAT
2008-6-8 2:00:02 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\Function.dll/Autorun.inf
2008-6-8 2:00:02 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\Function.dll/infect.bat
2008-6-8 2:00:02 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\Function.dll/scan.bat
2008-6-8 2:00:02 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\Function.dll/SOLA.BAT
2008-6-8 2:00:01 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\Function.dll 按散列
2008-6-8 2:00:01 已删除: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll
2008-6-8 2:00:01 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/readlnk.bat
2008-6-8 2:00:01 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/LocalScan.bat
2008-6-8 2:00:01 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/RecentInf.bat
2008-6-8 2:00:01 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/TENBATSU.BAT
2008-6-8 2:00:01 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/Autorun.inf
2008-6-8 2:00:01 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/infect.bat
2008-6-8 2:00:01 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/scan.bat
2008-6-8 2:00:01 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/SOLA.BAT
2008-6-8 2:00:01 未清除: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\SOLA.BAT 已延期
2008-6-8 2:00:01 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\SOLA.BAT
2008-6-8 2:00:01 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/SOLA.rar/SOLA\Function.dll 按散列
2008-6-8 2:00:01 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/readlnk.bat
2008-6-8 2:00:00 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/LocalScan.bat
2008-6-8 2:00:00 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/RecentInf.bat
2008-6-8 2:00:00 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/TENBATSU.BAT
2008-6-8 2:00:00 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/Autorun.inf
2008-6-8 2:00:00 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/infect.bat
2008-6-8 2:00:00 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/scan.bat
2008-6-8 2:00:00 未清除: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/SOLA.BAT 已延期
2008-6-8 2:00:00 已检测到: Virus.BAT.Agent.af D:\Sandbox\Administrator\DefaultBox\drive\D\临时文件\通过U盘感染Word文档.rar/Function.rar/Function.dll/SOLA.BAT

[ 本帖最后由 change_018 于 2008-6-8 01:58 编辑 ]

显示全部楼层 · 发表于 2008-6-8 02:28:32

其余无法识别的.都已上传卡巴了~~!

显示全部楼层 · 发表于 2008-6-8 02:34:23

原帖由 尽在不言中 于 2008-6-8 02:28 发表
其余无法识别的.都已上传卡巴了~~!

我的也是这样，呵呵，

显示全部楼层 · 发表于 2008-6-8 07:51:37

E:\virus\通过U盘感染Word文档.rar > RAR > Function.rar > RAR > Function.dll > RAR > Autorun.inf - BAT/Autorun.NAF 病毒
E:\virus\通过U盘感染Word文档.rar > RAR > SOLA.rar > RAR > SOLA\Function.dll > RAR > Autorun.inf - BAT/Autorun.NAF 病毒

显示全部楼层 · 发表于 2008-6-8 08:16:37

原帖由 傻猪猪米走鸡 于 2008-6-8 07:51 发表
E:\virus\通过U盘感染Word文档.rar > RAR > Function.rar > RAR > Function.dll > RAR > Autorun.inf - BAT/Autorun.NAF 病毒
E:\virus\通过U盘感染Word文档.rar > RAR > SOLA.rar > RAR > SOLA\Function.dll > RAR ...

其实Autorun.inf严格来说，不能算病毒....
但是，大家都被逼无奈哦～

显示全部楼层 · 发表于 2008-6-8 08:17:46

打开之后怎么就sleep文档里有东西啊，运行后没什么变化啊，怎么回事？

显示全部楼层 · 发表于 2008-6-8 09:20:38

如果光靠一个autorun.inf根本就不能算病毒

[病毒样本] 从隔壁转来一堆能感染WORD文档的毒毒们

本帖子中包含更多资源

本帖子中包含更多资源

回复 8楼 zwl2828 的帖子