virus

显示全部楼层 · 发表于 2008-6-24 00:10:32

mcafee扫出来的

显示全部楼层 · 发表于 2008-6-24 00:14:49

扫描系统区域...
扫描所选择的目录和文件...
对象: 1\39.exe
在压缩档案里: D:\fs.rar
Status: 已发现病毒
病毒: Win32.Worm.Otwycal.T (BD 引擎)
对象: 1\4191.exe
在压缩档案里: D:\fs.rar
Status: 已发现病毒
病毒: Adware.BDSearch.1 (BD 引擎)
对象: 1\50921.exe
在压缩档案里: D:\fs.rar
Status: 已发现病毒
病毒: Win32.Worm.Otwycal.T (BD 引擎)
对象: 1\f.exe
在压缩档案里: D:\fs.rar
Status: 已发现病毒
病毒: Win32.Worm.Otwycal.T (BD 引擎)

显示全部楼层 · 发表于 2008-6-24 00:17:50

Scan Log
Version of virus signature database: 3209 (20080623)
Date: 2008-6-24 Time: 0:17:54
Scanned disks, folders and files: G:\v\fs.rar
G:\v\fs.rar » RAR » 1\033.exe - a variant of Win32/TrojanDownloader.Adload.NFC trojan - was a part of the deleted object
G:\v\fs.rar » RAR » 1\39.exe - Win32/AutoRun.NAD virus - was a part of the deleted object
G:\v\fs.rar » RAR » 1\4191.exe - is OK
G:\v\fs.rar » RAR » 1\50921.exe - Win32/AutoRun.NAD virus - was a part of the deleted object
G:\v\fs.rar » RAR » 1\BEGIN.BAT - is OK
G:\v\fs.rar » RAR » 1\f.exe - Win32/AutoRun.NAD virus - was a part of the deleted object
Number of scanned objects: 6
Number of threats found: 4
Number of cleaned objects: 4
Time of completion: 0:17:55 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2008-6-24 00:34:55

已解毒: 病毒 Worm.Win32.Otwycal.g 檔案: C:\Documents and Settings\kato9096\桌面\fs.rar/1\39.exe
已解毒: 病毒 Worm.Win32.Otwycal.g 檔案: C:\Documents and Settings\kato9096\桌面\fs.rar/1\50921.exe
已刪除: 特洛伊木馬程式 Backdoor.Win32.Small.oo 檔案: C:\Documents and Settings\kato9096\桌面\fs.rar/1\f.exe
已刪除: 特洛伊木馬程式 Backdoor.Win32.Small.oo 檔案: C:\Documents and Settings\kato9096\桌面\fs.rar/1\f.exe//RCryptor//UPX

不报的已上报.

显示全部楼层 · 发表于 2008-6-24 00:36:28

刚点下载连接就被小红伞拦截了。

显示全部楼层 · 发表于 2008-6-24 00:42:34

已清除：病毒 Worm.Win32.Otwycal.g 文件: E:\Downloads\fs.rar/1\39.exe
已清除：病毒 Worm.Win32.Otwycal.g 文件: E:\Downloads\fs.rar/1\50921.exe
已删除：木马程序 Backdoor.Win32.Small.oo 文件: E:\Downloads\fs.rar/1\f.exe
已删除：木马程序 Backdoor.Win32.Small.oo 文件: e:\downloads\fs.rar/1\f.exe//RCryptor//UPX

显示全部楼层 · 发表于 2008-6-24 00:45:06

显示全部楼层 · 发表于 2008-6-24 00:46:51

Start of the scan: 2008年6月24日  00:44
Starting the file scan:
Begin scan in 'E:\Downloads\fs.rar'
E:\Downloads\fs.rar
  [0] Archive type: RAR
--> 1\033.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 1\39.exe
   [DETECTION] Contains detection pattern of the worm WORM/Otwycal.g
  --> 1\4191.exe
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/BDSearch.1.55
  --> 1\50921.exe
   [DETECTION] Contains detection pattern of the worm WORM/Otwycal.g
  --> 1\BEGIN.BAT
   [DETECTION] Contains detection pattern of the batch virus BAT/Dldr.aar
  --> 1\f.exe
   [DETECTION] Contains detection pattern of the worm WORM/Otwycal.g
   [NOTE]    The file was deleted!

End of the scan: 2008年6月24日  00:44
Used time: 00:26 min
The scan has been done completely.

显示全部楼层 · 发表于 2008-6-24 01:14:54

原帖由 kato9096 于 2008-6-24 00:34 发表
已解毒: 病毒 Worm.Win32.Otwycal.g 檔案: C:\Documents and Settings\kato9096\桌面\fs.rar/1\39.exe
已解毒: 病毒 Worm.Win32.Otwycal.g 檔案: C:\Documents and Settings\kato9096\桌面\fs.rar/1\50921.exe
已刪 ...

Hello.
New malicious software was found in the attached files.
Its detection will be included in the next update. Thank you for your help.
-----------------
Regards, Vladimir Lebedev
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

显示全部楼层 · 发表于 2008-6-24 11:22:32

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\FS\1\39.EXE
木马程序生成以下文件:
1) C:\WINDOWS\WINDOWS.EXT
是否删除木马程序及其衍生物?

[病毒样本] virus

本帖子中包含更多资源

卡巴的扫描结果（我只装了扫描模块）

本帖子中包含更多资源

小红伞的扫描结果

本帖子中包含更多资源