[病毒样本] 7

显示全部楼层 · 发表于 2008-6-29 00:07:07

Starting the file scan:

Begin scan in 'C:\Documents and Settings\kato9096\桌面\system'
C:\Documents and Settings\kato9096\桌面\system\clfmon.exe2
   [DETECTION] Contains detection pattern of the worm WORM/Cekar.A
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\system\cs.ex3e
   [DETECTION] Is the Trojan horse TR/Agent.ode.2
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\system\dd.exe2
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
C:\Documents and Settings\kato9096\桌面\system\yitallek.exe3
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!

End of the scan: Sunday,29 June 2008  00:07
Used time: 00:06 min

The scan has been done completely.

   1 Scanning directories
   7 Files were scanned
   4 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   4 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   0 Archives were scanned
   0 Warnings
   4 Notes

已上报~~

File ID    Filename    Size (Byte) Result
25060515    1.vbe2    663 Byte    UNDER ANALYSIS
25060516    User.db    91.5 KB    UNDER ANALYSIS
3813539    wujie.exe2    212.5 KB    CLEAN

已刪除: 病毒 Worm.Win32.AutoRun.doj 檔案: C:\Documents and Settings\kato9096\桌面\system\clfmon.exe2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.ssk 檔案: C:\Documents and Settings\kato9096\桌面\system\cs.ex3e//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.ivd 檔案: C:\Documents and Settings\kato9096\桌面\system\dd.exe2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.sav 檔案: C:\Documents and Settings\kato9096\桌面\system\yitallek.exe3//PE_Patch.UPX//UPX

已上报卡巴.

[ 本帖最后由 kato9096 于 2008-6-29 00:09 编辑 ]

显示全部楼层 · 发表于 2008-6-29 00:16:53

Sign of "Win32:AutoRun-AGN [Wrm]" has been found in "F:\system.rar\clfmon.exe2\[Upack]" file.
Sign of "Win32:Trojan-gen {Other}" has been found in "F:\system.rar\cs.ex3e" file.
Sign of "Win32:Trojan-gen {Other}" has been found in "F:\system.rar\dd.exe2" file.
Sign of "Win32:Agent-ZRP [Trj]" has been found in "F:\system.rar\yitallek.exe3\[UPX]\[Embedded#4060]" file.

显示全部楼层 · 发表于 2008-6-29 00:16:57

1.vbe2是个vbe的文本文件，可以打开看看有点意思
wujie.exe2是WJ浏览器，不是算恶意软件吧
User.db未发现可疑部分

显示全部楼层 · 发表于 2008-6-29 00:19:22

dd.exe:
http://www.threatexpert.com/repo ... 49ae27ec7456751b314

cs.exe:
http://www.threatexpert.com/repo ... f0006953c44bbdc1bc7

显示全部楼层 · 发表于 2008-6-29 08:41:56

病毒 2008-06-29  08:41:44 C:\Documents and Settings\Administrator\桌面\system.rar\yitallek.exe3 Win32.Troj.GameOnlineT.xx.61440 清除成功
病毒 2008-06-29  08:41:43 C:\Documents and Settings\Administrator\桌面\system.rar\dd.exe2 Win32.Troj.AgentT.ac.18776 清除成功
病毒 2008-06-29  08:41:43 C:\Documents and Settings\Administrator\桌面\system.rar\clfmon.exe2 Win32.Troj.AgentT.ac.18776 清除成功

显示全部楼层 · 发表于 2008-6-29 08:51:32

kv杀3

显示全部楼层 · 发表于 2008-6-29 09:14:40

:\virus\system.rar:\clfmon.exe2 - 特征码 'Virus.Worm.Win32.AutoRun.doj' 被发现
D:\virus\system.rar:\cs.ex3e - 特征码 'Trojan.Win32.Malagent' 被发现
D:\virus\system.rar:\dd.exe2 - 特征码 'Win32.SuspectCrc' 被发现
D:\virus\system.rar:\1.vbe2
D:\virus\system.rar:\wujie.exe2
D:\virus\system.rar:\User.db
D:\virus\system.rar:\yitallek.exe3 - 特征码 'Trojan-PWS.OnlineGames.ZAY' 被发现
D:\virus\system.rar

8 文件被扫描
(1 压缩档 7 文件)
4 特征码被侦测
0 可疑代码段被发现
耗时: 0:00.218

显示全部楼层 · 发表于 2008-6-29 17:47:39

wujie.exe

召唤BZ锁帖

显示全部楼层 · 发表于 2008-6-29 17:48:35

MicroVita AntiSpyware
_____________________________________________

         风暴微塔反间谍 T2
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\system\clfmon.exe2]
                  …………发现Spy！报告:[2] [1] Win32.Unknow
文件信息:  大小:28000  MD5:a512a39458d4379db7f6d97d4ac5c72b

[C:\Documents and Settings\Administrator\桌面\system\dd.exe2]
                  …………发现Spy！报告:[2] [1] Win32.Unknow
文件信息:  大小:7648  MD5:9c06f58e1988f49ae27ec7456751b314

文件数:4 病毒数:2  比重:0.5
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

显示全部楼层 · 发表于 2008-6-29 17:50:07

2008-6-29 17:50:03 Real-time file system protection file G:\v\c\yitallek.exe3 a variant of Win32/PSW.OnLineGames.NXI trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-6-29 17:50:02 Real-time file system protection file G:\v\c\dd.exe2 probably unknown NewHeur_PE virus cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-6-29 17:50:00 Real-time file system protection file G:\v\c\clfmon.exe2 a variant of Win32/Mypis.AH virus deleted - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

[病毒样本] 7

本帖子中包含更多资源