最新msn病毒样板

显示全部楼层 · 发表于 2008-6-30 20:30:43

RS20.51.02未杀！

显示全部楼层 · 发表于 2008-6-30 22:00:07

...
费尔在线扫描居然不报....

显示全部楼层 · 发表于 2008-6-30 22:03:03

费尔在线扫描说没有发现病毒

显示全部楼层 · 发表于 2008-6-30 23:04:34

小红伞 pass

显示全部楼层 · 发表于 2008-6-30 23:37:51

Hello.
New malicious software was found in the attached files.
Its detection will be included in the next update. Thank you for your help.
-----------------
Regards, Vladimir Lebedev
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

> Attachment: Photo5.zip

显示全部楼层 · 发表于 2008-6-30 23:39:01

SOPHOS 0

显示全部楼层 · 发表于 2008-7-1 00:09:54

kaba2009未杀！

显示全部楼层 · 发表于 2008-7-1 00:40:00

File:  Photo5.zip
Status:  INFECTED/MALWARE
MD5:  1cbd6669b52cab7eeffdf4c3e22fecbb
Packers detected:  -
Scanner results
Scan taken on 30 Jun 2008 16:37:45 (GMT)
A-Squared  Found nothing
AntiVir  Found nothing
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found Trojan.Agent.AIZX
ClamAV  Found nothing
CPsecure  Found nothing
Dr.Web  Found Trojan.Inject.3581
F-Prot Antivirus  Found nothing
F-Secure Anti-Virus  Found nothing
Fortinet  Found nothing
Ikarus  Found nothing
Kaspersky Anti-Virus  Found nothing
NOD32  Found Win32/AutoRun.RB
Norman Virus Control  Found nothing
Panda Antivirus  Found nothing
Sophos Antivirus  Found nothing
VirusBuster  Found nothing
VBA32  Found nothing

三款我非常喜欢的杀软报了~不得不佩服他们的引擎都是各有千秋不错

显示全部楼层 · 发表于 2008-7-1 08:34:49

2008-07-01 08:33:02 文件保护(创建文件) 操作:使用隔离区操作
进程路径:D:\桌面\virus\Photo5\12.exe
文件路径:C:\WINDOWS\system32\opnmljiH.dll

2008-07-01 08:33:02 文件保护(创建文件) 操作:使用隔离区操作
进程路径:D:\桌面\virus\Photo5\12.exe
文件路径:C:\Documents and Settings\Roger\Local Settings\Temp\removalfile.bat

显示全部楼层 · 发表于 2008-7-1 08:45:18

2008-07-01 08:35:32 注册表保护(创建注册表值)    操作:使用隔离区操作
进程路径:D:\桌面\virus\Photo5\euSp3[1].exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\EQSandBox\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
注册表名称:MSN File & Folder Sharing App

2008-07-01 08:35:32 文件保护(创建文件)    操作:使用隔离区操作
进程路径:D:\桌面\virus\Photo5\euSp3[1].exe
文件路径:C:\EQSandBox\C\WINDOWS\system32\msnfileshare.exe

2008-07-01 08:35:32 文件保护(修改文件)    操作:使用隔离区操作
进程路径:D:\桌面\virus\Photo5\euSp3[1].exe
文件路径:(隐藏文件)C:\EQSandBox\C\WINDOWS\system32\msnfileshare.exe

2008-07-01 08:35:35 文件保护(修改文件)    操作:使用隔离区操作
进程路径:D:\桌面\virus\Photo5\euSp3[1].exe
文件路径:C:\EQSandBox\C\WINDOWS\system32\drivers\etc\hosts

2008-07-01 08:35:35 应用程序保护(运行应用程序)    操作:使用隔离区操作
进程路径:D:\桌面\virus\Photo5\euSp3[1].exe
文件路径:C:\WINDOWS\system32\CMD.exe
命令行:/C del /F /S /Q *.zip

2008-07-01 08:35:36 应用程序保护(运行应用程序)    操作:使用隔离区操作
进程路径:D:\桌面\virus\Photo5\euSp3[1].exe
文件路径:C:\WINDOWS\system32\CMD.exe
命令行:/C del /F /S /Q *.com

2008-07-01 08:35:38 应用程序保护(运行应用程序)    操作:使用隔离区操作
进程路径:D:\桌面\virus\Photo5\euSp3[1].exe
文件路径:C:\WINDOWS\system32\CMD.exe
命令行:/C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"

2008-07-01 08:35:40 应用程序保护(运行应用程序)    操作:使用隔离区操作
进程路径:D:\桌面\virus\Photo5\euSp3[1].exe
文件路径:C:\WINDOWS\system32\CMD.exe
命令行:/C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"

2008-07-01 08:35:43 注册表保护(创建注册表值)    操作:使用隔离区操作
进程路径:D:\桌面\virus\Photo5\euSp3[1].exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\EQSandBox\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
注册表名称:PendingFileRenameOperations

2008-07-01 08:35:43 应用程序保护(运行应用程序)    操作:使用隔离区操作
进程路径:D:\桌面\virus\Photo5\euSp3[1].exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c del D:\桌面\virus\Photo5\euSp3[1].exe > nul

2008-07-01 08:35:32 应用程序保护(运行应用程序)    操作:使用隔离区操作
进程路径:D:\桌面\virus\Photo5\euSp3[1].exe
文件路径:C:\WINDOWS\system32\msnfileshare.exe

2008-07-01 08:35:58 文件保护(创建文件)    操作:使用隔离区操作
进程路径:C:\WINDOWS\system32\msnfileshare.exe
文件路径:C:\EQSandBox\C\Documents and Settings\Roger\Local Settings\Temporary Internet Files\Content.IE5\6BS8BNTO\msg2[1].txt

2008-07-01 08:35:58 文件保护(创建文件)    操作:使用隔离区操作
进程路径:C:\WINDOWS\system32\msnfileshare.exe
文件路径:C:\EQSandBox\C\Documents and Settings\Roger\Local Settings\Temporary Internet Files\Content.IE5\6BS8BNTO\issnb1[1].exe

2008-07-01 08:35:58 文件保护(创建文件)    操作:使用隔离区操作
进程路径:C:\WINDOWS\system32\msnfileshare.exe
文件路径:C:\EQSandBox\C\Documents and Settings\Roger\Local Settings\Temp\18.exe

2008-07-01 08:36:03 文件保护(创建文件)    操作:使用隔离区操作
进程路径:C:\WINDOWS\system32\msnfileshare.exe
文件路径:C:\EQSandBox\C\Documents and Settings\Roger\Local Settings\Temporary Internet Files\Content.IE5\G3D75K8E\euSp3[1].exe

2008-07-01 08:36:03 文件保护(创建文件)    操作:使用隔离区操作
进程路径:C:\WINDOWS\system32\msnfileshare.exe
文件路径:C:\EQSandBox\C\Documents and Settings\Roger\Local Settings\Temp\newPhoto12.zip

host 被添加

127.0.0.1 www.Merijn.org
127.0.0.1 www.spywareinfo.com
127.0.0.1 www.spybot.info
127.0.0.1 www.viruslist.com
127.0.0.1 www.hijackthis.de
127.0.0.1 www.f-secure.com
127.0.0.1 www.majorgeeks.com
127.0.0.1 www.avp.com
127.0.0.1 www.virustotal.com
127.0.0.1 www.sophos.com
127.0.0.1 www.avg-antivirus.net
127.0.0.1 www.kaspersky-labs.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.bleepingcomputer.com
127.0.0.1 www.free.grisoft.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 www.analysis.seclab.tuwien.ac.at
127.0.0.1 www.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 www.mcafee.com
127.0.0.1 www.free.avg.com
127.0.0.1 download.mcafee.com
127.0.0.1 mast.mcafee.com
127.0.0.1 guru0.grisoft.cz
127.0.0.1 guru1.grisoft.cz
127.0.0.1 guru2.grisoft.cz
127.0.0.1 guru3.grisoft.cz
127.0.0.1 guru4.grisoft.cz
127.0.0.1 guru5.grisoft.cz
127.0.0.1 www.virusspy.com
127.0.0.1 www.download.f-secure.com
127.0.0.1 www.housecall.trendmicro.com
127.0.0.1 www.avast.com
127.0.0.1 www.free.avg.com
127.0.0.1 www.onlinescan.avast.com
127.0.0.1 www.futurenow.bitdefender.com
127.0.0.1 www.bitdefender.com
127.0.0.1 www.f-prot.com
127.0.0.1 www.trendsecure.com
127.0.0.1 www.avira.com
127.0.0.1 www.eset.com
127.0.0.1 www.free.avg.com
127.0.0.1 www.free-av.com
127.0.0.1 www.2-spyware.com
127.0.0.1 www.antivir.es
127.0.0.1 www.prevx.com
127.0.0.1 www.ikarus.net
127.0.0.1 www.forums.majorgeeks.com
127.0.0.1 www.castlecops.com
127.0.0.1 www.virusspy.com
127.0.0.1 www.virusinfo.prevx.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.fortinet.com
127.0.0.1 www.safer-networking.org
127.0.0.1 www.fortiguardcenter.com
127.0.0.1 www.firewallguide.com
127.0.0.1 www.auditmypc.com
127.0.0.1 www.spywaredb.com
127.0.0.1 www.pctools.com
127.0.0.1 www.antivirus.comodo.com
127.0.0.1 www.spywareterminator.com
127.0.0.1 www.eradicatespyware.net
127.0.0.1 www.freespywareremoval.info
127.0.0.1 www.clamav.net
127.0.0.1 www.antivirus.about.com
127.0.0.1 www.pandasecurity.com
127.0.0.1
127.0.0.1 www.sandboxie.com
127.0.0.1 www.clamwin.com
127.0.0.1 www.cwsandbox.org
127.0.0.1 www.ca.com
127.0.0.1 www.networkworld.com
127.0.0.1 www.research.sunbelt-software.com
127.0.0.1 www.threatexpert.com
127.0.0.1 www.norman.com
127.0.0.1 virscan.org
127.0.0.1 www.viruschief.com
127.0.0.1 scanner.virus.org
127.0.0.1 www.hijackthis.de
127.0.0.1 hjt.networktechs.com
127.0.0.1 www.techsupportforum.com
127.0.0.1 www.whatthetech.com
127.0.0.1 www.prevx.com
127.0.0.1 forum.piriform.com
127.0.0.1 www.tweaksforgeeks.com
127.0.0.1 www.daniweb.com
127.0.0.1 www.geekstogo.com
127.0.0.1 www.pchell.com
127.0.0.1 www.spyany.com
127.0.0.1 forums.techguy.org
127.0.0.1 www.experts-exchange.com
127.0.0.1 forum.tweaks.com
127.0.0.1 www.wilderssecurity.com
127.0.0.1 www.techspot.com
127.0.0.1 www.thecomputerpitstop.com
127.0.0.1 www.computing.net
127.0.0.1 discussions.virtualdr.com
127.0.0.1 forum.securitycadets.com
127.0.0.1 www.techimo.com
127.0.0.1 www.infosecpodcast.com
127.0.0.1 www.csrrt.org
127.0.0.1 www.net-security.org
127.0.0.1 www.bleedingthreats.net
127.0.0.1 zhidao.baidu.com
127.0.0.1 bbs.360safe.com
127.0.0.1 hjt-data.trend-braintree.com
127.0.0.1 www.geekstogo.com
127.0.0.1 www.offensivecomputing.net
127.0.0.1 www.grisoft.com

msg2[1].txt 的內容

Would you mind if I shared this picture of you with a some friends of mine?
Have you seen my latest work of art? I just created it with Photoshop!
My account won't get closed if I use this as my default picture right?
I just can't believe this is real... What do you think?
You missed out on a crazy party Saturday! Just look at the picture I took!
I just can't get this stupid picture to print! What am I doing wrong?

[病毒样本] 最新msn病毒样板

2/0