[病毒样本] x11

显示全部楼层 · 发表于 2008-7-10 10:59:48

卡巴杀5漏6

已删除：风险软件 not-a-virus:RiskTool.Win32.HideWindows       文件　: D:\软件\其它\v\k\new\10.zip/Rgdet.exe//UPX
已删除：木马程序 Backdoor.IRC.Kelebek.f       文件　: D:\软件\其它\v\k\new\10.zip/temp.dll
已删除：风险软件 not-a-virus:Client-IRC.Win32.mIRC.603       文件　: D:\软件\其它\v\k\new\10.zip/Windows.exe//ASPack
已删除：木马程序 Backdoor.IRC.Kelebek.f       文件　: D:\软件\其它\v\k\new\10.zip/WZirdl.dll
已删除：风险软件 not-a-virus:Client-IRC.Win32.mIRC.603       文件　: D:\软件\其它\v\k\new\sex.zip/sex.exe//System/Windows.exe//ASPack
已删除：风险软件 not-a-virus:RiskTool.Win32.HideWindows       文件　: D:\软件\其它\v\k\new\sex.zip/sex.exe//System/Rgdet.exe//UPX
已删除：木马程序 Backdoor.IRC.Kelebek.f       文件　: D:\软件\其它\v\k\new\sex.zip/sex.exe//System/temp.dll
已删除：木马程序 Backdoor.IRC.Kelebek.f       文件　: D:\软件\其它\v\k\new\sex.zip/sex.exe//System/WZirdl.dll

TO KL

显示全部楼层 · 发表于 2008-7-10 11:02:46

C:\Documents and Settings\天壤之冰水\桌面\10.zip > ZIP > edih.dll - IRC/Flood 应用程序
C:\Documents and Settings\天壤之冰水\桌面\10.zip > ZIP > Rgdet.exe - Win32/HideWindow 应用程序
C:\Documents and Settings\天壤之冰水\桌面\10.zip > ZIP > WZirdl.dll - IRC/Kelebek.F 特洛伊木马

显示全部楼层 · 发表于 2008-7-10 11:07:21

2008-7-9 18:18:14 已检测到: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\sex.zip/sex.exe/System/temp.dll
2008-7-9 18:18:14 未清除: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\sex.zip/sex.exe/System/temp.dll 已延期
2008-7-9 18:18:14 已检测到: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\sex.zip/sex.exe/System/WZirdl.dll
2008-7-9 18:18:15 已检测到: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\10.zip/temp.dll
2008-7-9 18:18:15 未清除: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\10.zip/temp.dll 已延期
2008-7-9 18:18:16 已检测到: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\10.zip/WZirdl.dll
2008-7-9 18:18:16 未清除: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\10.zip/WZirdl.dll 已延期
2008-7-9 18:18:16 已检测到: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\10.zip/WZirdl.dll
2008-7-9 18:18:16 已删除: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\10.zip/WZirdl.dll
2008-7-9 18:18:16 已检测到: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\10.zip/temp.dll
2008-7-9 18:18:16 已删除: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\10.zip/temp.dll
2008-7-9 18:18:17 已检测到: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\sex.zip/sex.exe/System/temp.dll
2008-7-9 18:18:17 已检测到: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\sex.zip/sex.exe/System/WZirdl.dll
2008-7-9 18:18:17 已删除: Backdoor.IRC.Kelebek.f C:\Documents and Settings\Administrator\桌面\sex.zip/sex.exe

显示全部楼层 · 发表于 2008-7-10 11:12:50

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Hack.Flooder.Agent.al
病毒： Hack.HideWindow
病毒： Backdoor.Win32.IRCbot.vil
病毒： Backdoor.Script.IRC.Kelebek.a

用户来源：互联网

软件版本：20.52.22

显示全部楼层 · 发表于 2008-7-10 11:13:42

[:xi25:]

Hello,

control.ini, edih.dll, sysmake.vxd, Wmagmes.dll, WXfdisk.dll, Xddick.vxd

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: 10.zip

显示全部楼层 · 发表于 2008-7-10 11:30:53

Begin scan in 'C:\Documents and Settings\Administrator\桌面\10'
C:\Documents and Settings\Administrator\桌面\10\edih.dll
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Flood.IRC.2 Backdoor server programs
   [NOTE]    A backup was created as '48de814c.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\10\Rgdet.exe
   [DETECTION] Contains detection pattern of the dropper DR/HideWindows.A.2
   [NOTE]    A backup was created as '48d98150.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\10\sysmake.vxd
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Flood.IRC.7 Backdoor server programs
   [NOTE]    A backup was created as '48e88162.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\10\temp.dll
   [DETECTION] Contains detection pattern of the IRC virus IRC/Kelebek.F
   [NOTE]    A backup was created as '48e2814e.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\10\Windows.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Flood.IRC.5 Backdoor server programs
   [NOTE]    A backup was created as '48e38152.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\10\WZirdl.dll
   [DETECTION] Contains detection pattern of the IRC virus IRC/Kelebek.f
   [NOTE]    A backup was created as '48de8143.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!

End of the scan: 2008年7月10日  11:24
Used time: 00:03 min

The scan has been done completely.

   1 Scanning directories
   10 Files were scanned
   6 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   6 files were deleted
   0 files were repaired
   6 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   4 Files not concerned
   0 Archives were scanned
   0 Warnings
   6 Notes
Begin scan in 'C:\Documents and Settings\Administrator\桌面\sex.zip'
C:\Documents and Settings\Administrator\桌面\sex.zip
  [0] Archive type: ZIP
  --> sex.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Flood.IRC.1 Backdoor server programs
   [NOTE]    A backup was created as '48ed8236.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-7-10 11:38:13

5个

[病毒样本] x11

本帖子中包含更多资源

本帖子中包含更多资源