3 downloader+1 zhelatin

显示全部楼层 · 发表于 2008-7-16 20:33:13

Result: 2 malware found
Trojan-Downloader.Win32.Agent.wej (virus)

* C:\Documents and Settings\1\×ÀÃæ\pkg8.rar\mas1.exe

Trojan.Win32.KillAV.ww (virus)

* C:\Documents and Settings\1\×ÀÃæ\pkg8.rar\update.exe

显示全部楼层 · 发表于 2008-7-16 20:39:03

[Scanning : C:\Download Files]

C:\Download Files\pkg8.rar<RAR>:update.exe<UPX>:update.exe <- Heur.RoundKick : No action
C:\Download Files\pkg8.rar<RAR>:update.exe<UPX>:update.exe<DLLRES>:file0.exe <- Heur.RoundKick : No action

Scanned objects : 9

Infected objects : 2

显示全部楼层 · 发表于 2008-7-16 20:40:04

沙盒还是有点用的

显示全部楼层 · 发表于 2008-7-16 21:41:15

Hello,

form.exe

This file is corrupted.

kkk.exe - Trojan-GameThief.Win32.OnLineGames.sgkj

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: pkg8.rar

显示全部楼层 · 发表于 2008-7-16 22:26:18

form运行不了...
其余的TF干了~

显示全部楼层 · 发表于 2008-7-17 08:10:18

Start of the scan: 2008年7月17日  08:10

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\pkg8.rar'
C:\Documents and Settings\Administrator\桌面\pkg8.rar
  [0] Archive type: RAR
  --> form.exe
   [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.zh
  --> kkk.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> mas1.exe
   [DETECTION] Is the Trojan horse TR/Crypt.DJ.28
  --> update.exe
   [DETECTION] Is the Trojan horse TR/Agent.29696.13
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-7-22 03:09:12

卡巴杀了

显示全部楼层 · 发表于 2008-7-22 12:50:36

norman 4个

显示全部楼层 · 发表于 2008-7-22 16:10:08

eset 1个

显示全部楼层 · 发表于 2008-7-22 16:25:26

Begin scan in 'C:\Documents and Settings\Bartley\桌面\pkg8.rar'
C:\Documents and Settings\Bartley\桌面\pkg8.rar
[0] Archive type: RAR
--> form.exe
   [DETECTION] Contains recognition pattern of the WORM/Zhelatin.zh worm
--> kkk.exe
   [DETECTION] Is the TR/Dropper.Gen Trojan
--> mas1.exe
   [DETECTION] Is the TR/Crypt.DJ.28 Trojan
--> update.exe
   [DETECTION] Is the TR/Agent.29696.13 Trojan
[NOTE]    The file was moved to '48ec98e2.qua'!

End of the scan: 2008年7月22日  16:21
Used time: 00:34 Minute(s)

The scan has been done completely.

   0 Scanning directories
   5 Files were scanned
   4 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

[病毒样本] 3 downloader+1 zhelatin

ArcaVir2008

Norman Virus Control 5.99

本帖子中包含更多资源

回复 1楼 qianwenxiang 的帖子

回复 1楼 qianwenxiang 的帖子

本帖子中包含更多资源