[病毒样本] 10

显示全部楼层 · 发表于 2008-8-2 00:17:51

95e1ce3f6ec3f098697f3996e5419878  BDGuard.SYS3
246af4b090e1f677e8b028900a573a9f  css.js
3825fc7a255acf7317b60dc880bc59a8  dad32533.dll3
2e47a8df27c98a7bde35941e072409fd  deloqq.sys3
f4701619451a1f155300b4faba07fba5  NetmanEx.dll3
5cca9ba4913e47ab68f72b644368c601  qq365up.dll2
865ab0589791da145592a3ce377ed342  SUPERBCH.EXE3
b21fee5dffc1711e338790c8da29a31b  task.exe3
9b70b153aa56b65998f5f13fff91ab69  x.exe3
0560b36a9a58dcf6698545f9521eabf2  ZSSnp211.ex3e

已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Boran.z 檔案: C:\Documents and Settings\kato9096\桌面\frgbhn\BDGuard\BDGuard.SYS3
已刪除: 特洛伊木馬程式 Rootkit.Win32.Agent.bxg 檔案: C:\Documents and Settings\kato9096\桌面\frgbhn\BDGuard\NetmanEx.dll3
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.xwr 檔案: C:\Documents and Settings\kato9096\桌面\frgbhn\BDGuard\x.exe3//UPX

3个,不报的已上报卡巴,pcsl

Hello.
New malicious software was found in the attached file ().
It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

-----------------
Regards, Kirill Erakhtin
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-8-2 14:23 编辑 ]

显示全部楼层 · 发表于 2008-8-2 00:19:48

还有3个有效文件

显示全部楼层 · 发表于 2008-8-2 00:20:33

显示全部楼层 · 发表于 2008-8-2 00:36:57

ZSSnp211.exe看上去像正常的文件，手中无hips，不好分析

显示全部楼层 · 发表于 2008-8-2 00:38:55

Begin scan in 'C:\Documents and Settings\Administrator\桌面\BDGuard.rar'
C:\Documents and Settings\Administrator\桌面\BDGuard.rar
[0] Archive type: RAR
--> BDGuard.SYS3
   [DETECTION] Is the TR/Rootkit.AK.2 Trojan
--> task.exe3
   [DETECTION] Is the TR/Tiny.10240.A Trojan
--> NetmanEx.dll3
   [DETECTION] Contains HEUR/Crypted suspicious code
   --> x.exe3
      [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
--> SUPERBCH.EXE3
   [DETECTION] Contains HEUR/Malware suspicious code
[NOTE]    The file was deleted!

End of the scan: 星期六 2008年8月2日  00:38
Used time: 00:09 Minute(s)

The scan has been done completely.

   0 Scanning directories
   11 Files were scanned
   2 viruses and/or unwanted programs were found
   3 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   6 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2008-8-2 00:49:01

UGuard 完成了在 C:\Documents and Settings\Administrator\桌面\BDGuard.rar 上的扫描。
================
'Heur.SSDTModify' 在 'BDGuard.rar//BDGuard.SYS3' 中被检测到。
'Generic.nFile' 在 'BDGuard.rar//NetmanEx.dll3' 中被检测到。
'Trojan.Delf.l' 在 'BDGuard.rar//task.exe3' 中被检测到。
'SL.TR.dl.u' 在 'BDGuard.rar//x.exe3' 中被检测到。
================
扫描文件数： 11
本次扫描发现了 4 个已知威胁，请及时处理。
实际文件数： 1
扫描时间： 0-00-00 00:00:00:0891
威胁比率： 400%

显示全部楼层 · 发表于 2008-8-2 02:43:37

已删除：广告程序 not-a-virus:AdWare.Win32.Boran.z 文件　: G:\Temp\Virus\BDGuard.rar/BDGuard.SYS3
已删除：木马程序 Rootkit.Win32.Agent.bxg 文件　: G:\Temp\Virus\BDGuard.rar/NetmanEx.dll3
已删除：木马程序 Trojan-Downloader.Win32.Small.xwr 文件　: G:\Temp\Virus\BDGuard.rar/x.exe3//UPX

显示全部楼层 · 发表于 2008-8-2 08:50:54

2008-8-2 8:50:51 Real-time file system protection file G:\V\SUPERBCH.EXE3 probably unknown NewHeur_PE virus deleted NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.
2008-8-2 8:50:50 Real-time file system protection file G:\v\SUPERBCH.EXE3 probably unknown NewHeur_PE virus cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-8-2 8:50:50 Real-time file system protection file G:\V\X.EXE3 Win32/Agent.NXM trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.
2008-8-2 8:50:49 Real-time file system protection file G:\v\x.exe3 Win32/Agent.NXM trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

显示全部楼层 · 发表于 2008-8-2 08:58:26

扫描系统区域...
扫描所选择的目录和文件...
对象: BDGuard.SYS3
在压缩档案里: E:\virus\vir\BDGuard.rar
Status: 已发现病毒
病毒: not-a-virus:AdWare.Win32.Boran.z (KAV 引擎)
对象: NetmanEx.dll3
在压缩档案里: E:\virus\vir\BDGuard.rar
Status: 已发现病毒
病毒: Rootkit.Win32.Agent.bxg (KAV 引擎)
对象: x.exe3
在压缩档案里: E:\virus\vir\BDGuard.rar
Status: 已发现病毒
病毒: Trojan-Downloader.Win32.Small.xwr (KAV 引擎), Generic.Malware.SBdld!g.57F4DCA1 (BD 引擎)
对象: task.exe3
在压缩档案里: E:\virus\vir\BDGuard.rar
Status: 已发现病毒
病毒: Trojan.Generic.204243 (BD 引擎)
对象: SUPERBCH.EXE3
在压缩档案里: E:\virus\vir\BDGuard.rar
Status: 已发现病毒
病毒: Generic.Malware.SP!DV.C640E56C (BD 引擎)

显示全部楼层 · 发表于 2008-8-2 13:22:03

金山 miss 8