yangben

显示全部楼层 · 发表于 2008-8-4 20:27:31

[ 本帖最后由 allinwonderi 于 2008-8-4 20:30 编辑 ]

显示全部楼层 · 发表于 2008-8-4 20:29:33

红伞（上个星期五最后升级）剩五个

上报剩四个

File ID	Filename	Size (Byte)	Result
25104364	Au_.exe	72.4 KB	UNDER ANALYSIS
25104365	Bu_.exe	116.6 KB	UNDER ANALYSIS
25104366	Cu_.exe	91.31 KB	UNDER ANALYSIS
25104367	msn.exe	144.11 KB	UNDER ANALYSIS
25104368	4.exe	169.69 KB	MALWARE

显示全部楼层 · 发表于 2008-8-4 20:31:44

---------------------
扫描已结束: 2008-8-4, 20:31:22
用时: 0:00:22

扫描结果:

已扫描的文件:    23
已感染的对象:    8
已清除的对象:    0
已隔离的文件:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-8-4 20:34:03

[Scanning : C:\Download Files]

C:\Download Files\du\du\1.exe <- Trojan.Gamethief.Wow.Bpa : Cleaning -> Delete
C:\Download Files\du\du\2.exe <- Trojan.Downloader.Agent.Yko : Cleaning -> Delete
C:\Download Files\du\du\4.exe <- Trojan.Shutdowner.Io : Cleaning -> Delete
C:\Download Files\du\du\43976.exe <- Variant:Trojan.Blackhole.T : Cleaning -> Delete
C:\Download Files\du\du\49195.exe <- Trojan.Gamethief.Wow.Bpa : Cleaning -> Delete
C:\Download Files\du\du\businesnk.exe<UPX>:businesnk.exe<DLLRES>:res0.exe <- Trojan.Agent.Von : Cleaning -> Delete
C:\Download Files\du\du\msn.exe<NSIS>:4.exe<NSIS>:file1 <- Variant:Adware.Cinmus.Gzj : Cleaning -> Delete
C:\Download Files\du\du\self.bat <- Trojan.Gamethief.Onlinegames.Skmj : Cleaning -> Delete
C:\Download Files\du\du\uspmnk.exe <- Trojan.Gamethief.Onlinegames.Skmj : Cleaning -> Delete
C:\Download Files\du\du\winsys.exe <- Variant:Trojan.Blackhole.T : Cleaning -> Delete

Scanned objects : 46

Infected objects : 10

显示全部楼层 · 发表于 2008-8-4 20:51:20

已删除: 木马程序 Trojan-GameThief.Win32.WOW.bpa 文件: C:\Users\Niya\Downloads\du\du\1.exe//PE_Patch.PECompact//PecBundle//PECompact
已删除: 木马程序 Trojan-Downloader.Win32.Agent.yko 文件: C:\Users\Niya\Downloads\du\du\2.exe//ASPack
已删除: 广告软件 not-a-virus:AdWare.Win32.Cinmus.ohi 文件: C:\Users\Niya\Downloads\du\du\4.exe//data0004
已隔离: 病毒 Heur.Trojan.Generic (变种) 文件: C:\Users\Niya\Downloads\du\du\43976.exe//PE_Patch.PECompact//PecBundle//PECompact
已删除: 木马程序 Trojan-GameThief.Win32.WOW.bpa 文件: C:\Users\Niya\Downloads\du\du\49195.exe//PE_Patch.PECompact//PecBundle//PECompact
已删除: 木马程序 Trojan-Downloader.Win32.Agent.zaq 文件: C:\Users\Niya\Downloads\du\du\5.exe
已删除: 木马程序 Trojan-Downloader.Win32.Small.xii 文件: C:\Users\Niya\Downloads\du\du\a.exe//PE_Patch//UPack
已删除: 木马程序 Trojan.Win32.Agent.xku 文件: C:\Users\Niya\Downloads\du\du\businesnk.exe
已删除: 广告软件 not-a-virus:AdWare.Win32.Cinmus.izt 文件: C:\Users\Niya\Downloads\du\du\msn.exe//stream//data0002//data0003
已删除: 木马程序 Trojan-GameThief.Win32.OnLineGames.skmj 文件: C:\Users\Niya\Downloads\du\du\self.bat
已删除: 木马程序 Trojan-GameThief.Win32.OnLineGames.snbr 文件: C:\Users\Niya\Downloads\du\du\tcpip.exe//UPX
已删除: 木马程序 Trojan-GameThief.Win32.OnLineGames.skmj 文件: C:\Users\Niya\Downloads\du\du\uspmnk.exe
已删除: 木马程序 Trojan-Downloader.Win32.Vidlo.bo 文件: C:\Users\Niya\Downloads\du\du\visx6.exe//NSPack
已隔离: 病毒 Heur.Trojan.Generic (变种) 文件: C:\Users\Niya\Downloads\du\du\winsys.exe//PE_Patch.PECompact//PecBundle//PECompact

显示全部楼层 · 发表于 2008-8-4 21:05:27

Hello,

43976.exe3, winsys.ex2e - Trojan-Downloader.Win32.VB.gjv,
F9D3B.ex2e - Trojan-Downloader.Win32.VB.gjw

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Au_.exe2, Bu_.e2xe, Cu_.ex2e

These files are corrupted.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

显示全部楼层 · 发表于 2008-8-4 21:11:19

红伞14个

显示全部楼层 · 发表于 2008-8-4 22:02:32

扫描系统区域...
扫描所选择的目录和文件...
对象: 1.exe
路径: E:\virus\vir\du
Status: 已发现病毒
病毒: Trojan-GameThief.Win32.WOW.bpa (KAV 引擎)
对象: 2.exe
路径: E:\virus\vir\du
Status: 已发现病毒
病毒: Trojan-Downloader.Win32.Agent.yko (KAV 引擎)
对象: data0004
在压缩档案里: E:\virus\vir\du\4.exe
Status: 已发现病毒
病毒: not-a-virus:AdWare.Win32.Cinmus.ohi (KAV 引擎)
对象: (NSIS o) zlib_nsis0003
在压缩档案里: E:\virus\vir\du\4.exe
Status: 可疑病毒
病毒: Trojan.Obfuscated.KU (BD 引擎)
对象: 4.exe
路径: E:\virus\vir\du
Status: 病毒文件已删除
病毒: not-a-virus:AdWare.Win32.Cinmus.ohi (KAV 引擎), Trojan.Obfuscated.KU (BD 引擎)
对象: 49195.exe
路径: E:\virus\vir\du
Status: 已发现病毒
病毒: Trojan-GameThief.Win32.WOW.bpa (KAV 引擎)
对象: 5.exe
路径: E:\virus\vir\du
Status: 已发现病毒
病毒: Trojan-Downloader.Win32.Agent.zaq (KAV 引擎)
对象: a.exe
路径: E:\virus\vir\du
Status: 已发现病毒
病毒: Trojan-Downloader.Win32.Small.xii (KAV 引擎), Generic.Malware.dld!!.B7E565A1 (BD 引擎)
对象: businesnk.exe
路径: E:\virus\vir\du
Status: 已发现病毒
病毒: Trojan.Win32.Agent.xku (KAV 引擎), Trojan.PWS.OnlineGames.ZAY (BD 引擎)
对象: stream/data0002 data0003
在压缩档案里: E:\virus\vir\du\msn.exe
Status: 已发现病毒
病毒: not-a-virus:AdWare.Win32.Cinmus.izt (KAV 引擎)
对象: msn.exe
路径: E:\virus\vir\du
Status: 病毒文件已删除
病毒: not-a-virus:AdWare.Win32.Cinmus.izt (KAV 引擎), DeepScan:Generic.Adw.Cinmus.2.5757C38A (BD 引擎)
对象: self.bat
路径: E:\virus\vir\du
Status: 已发现病毒
病毒: Trojan-GameThief.Win32.OnLineGames.skmj (KAV 引擎)
对象: tcpip.exe
路径: E:\virus\vir\du
Status: 已发现病毒
病毒: Trojan-GameThief.Win32.OnLineGames.snbr (KAV 引擎)
对象: uspmnk.exe
路径: E:\virus\vir\du
Status: 已发现病毒
病毒: Trojan-GameThief.Win32.OnLineGames.skmj (KAV 引擎)
对象: visx6.exe
路径: E:\virus\vir\du
Status: 已发现病毒
病毒: Trojan-Downloader.Win32.Vidlo.bo (KAV 引擎)
扫描完成: 2008-8-4 22:02
已检查 18 个文件
已发现 12 个染毒文件

显示全部楼层 · 发表于 2008-8-5 00:07:18

43976.exe3, winsys.ex2e
这2个文件的md5是一样的

[病毒样本] yangben

Norman Virus Control 5.99

F-Prot 4.4.4

ArcaVir2008