15

sam.to

04128aeb28c17e59b9207222abfe6d5c  agreements.bat3
40c270436211d53b18faaa187a43ec4c  agreements.dat
0aea4e01fc7e02318bee361d08e993b0  agreements.ini3
31bd4ce0f20f27888a3b2ccc9e6b9dbb  agreements.ocx3
096b91ed12f83542db57788eeccd2798  agreements.xml
23f8cd9b78a8a484bf27a0d0ee931ea5  BhoPlugin.dll2
9b33aca564b3cf810cce81fa33eab832  Call.exe3
99ae226539cdbe24bdadd9f14b71649b  existing.exe3
6556e384f22ea8fa7077e326829210fc  ipsraidn.sys
7b3259cdfd32b91cd4a641686aa693a7  Sample.exe3
04128aeb28c17e59b9207222abfe6d5c  shipped.bat3
767219b82246ea6398c5839fd8a54161  startup.ex3e
767219b82246ea6398c5839fd8a54161  systray.e2xe
e4755dbf4f018b2a0f42edd634d18d4c  win32load.ex2e
276ce7a28ca10a37fd569b009a6374c7  winlogos.exe3



已刪除: 病毒 P2P-Worm.Win32.Malas.f        檔案: C:\Documents and Settings\kato9096\桌面\複製 -454\startup.ex3e
已刪除: 病毒 P2P-Worm.Win32.Malas.f        檔案: C:\Documents and Settings\kato9096\桌面\複製 -454\systray.e2xe
已刪除: 病毒 IRC-Worm.Win32.Small.bj        檔案: C:\Documents and Settings\kato9096\桌面\複製 -454\win32load.ex2e

不报的已上报到卡巴


Hello,

agreements.bat3, agreements.dat, agreements.ini3, agreements.ocx3, agreements.xml, Call.exe3, existing.exe3, ipsraidn.sys, Sample.exe3, shipped.bat3

No malicious code were found in these files.

BhoPlugin.dll2 - not-a-virus:AdWare.Win32.BHO.cqx

This file is an Advertizing Tool, It's detection will be included in the next
update of extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

winlogos.exe3 - Trojan-Clicker.Win32.Agent.cbm

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-8-28 15:46 编辑 ]

woai_jolin

2008-8-27 23:56:38        Real-time file system protection        file        G:\v\win32load.ex2e        Win32/TrojanDownloader.Agent.OEA trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-8-27 23:56:38        Real-time file system protection        file        G:\v\systray.e2xe        a variant of Win32/Malas worm        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-8-27 23:56:38        Real-time file system protection        file        G:\v\startup.ex3e        a variant of Win32/Malas worm        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

Kitman

Begin scan in 'C:\Documents and Settings\Administrator\桌面\454'
C:\Documents and Settings\Administrator\桌面\454\startup.ex3e
    [DETECTION] Contains recognition pattern of the WORM/Khanani.A worm
    [NOTE]      WORM/Khanani.A:[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]:<Hidden>=dw:00000002>=DW:00000001
    [NOTE]      A backup was created as '49167b46.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\454\systray.e2xe
    [DETECTION] Contains recognition pattern of the WORM/Khanani.A worm
    [NOTE]      A backup was created as '49287b4b.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\454\win32load.ex2e
    [DETECTION] Contains recognition pattern of the WORM/Small.BJ worm
    [NOTE]      A backup was created as '49237b3b.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\454\winlogos.exe3
    [0] Archive type: RSRC
    --> Object
      [DETECTION] Is the TR/WinterLove.Y.1 Trojan
    [NOTE]      A backup was created as '485fae14.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: 2008年8月28日  00:03
Used time: 00:03 Minute(s)

The scan has been done completely.

      1 Scanning directories
     15 Files were scanned
      4 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      4 files were deleted
      0 files were repaired
      4 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     11 Files not concerned
      0 Archives were scanned
      0 Warnings
      4 Notes

25123060	shipped.bat3	116 KB	UNDER ANALYSIS
25123061	agreements.dat	356 KB	UNDER ANALYSIS
25123062	agreements.ini3	2.34 KB	UNDER ANALYSIS
25123063	agreements.ocx3	356 KB	UNDER ANALYSIS
25123064	agreements.xml	93 Byte	UNDER ANALYSIS
25123065	BhoPlugin.dll2	48 KB	UNDER ANALYSIS
25123066	existing.exe3	416 KB	UNDER ANALYSIS
25123067	Sample.exe3	432 KB	UNDER ANALYSIS
2176616	ipsraidn.sys	83.72 KB	KNOWN CLEAN

[ 本帖最后由 Kitman 于 2008-8-28 00:06 编辑 ]

woai_jolin

2008-8-28 0:01:31        Kernel        File  'G:\v\existing.exe' was sent to ESET for analysis.       
2008-8-28 0:01:01        Kernel        File  'G:\v\Call.exe' was sent to ESET for analysis.       
2008-8-28 0:00:32        Kernel        File  'G:\v\BhoPlugin.dll' was sent to ESET for analysis.

Nerazzurri

2008-8-28        0:45:34        1219855534        Nerazzurri        4036        Sign of "Win32:Haxdoor-DG [Trj]" has been found in "C:\Documents and Settings\Nerazzurri\桌面\454.rar\winlogos.exe3\[Embedded#40d18]" file.  
2008-8-28        0:45:43        1219855543        Nerazzurri        4036        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\Nerazzurri\桌面\454.rar\winlogos.exe3\[Embedded#65b1c]" file.  
2008-8-28        0:45:43        1219855543        Nerazzurri        4036        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\Nerazzurri\桌面\454.rar\winlogos.exe3\[Embedded#6db18]\[Embedded#25660]" file.  
2008-8-28        0:45:43        1219855543        Nerazzurri        4036        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\Nerazzurri\桌面\454.rar\winlogos.exe3\[Embedded#6db18]" file.  
2008-8-28        0:45:43        1219855543        Nerazzurri        4036        Sign of "Win32:Haxdoor-DG [Trj]" has been found in "C:\Documents and Settings\Nerazzurri\桌面\454.rar\winlogos.exe3" file.  
2008-8-28        0:45:44        1219855544        Nerazzurri        4036        Sign of "Win32:Malas-B [Wrm]" has been found in "C:\Documents and Settings\Nerazzurri\桌面\454.rar\startup.ex3e" file.  
2008-8-28        0:45:44        1219855544        Nerazzurri        4036        Sign of "Win32:Malas-B [Wrm]" has been found in "C:\Documents and Settings\Nerazzurri\桌面\454.rar\systray.e2xe" file.  
2008-8-28        0:45:44        1219855544        Nerazzurri        4036        Sign of "Win32:Agent-XKO" has been found in "C:\Documents and Settings\Nerazzurri\桌面\454.rar\win32load.ex2e" file.

英仔

小乔美子

NIS 2008 报3个

hotgose

趋势3个

LQ55

江民杀了2个

水晶

C:\Documents and Settings\Administrator\桌面\454.rar ?RAR ?startup.ex3e - Win32/Malas 蠕虫 变种
C:\Documents and Settings\Administrator\桌面\454.rar ?RAR ?systray.e2xe - Win32/Malas 蠕虫 变种