Microsoft 感染型捆绑器 PE.VBIconchgs

显示全部楼层 · 发表于 2008-10-7 16:01:44

备注:

Microsoft Firewall Installer 12th Edition

Mac OS X Skin Installer By Microsoft Corporation.

INSTALLERN60.EXE

[ 本帖最后由 Nblock 于 2008-10-9 21:16 编辑 ]

显示全部楼层 · 发表于 2008-10-7 16:32:14

检测系统区域
检测选中目录和文件:
C:\Documents and Settings\Owner\桌面\BProtect.rar

项目: BPROTECT.AXV
检查档案: C:\Documents and Settings\Owner\桌面\BProtect.rar
状态: 发现病毒
病毒: Dropped:Win32.VB.Pajetbin.A (引擎 A)
项目: InstallerN60.exe
检查档案: C:\Documents and Settings\Owner\桌面\BProtect.rar
状态: 发现病毒
病毒: Win32.VB.Pajetbin.B (引擎 A)
项目: BProtect.exe
检查档案: C:\Documents and Settings\Owner\桌面\BProtect.rar
状态: 发现病毒
病毒: Dropped:Win32.VB.Pajetbin.A (引擎 A)
项目: BProtect.rar
路径: C:\Documents and Settings\Owner\桌面
状态: 病毒，文件已删除
病毒: Dropped:Win32.VB.Pajetbin.A (2x), Win32.VB.Pajetbin.B (引擎 A)

显示全部楼层 · 发表于 2008-10-7 16:35:57

附上MCLS日志：

Multi Command-Line Scanner Report
-------------------------------------------------------------------------
D:\Desk\Samples\Collect\MCLS\BProtect.exe
MD5 Hash: 2F07A7F3B015ABE239F20E0C6E0208A1
Type: Win32 Executable Microsoft Visual Basic 6 / Extension: .EXE

A-squared ----- Virus.Win32.VB.ig!IK
Antivir ----- W32/Protect.A
BitDefender ----- Dropped:Win32.VB.Pajetbin.A
ClamWin ----- W32.Pajetbin
Dr.Web ----- Nothing
Ikarus ----- Virus.Win32.VB.ig
Jiangmin ----- Virus.VB.Kangen.h
Kaspersky ----- Virus.Win32.VB.ig
Kingsoft ----- Nothing
Vba32 ----- Worm.Win32.VB.Ali

*** 8/10 antivirus engines found virus in this file ***
-------------------------------------------------------------------------
D:\Desk\Samples\Collect\MCLS\InstallerN60.exe
MD5 Hash: ACE9A7B64F039889FF407200E888B5C7
Type: Win32 Executable Microsoft Visual Basic 6 / Extension: .EXE

A-squared ----- Trojan.Win32.Agent.cgf!IK
Antivir ----- W32/Protect.A
BitDefender ----- Win32.VB.Pajetbin.B
ClamWin ----- W32.Pajetbin
Dr.Web ----- Nothing
Ikarus ----- Trojan.Win32.Agent.cgf
Jiangmin ----- Virus.VB.Kangen.i
Kaspersky ----- Virus.Win32.VB.il
Kingsoft ----- Win32.VBIconchgs.il.2060299
Vba32 ----- Worm.Win32.VB.Ali

*** 9/10 antivirus engines found virus in this file ***
-------------------------------------------------------------------------

Task done @ 2008/10/07 二 16:40:50.55

[ 本帖最后由 will 于 2008-10-7 16:41 编辑 ]

显示全部楼层 · 发表于 2008-10-7 16:37:04

DRWEB MISS

显示全部楼层 · 发表于 2008-10-7 16:39:25

Scan Stats:
  Scan Time: 1 seconds
  Scan Options:
  Scan Targets: D:\Virus\BProtect.rar
  Counts:
Total items scanned: 12
- Files & Directories: 12
- Registry Entries: 0
- Processes & Start-up Items: 0
- Network & Browser Items: 0
- Other: 0
- Trusted Files: 0
- Skipped Files: 0

Total security risks detected: 2
Total items resolved: 2
Total items that require attention: 0

Resolved Threats:
Risks in compressed file "bprotect.rar"
Type: Compressed
Risk: High (High Stealth, High Removal, High Performance, High Privacy)
Categories: Virus
Status: Fully Resolved
-----------
2 Files
d:\virus\bprotect.rar - Deleted

显示全部楼层 · 发表于 2008-10-7 16:39:26

norton報 W32.Pajetbin

显示全部楼层 · 发表于 2008-10-7 16:44:35

使用 G DATA AntiVirus 进行病毒病毒
版本 18.9.1.9
病毒特征库日期 10/7/2008
开始时间: 10/7/2008 16:43
引擎: KAV 引擎 (AVK 19.909), AVAST 引擎 (AVB 19.51)
启发式：开启
文件: 开启
系统区域: 关闭

检测选中目录和文件...
S:\BProtect\

项目: BPROTECT.AXV
路径: S:\BProtect
状态: 检测到病毒
病毒: Virus.Win32.VB.ig (KAV 引擎), Win32:VB-FBX (AVAST 引擎)
项目: InstallerN60.exe
路径: S:\BProtect
状态: 检测到病毒
病毒: Virus.Win32.VB.il (KAV 引擎), Win32:VB-FBX (AVAST 引擎)
项目: BProtect.exe
路径: S:\BProtect
状态: 检测到病毒
病毒: Virus.Win32.VB.ig (KAV 引擎), Win32:VB-FBX (AVAST 引擎)

检测执行时间： 10/7/2008 16:43
10 个文件被检查
3 个感染文件被发现

显示全部楼层 · 发表于 2008-10-7 18:19:11

显示全部楼层 · 发表于 2008-10-7 20:03:57

2008-10-7 20:03:08 检测到威胁: Virus.Win32.VB.ig D:\My Documents\桌面\BProtect.rar/BPROTECT.AXV
2008-10-7 20:03:08 未处理: Virus.Win32.VB.ig D:\My Documents\桌面\BProtect.rar/BPROTECT.AXV 延期
2008-10-7 20:03:08 检测到威胁: Virus.Win32.VB.il D:\My Documents\桌面\BProtect.rar/InstallerN60.exe
2008-10-7 20:03:08 未处理: Virus.Win32.VB.il D:\My Documents\桌面\BProtect.rar/InstallerN60.exe 延期
2008-10-7 20:03:08 检测到威胁: Virus.Win32.VB.ig D:\My Documents\桌面\BProtect.rar/BProtect.exe
2008-10-7 20:03:08 未处理: Virus.Win32.VB.ig D:\My Documents\桌面\BProtect.rar/BProtect.exe 延期
2008-10-7 20:03:08 检测到威胁: Virus.Win32.VB.ig D:\My Documents\桌面\BProtect.rar/BPROTECT.AXV
2008-10-7 20:03:09 检测到威胁: Virus.Win32.VB.ig D:\My Documents\桌面\BProtect.rar/BProtect.exe
2008-10-7 20:03:09 检测到威胁: Virus.Win32.VB.il D:\My Documents\桌面\BProtect.rar/InstallerN60.exe

显示全部楼层 · 发表于 2008-10-7 20:05:05

McAfee  报了1个。。

bprotect.axv       no
bprotect.exe       no
installern60.exe new malware-d
wavemsp#.exe    no

[病毒样本] Microsoft 感染型捆绑器 PE.VBIconchgs

本帖子中包含更多资源

红伞砍

本帖子中包含更多资源

本帖子中包含更多资源

kis2009