可疑x13

显示全部楼层 · 发表于 2008-10-9 10:56:11

有可疑，也可能有误报

显示全部楼层 · 发表于 2008-10-9 11:00:23

诺顿10.1杀

显示全部楼层 · 发表于 2008-10-9 11:01:40

扫描系统区域...
扫描所选择的目录和文件...
对象: 54544.exe
路径: F:\可疑x13
Status: 已发现病毒
病毒: Packer.PESpin.A (BD 引擎)
对象: 5465454.exe
路径: F:\可疑x13
Status: 已发现病毒
病毒: Trojan.Downloader.JKGW (BD 引擎)
对象: 5556767.exe
路径: F:\可疑x13
Status: 已发现病毒
病毒: Trojan.Downloader.JKGW (BD 引擎)
对象: 70167.exe
路径: F:\可疑x13
Status: 已发现病毒
病毒: Trojan.Packed.7494 (BD 引擎)
对象: 8589378.exe
路径: F:\可疑x13
Status: 已发现病毒
病毒: Trojan-Dropper.Win32.Agent.xp (KAV 引擎), Adware.Winad.FW (BD 引擎)
对象: 895346.exe
路径: F:\可疑x13
Status: 已发现病毒
病毒: Packer.Krunchy.A (BD 引擎)
对象: edit1310.exe
路径: F:\可疑x13
Status: 已发现病毒
病毒: Trojan.Generic.705070 (BD 引擎)
对象: setup.exe
在压缩档案里: F:\可疑x13\main5878.exe
Status: 已发现病毒
病毒: not-a-virus:AdWare.Win32.Virtumonde.ks (KAV 引擎)
对象: (RAR Sfx o) setup.exe
在压缩档案里: F:\可疑x13\main5878.exe
Status: 已发现病毒
病毒: Adware.Virtumonde.GES (BD 引擎)
对象: main5878.exe
路径: F:\可疑x13
Status: 已发现病毒
病毒: not-a-virus:AdWare.Win32.Virtumonde.ks (KAV 引擎), Adware.Virtumonde.GES (BD 引擎)
对象: Spss150150.exe
路径: F:\可疑x13
Status: 已发现病毒
病毒: Packer.Krunchy.A (BD 引擎)
扫描完成: 2008-10-9 10:58
已检查 13 个文件
已发现 9 个染毒文件
发现 0 个可疑文件

显示全部楼层 · 发表于 2008-10-9 11:29:38

egin scan in 'E:\可疑x13.rar'
E:\可疑x13.rar
[0] Archive type: RAR
--> ﾿￉ￒ￉x13\main5878.exe
   [DETECTION] Contains recognition pattern of the DR/Virtumonde.KS.23 dropper
   --> ﾿￉ￒ￉x13\main5878.exe
      [1] Archive type: RAR SFX (self extracting)
      --> setup.exe
      [DETECTION] Is the TR/Dropper.Gen Trojan
--> ﾿￉ￒ￉x13\70167.exe
   [DETECTION] Is the TR/Packed.7494 Trojan
--> ﾿￉ￒ￉x13\6578677.exe
   [DETECTION] Is the TR/Dldr.Obfuscated Trojan
--> ﾿￉ￒ￉x13\5465454.exe
   [DETECTION] Is the TR/Dldr.Delf.ihc Trojan
--> ﾿￉ￒ￉x13\5556767.exe
   [DETECTION] Is the TR/Dldr.Delf.ihc Trojan
--> ﾿￉ￒ￉x13\yao25481.exe
   [DETECTION] Is the TR/Dldr.Delf.jub Trojan
--> ﾿￉ￒ￉x13\54544.exe
   [DETECTION] This file has been compressed using unusual runtime compression (PCK/PESpin). Please verify the origin of this file.
--> ﾿￉ￒ￉x13\8589378.exe
   [DETECTION] Contains recognition pattern of the ADSPY/Wupd.2 adware or spyware
[NOTE]    The file was deleted!

End of the scan: 2008年10月9日  11:25
Used time: 00:26 Minute(s)

The scan has been done completely.

   0 Scanning directories
   16 Files were scanned
   9 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   7 Files not concerned
   2 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2008-10-9 12:01:55

irus check with G DATA AntiVirus
Version 18.7.8155.555
Virus signature dated 10/8/2008
Start time: 10/9/2008 12:01
Engine(s): Engine A (AVK 19.943), Engine B (AVB 19.57)
Heuristics: On
Archive: On
System areas: Off

Check the following directories and files:
S:\可疑x13\

Object: setup.exe
In archive: S:\可疑x13\main5878.exe
Status: Virus detected
Virus: not-a-virus:AdWare.Win32.Virtumonde.ks (Engine A), Win32:Virtumonde-CI [Adw] (Engine B)
Object: main5878.exe
Path: S:\可疑x13
Status: Virus, file deleted
Virus: not-a-virus:AdWare.Win32.Virtumonde.ks (Engine A), Win32:Virtumonde-CI [Adw] (Engine B)
Object: 70167.exe
Path: S:\可疑x13
Status: Virus, file deleted
Virus: Win32:Trojan-gen {Other} (Engine B)
Object: 6578677.exe
Path: S:\可疑x13
Status: Virus, file deleted
Virus: Win32:Trojan-gen {Other} (Engine B)
Object: 5465454.exe
Path: S:\可疑x13
Status: Virus, file deleted
Virus: Win32:Downloader-BMU [Trj] (Engine B)
Object: 5556767.exe
Path: S:\可疑x13
Status: Virus, file deleted
Virus: Win32:Downloader-BMU [Trj] (Engine B)
Object: 374675.exe
Path: S:\可疑x13
Status: Virus, file deleted
Virus: Win32:Trojan-gen {Other} (Engine B)
Object: yao25481.exe
Path: S:\可疑x13
Status: Virus, file deleted
Virus: Win32:Delf-LBF [Trj] (Engine B)
Object: 8589378.exe
Path: S:\可疑x13
Status: Virus, file deleted
Virus: Trojan-Dropper.Win32.Agent.xp (Engine A)

Analysis performed in full: 10/9/2008 12:01
13 files checked
8 infected files detected
0 suspicious files found

显示全部楼层 · 发表于 2008-10-9 12:04:38

KAV+BD+AVAST后余一只

显示全部楼层 · 发表于 2008-10-9 14:38:41

Start of the scan: 2008年10月9日  14:30
Starting the file scan:
Begin scan in 'C:\Documents and Settings\桌面\可疑x13'
C:\Documents and Settings\桌面\可疑x13\5465454.exe
[DETECTION] Is the TR/Dldr.Delf.ihc Trojan
[NOTE]    A backup was created as '4923a522.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\桌面\可疑x13\5556767.exe
[DETECTION] Is the TR/Dldr.Delf.ihc Trojan
[NOTE]    A backup was created as '4922a523.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\桌面\可疑x13\6578677.exe
[DETECTION] Is the TR/Dldr.Obfuscated Trojan
[NOTE]    A backup was created as '4924a523.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\桌面\可疑x13\70167.exe
[DETECTION] Is the TR/Packed.7494 Trojan
[NOTE]    A backup was created as '491ea51e.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\桌面\可疑x13\8589378.exe
[DETECTION] Contains recognition pattern of the ADSPY/Wupd.2 adware or spyware
[NOTE]    A backup was created as '4925a524.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\桌面\可疑x13\main5878.exe
[0] Archive type: RAR SFX (self extracting)
--> setup.exe
   [DETECTION] Is the TR/Dropper.Gen Trojan
[DETECTION] Contains recognition pattern of the DR/Virtumonde.KS.23 dropper
[NOTE]    A backup was created as '4956a550.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\桌面可疑x13\yao25481.exe
[DETECTION] Is the TR/Dldr.Delf.jub Trojan
[NOTE]    A backup was created as '495ca550.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2008年10月9日  14:30
Used time: 00:06 Minute(s)
----------------------------------------------------------------------------------------------
红伞Pass 6个，上报提交分析。

显示全部楼层 · 发表于 2008-10-9 15:11:39

微点拦截

显示全部楼层 · 发表于 2008-10-9 15:53:40

已刪除: 廣告軟體 not-a-virus:AdWare.Win32.Virtumonde.ks 檔案: C:\Documents and Settings\kato9096\桌面\可疑x13.rar/褫疶x13\main5878.exe/setup.exe
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.FraudLoad.vcmi 檔案: C:\Documents and Settings\kato9096\桌面\可疑x13.rar/褫疶x13\installer557743.exe
已刪除: 特洛伊木馬程式 Trojan-Dropper.Win32.Agent.xp 檔案: C:\Documents and Settings\kato9096\桌面\可疑x13.rar/褫疶x13\8589378.exe

3,上报10

显示全部楼层 · 发表于 2008-10-9 16:03:17

F:\可疑x13.rar > RAR > 可疑x13\main5878.exe > RAR > setup.exe - Win32/Adware.Virtumonde 应用程序的变种
F:\可疑x13.rar > RAR > 可疑x13\70167.exe > FSG v1.33 - 解压错误
F:\可疑x13.rar > RAR > 可疑x13\6578677.exe - 可能是 Win32/TrojanDownloader.Obfuscated 特洛伊木马的变种
F:\可疑x13.rar > RAR > 可疑x13\installer557743.exe - Win32/Adware.Antivirus2008 应用程序
F:\可疑x13.rar > RAR > 可疑x13\8589378.exe - Win32/Adware.WUpd 应用程序

[可疑文件] 可疑x13

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源