穿还原下载器魔兽msn KILLER10. Khelper10.sys Rootkit.Win32.Agent.enh

Nblock

Avast

4.8.1248.0

2008.10.22

Win32:Warezov-MF

Kaspersky

7.0.0.125

2008.10.23

Rootkit.Win32.Agent.enh

NOD32

3547

2008.10.22

probably a variant of Win32/Rootkit.Agent.NFF

Rising

21.00.31.00

2008.10.23

RootKit.Win32.Undef.tl

穿还原下载器  木马程序生成以下文件:
1) F:\XINQIDIAN.EXE
2) C:\WINDOWS\SYSTEM32\KILLER10.SYS  Khelper10.sys 穿还原
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\DLL484.DLL
是否删除木马程序及其衍生物?

HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\DOGKILLER10\    IMAGEPATH  \??\C:\WINDOWS\SYSTEM32\KILLER10.SYS

刚发现微点隔离区放出来的会自动改为大写

        





[ 本帖最后由 Nblock 于 2008-10-23 17:22 编辑 ]

lingbo110120

XINQIDIAN.EXE - 可能是 Win32/Rootkit.Agent.NFF 特洛伊木马 的变种
WOWSERVER.EXE - 未查明的 NewHeur_PE 病毒
XINQIDIAN MSN.EXE - 未查明的 NewHeur_PE 病毒

NOD KILL
2个NewHeur_PE 上报

icedream89

扫描系统区域...
扫描所选择的目录和文件...
对象: XINQIDIAN.EXE
        路径: C:\Documents and Settings\Administrator\桌面\XINQIDIAN
        Status: 已发现病毒
        病毒: Dropped:Generic.Malware.P!dldPk!g.8413FE17 (BD 引擎)
对象: WOWSERVER.EXE
        路径: C:\Documents and Settings\Administrator\桌面\WOWmsn
        Status: 已发现病毒
        病毒: Dropped:Generic.Malware.P!dldPk!.1C281DB7 (BD 引擎)
对象: BROWSER.DLL
        路径: C:\Documents and Settings\Administrator\桌面\Khelper10[1].sys
        Status: 已发现病毒
        病毒: Generic.Malware.P!Pk!g.8413FE17 (BD 引擎)
扫描完成: 2008-10-23 17:38
    已检查 7 个文件
    已发现 3 个染毒文件
    发现 0 个可疑文件

303898443

卡巴501报，一病毒，二三木马。

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Desktop\WOWmsn'
C:\Users\morgan\Desktop\WOWmsn\
  2008-10-23_170046.png
  2008-10-23_170639.png
  BROWSER.DLL
    [0] Archive type: RSRC
    --> Object
    [NOTE]      The file was deleted!
  Khelper10.sys
  WOWSERVER.EXE
    [0] Archive type: RSRC
      --> Object
        [1] Archive type: RSRC
        --> Object
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      The file was deleted!
  XINQIDIAN MSN.EXE
    [0] Archive type: RSRC
    --> Object
    [NOTE]      The file was deleted!
  XINQIDIAN.EXE
    [0] Archive type: RSRC
      --> Object
        [1] Archive type: RSRC
        --> Object
    --> Object
    [NOTE]      The file was deleted!


End of the scan: 2008年10月23日  20:59
Used time: 00:05 Minute(s)

The scan has been done completely.

      1 Scanning directories
      7 Files were scanned
      4 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      4 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      0 Archives were scanned
      0 Warnings
      4 Notes

xi889

2008/10/24 12:05:54        Deleted: Heur.Trojan.Generic        F:\Files\BROWSER.DLL               
2008/10/24 12:05:54        Deleted: Heur.Trojan.Generic        F:\Files\WOWSERVER.EXE               
2008/10/24 12:05:55        Deleted: Heur.Trojan.Generic        F:\Files\XINQIDIAN MSN.EXE               
2008/10/24 12:05:58        Deleted: Heur.Trojan.Generic        F:\Files\XINQIDIAN.EXE               
TO KL

小飞侠.net

V:\virusdoc20081026\v005\004\Khelper10.sys.rar>>BROWSER.DLL        TrojanDownloader.Agent.aldi.hiwz.dll        木马        还未处理
V:\virusdoc20081026\v005\004\Khelper10.sys.rar>>Khelper10.sys        RootKit.Undef.tl.eyej        木马        还未处理
V:\virusdoc20081026\v005\004\WOWmsn.rar>>WOWSERVER.EXE        TrojanPSW.GameOL.rew.zkub        木马        还未处理
V:\virusdoc20081026\v005\004\XINQIDIAN.rar>>XINQIDIAN.EXE        RootKit.Undef.tl.cxmu        木马        还未处理

Palkia

病毒        2008-10-26  07:59:26        C:\Documents and Settings\Administrator\桌面\WOWmsn.rar\WOWSERVER.EXE        Win32.Troj.OnLineGames.ak.28672        清除成功