[病毒样本] 1x

显示全部楼层 · 发表于 2008-12-17 14:03:12

过卡巴

显示全部楼层 · 发表于 2008-12-17 14:06:05

norton報trojan.dropper

显示全部楼层 · 发表于 2008-12-17 14:08:06

Virus or unwanted program 'TR/Dldr.Delphi.Gen [trojan]'
detected in file 'C:\Sandbox\Administrator\virus\drive\D\3\3.exe.
Action performed: Deny access

显示全部楼层 · 发表于 2008-12-17 14:55:47

显示全部楼层 · 发表于 2008-12-17 15:45:07

Access to the data has been denied!

Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL: http://bbs.kafan.cn/attachment.p ... 3e&t=1229499874
Information: Is the TR/Dldr.Delphi.Gen Trojan
Generated by AntiVir WebGuard 8.0.15.0, AVE 8.2.0.45, VDF 7.1.0.243

显示全部楼层 · 发表于 2008-12-17 16:03:01

Start of the scan: Wednesday, 17 December, 2008  16:02

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\新資料夾\病毒\3.rar'
C:\Documents and Settings\tim\桌面\新資料夾\病毒\3.rar
[NOTE]    A backup was created as '49bab241.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-12-17 16:04:21

上报卡巴...

显示全部楼层 · 发表于 2008-12-18 00:15:20

入库

2008/12/18 0:13:54 已清除病毒 Worm.Win32.AutoRun.uqq G:\Temp\Virus\3.rar/3.exe

显示全部楼层 · 发表于 2008-12-18 15:27:40

不错，一层一层的
首先创建了
c:\windows\system\llwzjy081217.exe
c:\documents and seetings\all users\jjjydf16.ini
c:\system\mujbj32dla.dll
然后调用cmd删除自身
调用ie联网
对llwzjy081217.exe进行分析
破坏显示隐藏文件
利用ntsd.exe结束QQDoctor.exe等进程
影响劫持
AgentSvr.exe
AppSvc32.exe
AutoRun.exe
autoruns.exe
avgrssvc.exe
AvMonitor.exe
avp.com
avp.exe
CCenter.exe
ccSvcHst.exe
cross.exe
enc98.EXE
FileDsty.exe
  FTCleanerShell.exe
guangd.exe
HijackThis.exe
IceSword.exe
  iparmo.exe
Iparmor.exe
isPwdSvc.exe
kabaload.exe
KaScrScn.SCR
KASMain.exe
KASTask.exe
KAV32.exe
  KAVDX.exe
KAVPFW.exe
  KAVSetup.exe
  KAVStart.exe
KISLnchr.exe
KMailMon.exe
KMFilter.exe
  KPFW32.exe
等一大堆，我懒的弄了

显示全部楼层 · 发表于 2008-12-18 15:50:51

nod杀

[病毒样本] 1x

本帖子中包含更多资源

本帖子中包含更多资源