U盤病毒集中帖 (第39次更新) 20090409

显示全部楼层 · 发表于 2009-2-24 19:27:15

第14次更新
To KL

显示全部楼层 · 发表于 2009-2-24 23:24:58

第15次更新 to VB

显示全部楼层 · 发表于 2009-2-25 00:54:41

15次 ESET
C:\Documents and Settings\GUNDAM\桌面\15.rar » RAR » cx820.bat - Win32/PSW.OnLineGames.NMY trojan

显示全部楼层 · 发表于 2009-2-25 07:55:18

第14次miss 1
Starting the file scan:

Begin scan in 'D:\new\cx820.bat'
D:\new\cx820.bat
[DETECTION] Is the TR/Onlinegames.648 Trojan
[NOTE]    A backup was created as '49dc8985.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\new\mt.com'
D:\new\mt.com
[DETECTION] Is the TR/Onlinegames.778 Trojan
[NOTE]    A backup was created as '49d28981.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\new\qqu219p8.exe'

End of the scan: 2009年2月25日  07:55
Used time: 00:07 Minute(s)

The scan has been done completely.

   0 Scanning directories
   3 Files were scanned
   2 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   2 files were deleted
   0 files were repaired
   2 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   0 Archives were scanned
   0 Warnings
   2 Notes

[ 本帖最后由 Sebastian 于 2009-2-25 07:58 编辑 ]

显示全部楼层 · 发表于 2009-2-25 07:57:39

第15次miss 2
Starting the file scan:

Begin scan in 'D:\new\cx820.bat'
Begin scan in 'D:\new\mt.com'

End of the scan: 2009年2月25日  07:58
Used time: 00:06 Minute(s)

The scan has been done completely.

   0 Scanning directories
   2 Files were scanned
   0 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   0 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2009-2-26 07:45:39

第16次更新 VirusBuster found nothing

显示全部楼层 · 发表于 2009-2-26 07:58:09

程序：
C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\RAR$DI00.445\GXUL.COM
是可疑程序!
试图修改关键系统文件!
是否阻止该进程继续运行?
程序：
C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\RAR$DI00.445\GXUL.COM
木马程序生成以下文件：
1) C:\WINDOWS\SYSTEM32\URET463.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2009-2-26 10:14:44

第15、16次更新
To KL

显示全部楼层 · 发表于 2009-2-26 18:40:28

13~16 TO DW
DW全數回復
Original file name: mt.com
Original file name: jg.com
Original file name:gxul.com
Original file name:mt.com
Virus: Trojan.PWS.Gamania.10780.
-
Original file name:qqu219p8.exe
Original file name: qn1.bat
Original file name: cx820.bat
Virus: Trojan.PWS.Wsgame.4983.
-
Original file name:coupons.exe
Original file name:sales.exe
Virus: Trojan.Spambot.4331

[ 本帖最后由黑衣~魂于 2009-2-26 18:53 编辑 ]

显示全部楼层 · 发表于 2009-2-26 20:17:25

红伞上报更新中~
http://bbs.kafan.cn/redirect.php ... 322&ptid=422339

[病毒样本] U盤病毒 集中帖 (第39次更新) 20090409

[病毒样本] U盤病毒集中帖 (第39次更新) 20090409