Adware Virus DownLoader(释放并下载大量病毒-第290次更新）

显示全部楼层 · 发表于 2009-3-29 20:31:31

第12-13次更新
Starting the file scan:

Begin scan in 'D:\new\D0729678D520272DF9D0C322BBC3E652.exe'
D:\new\D0729678D520272DF9D0C322BBC3E652.exe
  [0] Archive type: NSIS
--> [TempDir]/setup_1027272.exe
   --> Object
      [2] Archive type: OVL
      --> Object
      [DETECTION] Is the TR/Agent.pxw Trojan
--> [TempDir]/small66.exe
   --> Object
      [DETECTION] Contains recognition pattern of the ADSPY/Agent.XA adware or spyware
--> [TempDir]/4005.exe
   [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
--> [TempDir]/llly66.exe
   [DETECTION] Contains recognition pattern of the DR/Spy.Agent.ahoi dropper
   --> [UnknownDir]/install.exe
      [DETECTION] Is the TR/Agent.FWQ Trojan
   --> [UnknownDir]/nlpsa.txt
      [DETECTION] Is the TR/Downloader.Gen Trojan
   --> [UnknownDir]/setup.exe
      [DETECTION] Is the TR/Agent.fwq.1 Trojan
   --> [UnknownDir]/sysmain.dat
      [DETECTION] Is the TR/Kaba.73278 Trojan
   --> [UnknownDir]/sysvc.dat
      [DETECTION] Is the TR/Spy.Agent.abzr Trojan
--> [TempDir]/service.exe
   [DETECTION] Is the TR/ATRAPS.Gen Trojan
[NOTE]    A backup was created as '4a066a72.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\new\30B886CAAF839340BAF2A0AD0FC231B7.exe'
D:\new\30B886CAAF839340BAF2A0AD0FC231B7.exe
  [0] Archive type: NSIS
--> [TempDir]/setup_1027272.exe
   --> Object
      [2] Archive type: OVL
      --> Object
      [DETECTION] Is the TR/Agent.pxw Trojan
--> [TempDir]/small66.exe
   --> Object
      [DETECTION] Contains recognition pattern of the ADSPY/Agent.XA adware or spyware
--> [TempDir]/llly66.exe
   [DETECTION] Contains recognition pattern of the DR/Spy.Agent.ahoi dropper
   --> [UnknownDir]/install.exe
      [DETECTION] Is the TR/Agent.FWQ Trojan
   --> [UnknownDir]/nlpsa.txt
      [DETECTION] Is the TR/Downloader.Gen Trojan
   --> [UnknownDir]/setup.exe
      [DETECTION] Is the TR/Agent.fwq.1 Trojan
   --> [UnknownDir]/sysmain.dat
      [DETECTION] Is the TR/Kaba.73278 Trojan
   --> [UnknownDir]/sysvc.dat
      [DETECTION] Is the TR/Spy.Agent.abzr Trojan
--> [TempDir]/service.exe
   [DETECTION] Is the TR/ATRAPS.Gen Trojan
--> [TempDir]/4005.exe
   [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
[NOTE]    A backup was created as '4a116a73.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2009年3月29日  20:32
Used time: 00:03 Minute(s)

The scan has been done completely.

   0 Scanned directories
   44 Files were scanned
   20 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   2 files were deleted
   0 Viruses and unwanted programs were repaired
   2 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   24 Files not concerned
   6 Archives were scanned
   0 Warnings
   2 Notes

显示全部楼层 · 发表于 2009-3-30 08:42:21

Name: Trojan.Agent2.PW
Type: Trojan

Description:

Files:
c:\users\administrator\desktop\30b886caaf839340baf2a0ad0fc231b7.exe

显示全部楼层 · 发表于 2009-3-30 18:19:37

Update

显示全部楼层 · 发表于 2009-3-30 18:23:21

第14次更新
Starting the file scan:

Begin scan in 'D:\new\A39B4DD0AC5B5E1C53C7DD377ABC209D.exe'
D:\new\A39B4DD0AC5B5E1C53C7DD377ABC209D.exe
  [0] Archive type: NSIS
[DETECTION] Contains recognition pattern of the DR/Agent.ijd.13 dropper
--> [TempDir]/setup_1027272.exe
   --> Object
      [2] Archive type: OVL
      --> Object
      [DETECTION] Is the TR/Agent.pxw Trojan
--> [TempDir]/small66.exe
   --> Object
      [DETECTION] Contains recognition pattern of the ADSPY/Agent.XA adware or spyware
--> [TempDir]/llly66.exe
   [DETECTION] Contains recognition pattern of the DR/Spy.Agent.ahoi dropper
   --> [UnknownDir]/install.exe
      [DETECTION] Is the TR/Agent.FWQ Trojan
   --> [UnknownDir]/nlpsa.txt
      [DETECTION] Is the TR/Downloader.Gen Trojan
   --> [UnknownDir]/setup.exe
      [DETECTION] Is the TR/Agent.fwq.1 Trojan
   --> [UnknownDir]/sysmain.dat
      [DETECTION] Is the TR/Kaba.73278 Trojan
   --> [UnknownDir]/sysvc.dat
      [DETECTION] Is the TR/Spy.Agent.abzr Trojan
--> [TempDir]/service.exe
   [DETECTION] Is the TR/ATRAPS.Gen Trojan
--> [TempDir]/4005.exe
   [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
--> [TempDir]/lqbz81.exe
   [DETECTION] Is the TR/Agent2.gsr Trojan
[NOTE]    A backup was created as '4a099e1f.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2009年3月30日  18:24
Used time: 00:01 Minute(s)

The scan has been done completely.

   0 Scanned directories
   22 Files were scanned
   12 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   1 files were deleted
   0 Viruses and unwanted programs were repaired
   1 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   10 Files not concerned
   3 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2009-3-30 23:10:11

Name: Trojan.Agent2.PW
Type: Trojan

Description:

Files:
c:\users\administrator\desktop\a39b4dd0ac5b5e1c53c7dd377abc209d.exe

显示全部楼层 · 发表于 2009-3-31 01:08:32

let me check these files.

显示全部楼层 · 发表于 2009-3-31 18:27:32

Update

显示全部楼层 · 发表于 2009-3-31 18:37:34

第15次更新
'ADSPY/Agent.XA [adware]'
'TR/ATRAPS.Gen [trojan]'
'W32/Cekar.B [virus]'

木马名称：Rootkit.Win32.Agent.dgd

程序：
C:\DOCUMENTS AND SETTINGS\XXX\LOCAL SETTINGS\TEMP\SETUP_1027272.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称：Trojan-Spy.Win32.Agent.wzf

程序：
C:\DOCUMENTS AND SETTINGS\XXX\LOCAL SETTINGS\TEMP\LLLY66.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称：Trojan.Win32.Delf.hiu

程序：
C:\DOCUMENTS AND SETTINGS\XXX\LOCAL SETTINGS\TEMP\4005.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称：Trojan.Win32.Agent.aqfo

程序：
C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\LQBZ81.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序：
C:\DOCUMENTS AND SETTINGS\\桌面\0ED2FE44B55500F78DF1C7E90481C489.EXE
木马程序生成以下文件：
1) C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\IETIMBAR(-50331498).EXE
2) C:\PROGRAM FILES\INTERNET EXPLORER\IETIMBAR\IETIMBAR.DLL
3) C:\PROGRAM FILES\INTERNET EXPLORER\IETIMBAR\UNINSTALL.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2009-3-31 23:47:17

Name: Trojan.Agent2.PW
Type: Trojan

Description:

Files:
c:\users\administrator\desktop\0ed2fe44b55500f78df1c7e90481c489.exe

Name: Packed/Upack
Type: Sequence

Description:

Files:
c:\users\administrator\desktop\0ed2fe44b55500f78df1c7e90481c489.exe

显示全部楼层 · 发表于 2009-4-1 17:47:23

Update

[病毒样本] Adware Virus DownLoader(释放并下载大量病毒-第290次更新）

回复 40楼 935623508 的帖子

回复 43楼 935623508 的帖子

回复 47楼 935623508 的帖子