Adware Virus DownLoader(释放并下载大量病毒-第290次更新）

显示全部楼层 · 发表于 2009-4-3 22:56:42

18 to VB

显示全部楼层 · 发表于 2009-4-4 10:04:00

30~4.3
风险程序 2009-04-04  10:04:22 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(17).rar\8213F674F2751623B26011C81F9B31D9.exe\$TEMP\small66.exe Win32.Adware.BHO.348160 (广告软件) 跳过，未处理
风险程序 2009-04-04  10:04:22 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(18).rar\E3EBECE392CCA425D76C03F10F5AAD59.exe\$TEMP\small66.exe Win32.Adware.BHO.348160 (广告软件) 跳过，未处理
风险程序 2009-04-04  10:04:22 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(16).rar\B1FDD3296BCF2D2F883705720E698B4C.exe\$TEMP\small66.exe Win32.Adware.BHO.348160 (广告软件) 跳过，未处理
风险程序 2009-04-04  10:04:22 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(15).rar\0ED2FE44B55500F78DF1C7E90481C489.exe\$TEMP\small66.exe Win32.Adware.BHO.348160 (广告软件) 跳过，未处理
风险程序 2009-04-04  10:04:22 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(14).rar\A39B4DD0AC5B5E1C53C7DD377ABC209D.exe\$TEMP\small66.exe Win32.Adware.BHO.348160 (广告软件) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(17).rar\8213F674F2751623B26011C81F9B31D9.exe\$TEMP\lqbz81.exe Win32.Hack.Agent.u.60928 (后门程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(17).rar\8213F674F2751623B26011C81F9B31D9.exe\$TEMP\svchosts.exe Win32.Troj.Buzus.30208 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(17).rar\8213F674F2751623B26011C81F9B31D9.exe\$TEMP\service.exe Win32.Troj.Delf.nk.808960 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(17).rar\8213F674F2751623B26011C81F9B31D9.exe\$TEMP\setup_1027272.exe Win32.Troj.Agent.114688 (跑跑偷车贼变种) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(18).rar\E3EBECE392CCA425D76C03F10F5AAD59.exe\$TEMP\lqbz82.exe Win32.Hack.Agent.u.86016 (后门程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(18).rar\E3EBECE392CCA425D76C03F10F5AAD59.exe\$TEMP\service.exe Win32.Troj.Delf.nk.808960 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(18).rar\E3EBECE392CCA425D76C03F10F5AAD59.exe\$TEMP\svchosts.exe Win32.Troj.Buzus.30208 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(18).rar\E3EBECE392CCA425D76C03F10F5AAD59.exe\$TEMP\setup_1027272.exe Win32.Troj.Agent.114688 (跑跑偷车贼变种) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(16).rar\B1FDD3296BCF2D2F883705720E698B4C.exe\$TEMP\009.exe Win32.Troj.Crypt.D.184320 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(16).rar\B1FDD3296BCF2D2F883705720E698B4C.exe\$TEMP\lqbz81.exe Win32.Hack.Agent.u.60928 (后门程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(16).rar\B1FDD3296BCF2D2F883705720E698B4C.exe\$TEMP\svchosts.exe Win32.Troj.Buzus.30208 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(16).rar\B1FDD3296BCF2D2F883705720E698B4C.exe\$TEMP\service.exe Win32.Troj.Delf.nk.808960 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(16).rar\B1FDD3296BCF2D2F883705720E698B4C.exe\$TEMP\setup_1027272.exe Win32.Troj.Agent.114688 (跑跑偷车贼变种) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(15).rar\0ED2FE44B55500F78DF1C7E90481C489.exe\$TEMP\009.exe Win32.Troj.Crypt.D.184320 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(15).rar\0ED2FE44B55500F78DF1C7E90481C489.exe\$TEMP\lqbz81.exe Win32.Hack.Agent.u.60928 (后门程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(15).rar\0ED2FE44B55500F78DF1C7E90481C489.exe\$TEMP\4005.exe Win32.Troj.Delf.bq.73728 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(15).rar\0ED2FE44B55500F78DF1C7E90481C489.exe\$TEMP\service.exe Win32.Troj.Delf.nk.808960 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(15).rar\0ED2FE44B55500F78DF1C7E90481C489.exe\$TEMP\llly66.exe Win32.Troj.Agent.40960 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(15).rar\0ED2FE44B55500F78DF1C7E90481C489.exe\$TEMP\setup_1027272.exe Win32.Troj.Agent.114688 (跑跑偷车贼变种) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(14).rar\A39B4DD0AC5B5E1C53C7DD377ABC209D.exe\$TEMP\lqbz81.exe Win32.Hack.Agent.u.60928 (后门程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(14).rar\A39B4DD0AC5B5E1C53C7DD377ABC209D.exe\$TEMP\4005.exe Win32.Troj.Delf.bq.73728 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(14).rar\A39B4DD0AC5B5E1C53C7DD377ABC209D.exe\$TEMP\service.exe Win32.Troj.Delf.nk.808960 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(14).rar\A39B4DD0AC5B5E1C53C7DD377ABC209D.exe\$TEMP\llly66.exe Win32.Troj.Agent.40960 (木马程序) 跳过，未处理
病毒 2009-04-04  10:04:21 C:\Documents and Settings\Administrator\桌面\dzh_2008v5(14).rar\A39B4DD0AC5B5E1C53C7DD377ABC209D.exe\$TEMP\setup_1027272.exe Win32.Troj.Agent.114688 (跑跑偷车贼变种) 跳过，未处理

显示全部楼层 · 发表于 2009-4-4 13:21:00

Update

显示全部楼层 · 发表于 2009-4-4 13:25:45

第19次更新
Starting the file scan:

Begin scan in 'D:\kafan\81598BB7DB8AEF5CFC01D107B69E81D8.exe'
D:\kafan\81598BB7DB8AEF5CFC01D107B69E81D8.exe
  [0] Archive type: NSIS
--> [TempDir]/setup_1027272.exe
   --> Object
      [2] Archive type: OVL
      --> Object
      [DETECTION] Is the TR/Agent.pxw Trojan
--> [TempDir]/small66.exe
   --> Object
      [DETECTION] Contains recognition pattern of the ADSPY/Agent.XA adware or spyware
--> [TempDir]/svchosts.exe
   [DETECTION] Contains recognition pattern of the DR/Delphi.Gen dropper
--> [TempDir]/service.exe
   [DETECTION] Is the TR/ATRAPS.Gen Trojan
--> [TempDir]/3.exe
   [DETECTION] Is the TR/Crypt.FKM.Gen Trojan
--> [TempDir]/spools.exe
   --> Object
      [DETECTION] Contains recognition pattern of the W32/Cekar.B Windows virus
[NOTE]    A backup was created as '4a0befc7.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2009年4月4日  13:26
Used time: 00:02 Minute(s)

The scan has been done completely.

   0 Scanned directories
   16 Files were scanned
   6 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   1 files were deleted
   0 Viruses and unwanted programs were repaired
   1 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   10 Files not concerned
   2 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2009-4-4 16:06:19

Name: Packed/FSG
Type: Sequence

Description:

Files:
c:\users\administrator\desktop\81598bb7db8aef5cfc01d107b69e81d8.exe

Name: Packed/Upack
Type: Sequence

Description:

Files:
c:\users\administrator\desktop\81598bb7db8aef5cfc01d107b69e81d8.exe

显示全部楼层 · 发表于 2009-4-5 13:10:37

Update

显示全部楼层 · 发表于 2009-4-5 13:20:12

4-5 解包后AVIRA MISS3

显示全部楼层 · 发表于 2009-4-5 13:53:48

to rav

显示全部楼层 · 发表于 2009-4-5 14:06:44

4-5运行红伞报
'ADSPY/Agent.XA [adware]'
'TR/Crypt.FKM.Gen [trojan]'
'W32/Cekar.B [virus]'
'TR/ATRAPS.Gen [trojan]'

微点也杀

显示全部楼层 · 发表于 2009-4-5 14:16:34

2009/4/5 14:14:52 已清除木马程序 Trojan.Win32.Buzus.atlg E:\download\dzh_2008v5(20).rar
2009/4/5 14:14:52 已清除木马程序 Trojan.Win32.Agent.bzoj E:\download\dzh_2008v5(20).rar/4A0A452255E108FE14129CCE4E5765CF.exe//stream//data0004//FSG
2009/4/5 14:14:52 已清除木马程序 Trojan.Win32.Buzus.atlg E:\download\dzh_2008v5(20).rar/4A0A452255E108FE14129CCE4E5765CF.exe//stream//data0008

[病毒样本] Adware Virus DownLoader(释放并下载大量病毒-第290次更新）

回复 56楼 935623508 的帖子

29