查看: 3517|回复: 18
收起左侧

[病毒样本] 昨日病毒有入侵此机子,造成再次重装系统

[复制链接]
molicn
发表于 2009-2-23 19:35:35 | 显示全部楼层 |阅读模式
RT

文件 setup.exe 接收于 2009.02.23 12:30:20 (CET)
当前状态: 正在读取 ... 队列中 等待中 扫描中 完成 未发现 停止

结果: 1/39 (2.57%)

正在读取服务器信息中...
您的文件所排队列位置: ___.
预计开始时间为 ___ 和 ___
之间.
扫描完成前请勿关闭窗口.
目前针对您的文件所进行的扫描进程已停止, 我们将会在稍后恢复.
如果您的等候时间超过 5 分钟, 请重新发送文件.
您的文件目前正在被 VirusTotal 扫描中,
结果将会稍后完成时生成.
格式化文本
打印结果


您的文件已过期或不存在.
目前服务已停止, 您的文件将会稍后的未知时间内进行扫描 (位置:
). 您可以继续等待回应 (自动读取) 或者在下面的表单内输入您的电子邮件地址, 并按下 "获取", 当扫描完成时, 系统会自动给您发送电子邮件通知.  
Email:



反病毒引擎版本最后更新扫描结果
a-squared4.0.0.932009.02.23-
AhnLab-V32009.2.23.22009.02.23-
AntiVir7.9.0.872009.02.23-
Authentium5.1.0.42009.02.23-
Avast4.8.1335.02009.02.22-
AVG8.0.0.2372009.02.23-
BitDefender7.22009.02.23-
CAT-QuickHeal10.002009.02.22-
ClamAV0.94.12009.02.23-
Comodo9842009.02.20-
DrWeb4.44.0.091702009.02.23-
eSafe7.0.17.02009.02.19-
eTrust-Vet31.6.63682009.02.20-
F-Prot4.4.4.562009.02.23-
F-Secure8.0.14470.02009.02.23-
Fortinet3.117.0.02009.02.23-
GData192009.02.23-
IkarusT3.1.1.45.02009.02.23-
K7AntiVirus7.10.6392009.02.21Trojan.Win32.Malware.1
Kaspersky7.0.0.1252009.02.23-
McAfee55332009.02.22-
McAfee+Artemis55332009.02.22-
Microsoft1.43062009.02.23-
NOD3238802009.02.23-
Norman6.00.062009.02.20-
nProtect2009.1.8.02009.02.23-
Panda10.0.0.102009.02.22-
PCTools4.4.2.02009.02.22-
Prevx1V22009.02.23-
Rising21.18.02.002009.02.23-
SecureWeb-Gateway6.7.62009.02.23-
Sophos4.39.02009.02.23-
Sunbelt3.2.1855.22009.02.17-
Symantec102009.02.23-
TheHacker6.3.2.5.2632009.02.23-
TrendMicro8.700.0.10042009.02.23-
VBA323.12.10.02009.02.22-
ViRobot2009.2.23.16182009.02.23-
VirusBuster4.5.11.02009.02.22-
附加信息
File size: 526326 bytes
MD5...: edf2f081a6a8cd96e333a6e2627118dd
SHA1..: fd12e89eba060f684e3242e1a7419715a53ae64d
SHA256: 2343a884b8c430fc3937c75541a0fc3a22eb67da38e6b206c665821166604ef6
SHA512: b695ae5a843c6b3ea0929bc231af3aec893ee422a16a0a67f2d5bbb90b1d7ac4
98d94953a81861c4407afe81c71ca2724f212b1ac66eda0e56b0fd5d1829b1f3
ssdeep: 12288:O1DYrcN7Bk/RQrUE5+H+XAVBi46txEJ5GIMUFAjVRrkmMEf:OdYkG+rUE5
gtbi4sEqIMUkhknEf
PEiD..: BobSoft Mini Delphi -> BoB / BobSoft
TrID..: File type identification
InstallShield setup (53.8%)
Win32 Executable Delphi generic (18.3%)
Win32 Executable Generic (10.6%)
Win32 Dynamic Link Library (generic) (9.4%)
Win16/32 Executable Delphi generic (2.5%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x417de0
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x16e44 0x17000 6.45 e27b030008304239b7164145b3f51744
DATA 0x18000 0x700 0x800 3.19 22c2125508951e55c9f7304c58804faf
BSS 0x19000 0x8ad 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0x1a000 0x14d0 0x1600 4.79 08b2ec6b7f09cb82de12e663d8041976
.tls 0x1c000 0x8 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rdata 0x1d000 0x18 0x200 0.20 17291f4d14f4488dcc09f44b431f3d22
.reloc 0x1e000 0x11c4 0x1200 6.70 c6aec7ca10da40ac288033bc4bdfc126
.rsrc 0x20000 0x1cfc 0x1e00 4.78 4aadb1b498d07932ff9cadec68378e24

( 16 imports )
> kernel32.dll: GetCurrentThreadId, WideCharToMultiByte, ExitProcess, UnhandledExceptionFilter, RtlUnwind, RaiseException, TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA, FreeLibrary, HeapFree, HeapReAlloc, HeapAlloc, GetProcessHeap
> oleaut32.dll: SysFreeString, SysReAllocStringLen
> advapi32.dll: RegSetValueExA, RegQueryValueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegEnumKeyExA, RegCreateKeyExA, RegCloseKey, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid, AdjustTokenPrivileges
> kernel32.dll: WritePrivateProfileStringA, WriteFile, WinExec, WaitForSingleObject, TerminateProcess, Sleep, SetFileTime, SetFilePointer, SetFileAttributesA, SetErrorMode, SetEndOfFile, SetCurrentDirectoryA, RemoveDirectoryA, ReadFile, OpenProcess, MultiByteToWideChar, LocalFileTimeToFileTime, LoadLibraryA, GlobalFree, GlobalAlloc, GetWindowsDirectoryA, GetVersionExA, GetVersion, GetUserDefaultLangID, GetTimeFormatA, GetTempPathA, GetSystemDirectoryA, GetShortPathNameA, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetLastError, GetFullPathNameA, GetFileTime, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThread, GetCurrentProcess, GetComputerNameA, GetCommandLineA, FreeLibrary, FormatMessageA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, ExpandEnvironmentStringsA, DosDateTimeToFileTime, DeleteFileA, CreateFileA, CreateDirectoryA, CompareStringA, CloseHandle
> gdi32.dll: StretchDIBits, StretchBlt, SetWindowOrgEx, SetTextColor, SetStretchBltMode, SetRectRgn, SetROP2, SetPixel, SetDIBits, SetBrushOrgEx, SetBkMode, SetBkColor, SelectObject, SaveDC, RestoreDC, OffsetRgn, MoveToEx, IntersectClipRect, GetTextExtentPoint32A, GetStockObject, GetPixel, GetObjectA, GetDIBits, ExtSelectClipRgn, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgn, CreateFontIndirectA, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CombineRgn, BitBlt, AddFontResourceA
> user32.dll: wvsprintfA, WaitMessage, ValidateRect, TranslateMessage, ShowWindow, SetWindowPos, SetWindowLongA, SetTimer, SetPropA, SetParent, SetForegroundWindow, SetFocus, SetCursor, SendMessageA, ScreenToClient, RemovePropA, ReleaseDC, RegisterClassA, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, MessageBoxA, LoadIconA, LoadCursorA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsIconic, InvalidateRect, GetWindowTextLengthA, GetWindowTextA, GetWindowRgn, GetWindowRect, GetWindowLongA, GetWindowDC, GetUpdateRgn, GetSystemMetrics, GetSystemMenu, GetSysColor, GetPropA, GetParent, GetWindow, GetKeyState, GetFocus, GetDCEx, GetDC, GetCursorPos, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, FindWindowA, FillRect, ExitWindowsEx, EnumWindows, EndPaint, EnableWindow, EnableMenuItem, DrawTextA, DrawIcon, DispatchMessageA, DestroyWindow, DestroyIcon, DeleteMenu, DefWindowProcA, CopyImage, ClientToScreen, CheckRadioButton, CallWindowProcA, BeginPaint, CharLowerBuffA
> winmm.dll: timeKillEvent, timeSetEvent
> user32.dll: CreateWindowExA
> oleaut32.dll: SysAllocStringLen
> ole32.dll: OleInitialize
> comctl32.dll: ImageList_Draw, ImageList_SetBkColor, ImageList_Create, InitCommonControls
> shell32.dll: SHGetFileInfoA
> shell32.dll: ShellExecuteExA, ShellExecuteA
> cabinet.dll: FDIDestroy, FDICopy, FDICreate
> ole32.dll: OleInitialize, CoTaskMemFree, CoCreateInstance, CoUninitialize, CoInitialize
> shell32.dll: SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHChangeNotify, SHBrowseForFolderA

( 0 exports )

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
江湖的fans
发表于 2009-2-23 19:42:37 | 显示全部楼层
TO  KL  KV  

鉴定是否为病毒

eset  0
ldy144028
头像被屏蔽
发表于 2009-2-23 19:42:53 | 显示全部楼层
毒霸 MISS
saga3721
发表于 2009-2-23 19:46:21 | 显示全部楼层
类似好几个弹框不多贴了
程序:
C:\DOCUMENTS AND SETTINGS\\桌面\SETUP.EXE
并生成以下文件:
1) D:\EXPLORER.EXE
2) C:\AUTORUN.INF
3) D:\SETUP.EXE
4) D:\AUTORUN.INF

是否删除木马程序及其衍生物?
wsmurderer
发表于 2009-2-23 19:52:53 | 显示全部楼层
原帖由 saga3721 于 2009-2-23 19:46 发表
类似好几个弹框不多贴了
程序:
C:\DOCUMENTS AND SETTINGS\\桌面\SETUP.EXE
并生成以下文件:
1) D:\EXPLORER.EXE
2) C:\AUTORUN.INF
3) D:\SETUP.EXE
4) D:\AUTORUN.INF

是否删除木马程序及其衍生物?

看来不是什么好鸟
Palkia
发表于 2009-2-23 19:58:04 | 显示全部楼层
to rs
saga3721
发表于 2009-2-23 20:07:26 | 显示全部楼层

回复 5楼 wsmurderer 的帖子

中了之后重启C盘也打不开了,D盘好像还创建了瑞星字样的文件。现在的微点重启可杀,前些天的版本不可(微点主动防御软件  试用版 程序版本: 1.2.10580.0171 特征版本: 1.6.1014.090215 还不能杀)

[ 本帖最后由 saga3721 于 2009-2-23 20:08 编辑 ]
尤金卡巴斯基
发表于 2009-2-23 20:07:52 | 显示全部楼层
To KL
wsmurderer
发表于 2009-2-23 20:27:59 | 显示全部楼层

回复 8楼 尤金卡巴斯基 的帖子

微点的规则更新还是比较快的,不过前几天有个灰鸽子过了微点,上报微点后加入了特征码,不过只测主防依旧被过
Oday
发表于 2009-2-23 20:57:07 | 显示全部楼层
Avira没反应
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-12-23 02:54 , Processed in 0.117358 second(s), 3 queries , Redis On.

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表