2x……

显示全部楼层 · 发表于 2009-5-23 06:05:37

Hello,

activex.exe,
xp.exe - Trojan.Win32.Antavmu.gi
vod999.exe - Trojan.Win32.StartPage.drc

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

[ 本帖最后由幸福的猪猪于 2009-5-23 06:26 编辑 ]

显示全部楼层 · 发表于 2009-5-23 06:58:08

EAV4 missed ALL
to ESET

显示全部楼层 · 发表于 2009-5-23 07:01:19

Starting the file scan:

Begin scan in 'D:\kafan\TDDOWNLOAD.zip'
D:\kafan\TDDOWNLOAD.zip
  [0] Archive type: ZIP
--> TDDOWNLOAD/activex.exe
   --> Object
      [DETECTION] Is the TR/Drop.Geral.NA.1 Trojan
--> TDDOWNLOAD/xp.exe
   --> Object
      [DETECTION] Is the TR/Drop.Geral.NA.1 Trojan
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\vod999.zip'

End of the scan: 2009年5月23日  07:03
Used time: 00:00 Minute(s)

The scan has been done completely.

   0 Scanned directories
   5 Files were scanned
   2 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   1 files were deleted
   0 Viruses and unwanted programs were repaired
   0 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   2 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2009-5-23 07:29:28

病毒信息
附件 vod999.zip 含有Mal/StartP-A病毒清除失败

显示全部楼层 · 发表于 2009-5-23 09:06:55

2009-05-23 09:05:37 运行应用程序    操作:阻止
进程路径:E:\virus\TDDOWNLOAD\xp.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c sc config ekrn start= disabled
触发规则:应用程序规则->AD:04…禁止的程序操作->*.*->*\cmd.exe

2009-05-23 09:05:39 运行应用程序    操作:阻止
进程路径:E:\virus\TDDOWNLOAD\activex.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c sc config ekrn start= disabled
触发规则:应用程序规则->AD:04…禁止的程序操作->*.*->*\cmd.exe

2009-05-23 09:05:42 运行应用程序    操作:阻止
进程路径:E:\virus\TDDOWNLOAD\xp.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c taskkill.exe /im ekrn.exe /f
触发规则:应用程序规则->AD:04…禁止的程序操作->*.*->*\cmd.exe

2009-05-23 09:05:44 运行应用程序    操作:阻止
进程路径:E:\virus\TDDOWNLOAD\activex.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c taskkill.exe /im ekrn.exe /f
触发规则:应用程序规则->AD:04…禁止的程序操作->*.*->*\cmd.exe

2009-05-23 09:05:47 运行应用程序    操作:阻止
进程路径:E:\virus\TDDOWNLOAD\xp.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c taskkill.exe /im egui.exe /f
触发规则:应用程序规则->AD:04…禁止的程序操作->*.*->*\cmd.exe

2009-05-23 09:05:49 运行应用程序    操作:阻止
进程路径:E:\virus\TDDOWNLOAD\activex.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c taskkill.exe /im egui.exe /f
触发规则:应用程序规则->AD:04…禁止的程序操作->*.*->*\cmd.exe

2009-05-23 09:06:10 创建文件    操作:阻止
进程路径:E:\virus\TDDOWNLOAD\xp.exe
文件路径:C:\WINDOWS\574453test.dll
触发规则:所有程序规则->FD:01…系统文件组->%SystemDrive%\*.dll

2009-05-23 09:06:11 运行应用程序    操作:阻止
进程路径:E:\virus\TDDOWNLOAD\xp.exe
文件路径:C:\WINDOWS\system32\rundll32.exe
命令行:C:\WINDOWS\574453test.dll testall
触发规则:所有程序规则->AD:01…禁止注入系统进程（黑名单）->%windir%\System32\rundll32.exe

2009-05-23 09:06:12 创建文件    操作:阻止
进程路径:E:\virus\TDDOWNLOAD\activex.exe
文件路径:C:\WINDOWS\576218test.dll
触发规则:所有程序规则->FD:01…系统文件组->%SystemDrive%\*.dll

2009-05-23 09:06:13 运行应用程序    操作:阻止
进程路径:E:\virus\TDDOWNLOAD\activex.exe
文件路径:C:\WINDOWS\system32\rundll32.exe
命令行:C:\WINDOWS\576218test.dll testall
触发规则:所有程序规则->AD:01…禁止注入系统进程（黑名单）->%windir%\System32\rundll32.exe

2009-05-23 09:06:30 创建文件    操作:阻止并结束进程
进程路径:E:\virus\TDDOWNLOAD\xp.exe
文件路径:C:\WINDOWS\extext593890t.exe
触发规则:所有程序规则->FD:01…系统文件组->%SystemDrive%\*.exe

2009-05-23 09:06:30 创建文件    操作:阻止
进程路径:E:\virus\vod999.exe
文件路径:C:\WINDOWS\~DFB8B3.tmp
触发规则:所有程序规则->FD:02…有关文件创建修改组（含黑名单）->%windir%\*

2009-05-23 09:06:32 创建文件    操作:阻止并结束进程
进程路径:E:\virus\TDDOWNLOAD\activex.exe
文件路径:C:\WINDOWS\extext595578t.exe
触发规则:所有程序规则->FD:01…系统文件组->%SystemDrive%\*.exe

显示全部楼层 · 发表于 2009-5-23 09:27:02

显示全部楼层 · 发表于 2009-5-23 10:59:36

vod999费尔不报

显示全部楼层 · 发表于 2009-5-23 18:23:41

TO DW

显示全部楼层 · 发表于 2009-5-23 20:51:09

to McAfee

显示全部楼层 · 发表于 2009-5-23 21:18:41

vod999.zip

	2009-05-23 Found nothing		2009-05-23 Found nothing
	2009-05-23 Found nothing		2009-05-23 Trojan.Win32.StartPage.drc
	2009-05-22 Found nothing		2009-05-23 Found nothing
	2009-05-23 Found nothing		2009-05-22 Found nothing
	2009-05-23 Found nothing		2009-05-22 Found nothing
	2009-05-23 Found nothing		2009-05-23 Found nothing
	2009-05-22 Found nothing		2009-05-22 Found nothing
	2009-05-23 Found nothing		2009-05-23 Mal/StartP-A
	2009-05-23 Found nothing		2009-05-22 Found nothing
	2009-05-22 Found nothing		2009-05-22 Found nothing
	2009-05-23 Found nothing

TDDOWNLOAD.zip

	2009-05-23 Found nothing		2009-05-23 Trojan.Win32.AntiAV
	2009-05-23 Trojan.Win32.AntiAV!IK		2009-05-23 Trojan.Win32.Antavmu.gi
	2009-05-22 Found nothing		2009-05-23 Found nothing
	2009-05-23 Found nothing		2009-05-22 Found nothing
	2009-05-23 TR/Drop.Geral.NA.1		2009-05-22 Sandbox: W32/Rootkit.XDV.dropper
	2009-05-23 Gen:Trojan.Heur.2015746F6F		2009-05-23 Found nothing
	2009-05-22 Found nothing		2009-05-22 Found nothing
	2009-05-23 Found nothing		2009-05-23 Mal/PWS-Fam
	2009-05-23 Found nothing		2009-05-22 Found nothing
	2009-05-22 Found nothing		2009-05-22 Found nothing
	2009-05-23 Found nothing

[病毒样本] 2x……

本帖子中包含更多资源

本帖子中包含更多资源