继续Trojan.Renos (AntiVir BitDefender Kaspersky etc. miss)

显示全部楼层 · 发表于 2009-7-3 13:36:27

a-squared	4.5.0.18	2009.07.03	Trojan-Downloader.Win32.Renos!IK
AhnLab-V3	5.0.0.2	2009.07.02	-
AntiVir	7.9.0.204	2009.07.02	-
Antiy-AVL	2.0.3.1	2009.07.02	-
Authentium	5.1.2.4	2009.07.02	-
Avast	4.8.1335.0	2009.07.02	-
AVG	8.5.0.386	2009.07.02	-
BitDefender	7.2	2009.07.03	-
CAT-QuickHeal	10.00	2009.07.02	-
ClamAV	0.94.1	2009.07.02	-
Comodo	1538	2009.07.02	-
DrWeb	5.0.0.12182	2009.07.03	-
eSafe	7.0.17.0	2009.07.02	Suspicious File
eTrust-Vet	31.6.6593	2009.07.02	-
F-Prot	4.4.4.56	2009.07.02	-
F-Secure	8.0.14470.0	2009.07.03	-
Fortinet	3.117.0.0	2009.07.03	-
GData	19	2009.07.03	-
Ikarus	T3.1.1.64.0	2009.07.03	Trojan-Downloader.Win32.Renos
Jiangmin	11.0.706	2009.07.02	-
K7AntiVirus	7.10.782	2009.07.02	-
Kaspersky	7.0.0.125	2009.07.03	-
McAfee	5664	2009.07.02	-
McAfee+Artemis	5664	2009.07.02	-
McAfee-GW-Edition	6.8.5	2009.07.03	-
Microsoft	1.4803	2009.07.02	-
NOD32	4211	2009.07.02	Win32/Agent.PSP
Norman	6.01.09	2009.07.02	-
nProtect	2009.1.8.0	2009.07.02	-
Panda	10.0.0.14	2009.07.02	-
PCTools	4.4.2.0	2009.07.02	-
Prevx	3.0	2009.07.03	Medium Risk Malware Downloader
Rising	21.36.40.00	2009.07.03	-
Sophos	4.43.0	2009.07.03	-
Sunbelt	3.2.1858.2	2009.07.02	-
Symantec	1.4.4.12	2009.07.03	-
TheHacker	6.3.4.3.360	2009.07.03	-
TrendMicro	8.950.0.1094	2009.07.03	-
VBA32	3.12.10.7	2009.07.03	-
ViRobot	2009.7.2.1816	2009.07.02	-
VirusBuster	4.6.5.0	2009.07.02	-

显示全部楼层 · 发表于 2009-7-3 13:46:07

to mcafee

显示全部楼层 · 发表于 2009-7-3 13:47:53

to kaba avira kill。

Hello,

c.exe - Trojan-Downloader.Win32.FraudLoad.evx

New malicious software was found in the attached file. Its detection will be included in the next update.
Thank you for your help.

?Filename	Result
c.exe	MALWARE

The file 'c.exe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Drop.Agent.crs. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.01.04.176.

[ 本帖最后由幸福的猪猪于 2009-7-3 16:56 编辑 ]

显示全部楼层 · 发表于 2009-7-3 13:49:43

显示全部楼层 · 发表于 2009-7-3 14:01:44

Kaspersky miss To KL

显示全部楼层 · 发表于 2009-7-3 14:06:04

Oh GOD！

这个恶意软件够虐的。

沙盒报告：http://www.sunbeltsecurity.com/c ... 43390265EDFD318A44C

显示全部楼层 · 发表于 2009-7-3 15:25:02

2009-7-3 15:24:00 创建新进程允许
进程: f:\program files\7-zip\7zfm.exe
目标: c:\documents and settings\administrator\local settings\temp\7zo206.tmp\c.exe
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7zO206.tmp\c.exe"
规则: [应用程序]*

2009-7-3 15:24:02 创建新进程阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo206.tmp\c.exe
目标: c:\documents and settings\administrator\local settings\temp\7zo206.tmp\c.exe
命令行: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7zO206.tmp\c.exe
规则: [应用程序]*

2009-7-3 15:24:06 创建文件阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo206.tmp\c.exe
目标: C:\WINDOWS\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job
规则: [文件组]系统执行文件 -> [文件]c:\windows\tasks; *.job

2009-7-3 15:24:08 创建文件阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo206.tmp\c.exe
目标: C:\WINDOWS\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job
规则: [文件组]系统执行文件 -> [文件]c:\windows\tasks; *.job

2009-7-3 15:24:09 创建文件阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo206.tmp\c.exe
目标: C:\WINDOWS\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job
规则: [文件组]系统执行文件 -> [文件]c:\windows\tasks; *.job

2009-7-3 15:24:13 创建文件阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo206.tmp\c.exe
目标: C:\WINDOWS\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job
规则: [文件组]系统执行文件 -> [文件]c:\windows\tasks; *.job

2009-7-3 15:24:15 创建文件阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo206.tmp\c.exe
目标: C:\WINDOWS\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job
规则: [文件组]系统执行文件 -> [文件]c:\windows\tasks; *.job

2009-7-3 15:24:16 创建文件阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo206.tmp\c.exe
目标: C:\WINDOWS\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job
规则: [文件组]系统执行文件 -> [文件]c:\windows\tasks; *.job

2009-7-3 15:24:18 修改注册表值阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo206.tmp\c.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Cognac
值: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7zO206.tmp\c.exe
规则: [注册表组]自动运行程序所在位置 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\*

2009-7-3 15:24:20 访问COM接口阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo206.tmp\c.exe
目标: {8856F961-340A-11D0-A96B-00C04FD705A2} Shell.Explorer.2
文件路径: C:\WINDOWS\system32\shdocvw.dll
规则: [应用程序]* -> [COM接口]{8856F961-340A-11D0-A96B-00C04FD705A2}

2009-7-3 15:24:38 创建新进程阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo206.tmp\c.exe
目标: c:\windows\system32\drwtsn32.exe
命令行: C:\WINDOWS\system32\drwtsn32 -p 3368 -e 688 -g
规则: [应用程序]*

2009-7-3 15:24:41 删除文件允许
进程: f:\program files\7-zip\7zfm.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\7zO206.tmp\c.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

显示全部楼层 · 发表于 2009-7-3 16:04:33

miss

• File Info
Name Value
Size 130221
MD5 285d4e7c07fa47d009b50ae509fbd493
SHA1 631ae03db7659e5f7582a7b7fbd518647f8c788d
SHA256 f5776d4f7e951681b5012e0cb68240f0fbf9021b6e9c9079dc3104779dc39e9c
Process Failed

• Verdict
Auto Analysis Verdict
Not Rated as Suspicious

显示全部楼层 · 发表于 2009-7-3 18:40:08

日期和时间：  2009-7-3 18:40:01
文件名：  c.rar
原始路径：  C:\Documents and Settings\Administrator\桌面\
文件大小：  127.17 KB
病毒名称：  Trojan-Downloader.Win32.Renos
建议：  保存并删除
特征编号：  1005136

[病毒样本] 继续Trojan.Renos (AntiVir BitDefender Kaspersky etc. miss)

本帖子中包含更多资源

回复 1楼 promised 的帖子

本帖子中包含更多资源

浏览过的版块