[病毒样本] n

显示全部楼层 · 发表于 2009-7-12 14:22:13

hxxp://qkyygo.com/qk/x.jpg
hxxp://www.mysnda.com/e/a.gif 带密码
hxxp://www.mysnda.com/e/a.css
hxxp://winddk.ch.ma/dd.txt

显示全部楼层 · 发表于 2009-7-12 14:26:23

D:\TDDownload\abbr_a4b77fa330aeb066949a607a9aa2faa5.rar/照片 .exe 已检测: Trojan-GameThief.Win32.Lmir!IK
好长的名字

显示全部楼层 · 发表于 2009-7-12 14:28:15

Avira
Starting the file scan:

Begin scan in 'D:\kafan\abbr_a4b77fa330aeb066949a607a9aa2faa5.rar'
D:\kafan\abbr_a4b77fa330aeb066949a607a9aa2faa5.rar
  [0] Archive type: RAR
--> ￕￕￆﾬ                                                                                                                                                                         .exe
   [DETECTION] Is the TR/Crypt.NSPM.Gen Trojan
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\1.exe'
D:\kafan\1.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/Wuca.CW back-door program
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\2.exe'
D:\kafan\2.exe
[DETECTION] Contains recognition pattern of the ADSPY/Agent.160989 adware or spyware
--> 52D77ECE7B32424dB93B9A6EFBDDB0DF/[TempDir]/235.exe
   [DETECTION] Contains recognition pattern of the DR/Cinmus.fow dropper
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\7.exe'
D:\kafan\7.exe
  [0] Archive type: NSIS
[DETECTION] Contains recognition pattern of the DR/BHO.uzk.23 dropper
--> SOFTWARE/MicroPlugins/Common/cpush.dll
   [DETECTION] Contains recognition pattern of the ADSPY/Cinmus.ucc.6 adware or spyware
--> SOFTWARE/MicroPlugins/Common/cpush.tmp
   [DETECTION] Contains recognition pattern of the ADSPY/Cinmus.ucc.6 adware or spyware
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\8.exe'
D:\kafan\8.exe
[DETECTION] Is the TR/PSW.OnlineGames.vcqj.7 Trojan
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\a.css'
D:\kafan\a.css
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\a.gif'
Begin scan in 'D:\kafan\x.jpg'
Begin scan in 'D:\kafan\9.exe'
D:\kafan\9.exe
[DETECTION] Contains recognition pattern of the DR/Zhongsou.170576 dropper
--> [ProgramFilesDir]/Internet Explorer/IETimber/IETimber.dll
   [DETECTION] Contains recognition pattern of the ADSPY/Timber.BHO adware or spyware
[NOTE]    The file was deleted!

End of the scan: 2009年7月12日  14:29
Used time: 00:01 Minute(s)

The scan has been done completely.

   0 Scanned directories
   20 Files were scanned
   11 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   7 files were deleted
   0 Viruses and unwanted programs were repaired
   0 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   9 Files not concerned
   5 Archives were scanned
   0 Warnings
   7 Notes

显示全部楼层 · 发表于 2009-7-12 15:05:38

2009-07-12 15:05:30 修改文件    操作:阻止
进程路径:E:\abbr_a4b77fa330aeb066949a607a9aa2faa5\照片                                                                                                                                                                         .exe
文件路径:(隐藏文件)E:\abbr_a4b77fa330aeb066949a607a9aa2faa5\照片                                                                                                                                                                         .exe
触发规则:所有程序规则->全局设置->E:\*.exe

2009-07-12 15:05:30 创建注册表值    操作:阻止
进程路径:E:\abbr_a4b77fa330aeb066949a607a9aa2faa5\照片                                                                                                                                                                         .exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
注册表名称:PendingFileRenameOperations
触发规则:所有程序规则->系统设置->HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Session Manager

2009-07-12 15:05:40 创建文件    操作:阻止并结束进程
进程路径:E:\abbr_a4b77fa330aeb066949a607a9aa2faa5\照片                                                                                                                                                                         .exe
文件路径:C:\sam.dll
触发规则:所有程序规则->全局设置->%SystemDrive%\*

显示全部楼层 · 发表于 2009-7-12 15:06:50

to mpav

显示全部楼层 · 发表于 2009-7-12 16:50:18

To KL

显示全部楼层 · 发表于 2009-7-12 17:26:12

abbr_a4b77fa330aeb066949a607a9aa2faa5.rar/照片 $rK;D:\My Documents\桌面\test\abbr_a4b77fa330aeb066949a607a9aa2faa5.rar/照片 $rK;Trojan.KillProc.1565;;
照片 $rK;D:\My Documents\桌面\test;Container contains infected objects;;
abbr_a4b77fa330aeb066949a607a9aa2faa5.rar;D:\My Documents\桌面\test;Archive contains infected objects;;

显示全部楼层 · 发表于 2009-7-12 18:09:04

賣咖啡厲害!

显示全部楼层 · 发表于 2009-7-12 19:19:36

Hello,

##.exe_ - Worm.Win32.AutoRun.armw

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

Best regards, Sergey Prokudin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia
Tel./Fax: + 7 (495) 797 8700
http://www.kaspersky.com http://www.viruslist.com

显示全部楼层 · 发表于 2009-7-12 21:47:22

MSE
TrojanDownloader:Win32/Kilfno.B

[病毒样本] n

本帖子中包含更多资源

drweb