NOD 32：QQ盗号和Tr/downloader各一个～～

显示全部楼层 · 发表于 2007-4-1 18:17:59

转自NOD 32 club一坛友上网时从网站上抓下来的。。。。。

显示全部楼层 · 发表于 2007-4-1 18:18:22

QQ盗号：

AhnLab-V3 2007.3.31.0 04.01.2007  no virus found
AntiVir 7.3.1.47 03.31.2007 TR/Crypt.FKM.Gen
Authentium 4.93.8 03.31.2007  no virus found
Avast 4.7.936.0 03.31.2007  no virus found
AVG 7.5.0.447 03.31.2007  no virus found
BitDefender 7.2 04.01.2007  no virus found
CAT-QuickHeal 9.00 03.31.2007 (Suspicious) - DNAScan
ClamAV devel-20070312 04.01.2007 Trojan.Gadgo.20
DrWeb 4.33 04.01.2007 BackDoor.Klj
eSafe 7.0.15.0 03.31.2007 Suspicious Trojan/Worm
eTrust-Vet 30.6.3527 03.31.2007  no virus found
Ewido 4.0 03.31.2007  no virus found
FileAdvisor 1 04.01.2007  no virus found
Fortinet 2.85.0.0 04.01.2007 suspicious
F-Prot 4.3.1.45 03.30.2007  no virus found
F-Secure 6.70.13030.0 04.01.2007  no virus found
Ikarus T3.1.1.3 04.01.2007  no virus found
Kaspersky 4.0.2.24 04.01.2007  no virus found
McAfee 4997 03.31.2007  no virus found
Microsoft 1.2306 04.01.2007  no virus found
NOD32v2 2160 03.31.2007 a variant of Win32/PSW.QQRob.NAQ
Norman 5.80.02 03.31.2007  no virus found
Panda 9.0.0.4 03.31.2007 Trj/Agent.ESK
Prevx1 V2 04.01.2007  no virus found
Sophos 4.16.0 03.30.2007  no virus found
Sunbelt 2.2.907.0 03.31.2007 VIPRE.Suspicious
Symantec 10 04.01.2007  no virus found
TheHacker 6.1.6.083 03.30.2007  no virus found
UNA 1.83 03.16.2007  no virus found
VBA32 3.11.3 04.01.2007 MalwareScope.Backdoor.Hupigon.8
VirusBuster 4.3.7:9 03.31.2007  no virus found
Webwasher-Gateway 6.0.1 04.01.2007 Trojan.Crypt.FKM.Gen

显示全部楼层 · 发表于 2007-4-1 18:19:09

Tr/downloader：

AhnLab-V3	2007.3.31.0	04.01.2007 [td]no virus found
AntiVir	7.3.1.47	03.31.2007	HEUR/Malware
Authentium	4.93.8	03.31.2007	W32/Downloader2.XZ
Avast	4.7.936.0	03.31.2007 [td]no virus found
AVG	7.5.0.447	03.31.2007	Downloader.Agent.IQH
BitDefender	7.2	04.01.2007	Trojan.Downloader.StartPage.A
CAT-QuickHeal	9.00	03.31.2007	(Suspicious) - DNAScan
ClamAV	devel-20070312	04.01.2007 [td]no virus found
DrWeb	4.33	04.01.2007	MULDROP.Trojan
eSafe	7.0.15.0	03.31.2007	suspicious Trojan/Worm
eTrust-Vet	30.6.3527	03.31.2007 [td]no virus found
Ewido	4.0	03.31.2007 [td]no virus found
FileAdvisor	1	04.01.2007 [td]no virus found
Fortinet	2.85.0.0	04.01.2007	W32/Agent.BES!tr.dldr
F-Prot	4.3.1.45	03.30.2007	W32/Downloader2.XZ
F-Secure	6.70.13030.0	04.01.2007	Trojan-Downloader.Win32.Agent.bes
Ikarus	T3.1.1.3	04.01.2007 [td]no virus found
Kaspersky	4.0.2.24	04.01.2007	Trojan-Downloader.Win32.Agent.bes
McAfee	4997	03.31.2007 [td]no virus found
Microsoft	1.2306	04.01.2007 [td]no virus found
NOD32v2	2160	03.31.2007	Win32/TrojanDownloader.Agent.BES
Norman	5.80.02	03.31.2007 [td]no virus found
Panda	9.0.0.4	04.01.2007	Suspicious file
Prevx1	V2	04.01.2007 [td]no virus found
Sophos	4.16.0	03.30.2007 [td]no virus found
Sunbelt	2.2.907.0	03.31.2007 [td]no virus found
Symantec	10	04.01.2007 [td]no virus found
TheHacker	6.1.6.083	03.30.2007 [td]no virus found
UNA	1.83	03.16.2007 [td]no virus found
VBA32	3.11.3	04.01.2007	Trojan-Downloader.Win32.Agent.bes
VirusBuster	4.3.7:9	03.31.2007 [td]no virus found
Webwasher-Gateway	6.0.1	04.01.2007	Heuristic.Malware

显示全部楼层 · 发表于 2007-4-1 18:21:13

FS7.0
Result: 1 malware found
Trojan-Downloader.Win32.Agent.bes (virus)
C:\Documents and Settings\ÉÙÁÖ\×ÀÃæ\²¡¶¾.rar\cja.exe
上报。。。

显示全部楼层 · 发表于 2007-4-1 18:26:13

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用

===============================================
___________病毒查杀结果__________________

===============================================

2007年4月1日18时26分15秒开始查杀C:\Documents and Settings\Administrator\桌面\新建文件夹\新建文件夹 (8)\病毒
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。

-----------------------------------------

2007年4月1日18时26分15秒收起线程…100% 查杀完毕！
扫描文件：2查杀病毒：0

显示全部楼层 · 发表于 2007-4-1 18:44:30

补上FS未报的那支

显示全部楼层 · 发表于 2007-4-1 18:47:33

已检测到: 木马程序 Trojan-Downloader.Win32.Agent.bes URL: http:/bbs.kafan.cn/attachment.php?aid=50456/cja.exe/PE_Patch/UPX

显示全部楼层 · 发表于 2007-4-1 22:29:10

显示全部楼层 · 发表于 2007-4-1 22:39:56

!**************************************************
Safe'n'Sec alert
Action
Date and time: 2007-4-1 22:35:01
Type: Editing a file/folder
Risk: Moderate

Application
Process identifier: 1236
Parent process identifier: 1244
User identifier: WWW-C467E80E9F5\Administrator
File: D:\VIR\病毒\CJB.EXE

Object
File/folder:C:\WINDOWS\SYSTEM32\W3WP.EXE
User action: Block
***************************************************
2007-4-1 22:35:49 !**************************************************
Safe'n'Sec alert
Action
Date and time: 2007-4-1 22:35:28
Type: Registering a new Windows service
Risk: Moderate

Activity control rule
Name:

Application
Process Identifier: 1236
Parent process Identifier: 1244
User Identifier: WWW-C467E80E9F5\Administrator
File: D:\VIR\病毒\CJB.EXE

Service
Name: VOLUME SHADOW
Description: VOLUME SHADOW
Type: 272
Start type: 2
File: C:\WINDOWS\SYSTEM32\W3WP.EXE
Dependencies:
Account:
User action: Block
***************************************************
2007-4-1 22:36:00 !**************************************************
Safe'n'Sec alert
Action
Date and time: 2007-4-1 22:35:49
Type: Changing the value of a system registry key
Risk: Moderate

Control activity rule
Name: reg server R3

Application
Process identifier: 1236
Parent process identifier: 1244
User identifier: WWW-C467E80E9F5\Administrator
File: D:\VIR\病毒\CJB.EXE

Object
Value of the registry key: \REGISTRY\MACHINE\SYSTEM\CONTROLSET002\SERVICES\VOLUME SHADOW\DESCRIPTION
User action: Block

[ 本帖最后由 blueline 于 2007-4-1 22:42 编辑 ]

显示全部楼层 · 发表于 2007-4-1 22:50:20

驱逐舰报一个

[病毒样本] NOD 32：QQ盗号和Tr/downloader各一个～～

本帖子中包含更多资源

本帖子中包含更多资源

Cyberhawk

本帖子中包含更多资源

本帖子中包含更多资源