查看: 2961|回复: 13
收起左侧

[病毒样本] 东方卫士主页再次被人挂马

[复制链接]
The EQs
发表于 2007-4-1 23:05:45 | 显示全部楼层 |阅读模式
Time Module Object Name Threat Action User Information
2007-4-1 23:04:42 AMON file C:\Documents and Settings\EQ2\桌面\logo[1].jpg a variant of Win32/TrojanDownloader.Ani.Gen trojan error while cleaning - operation unavailable for this type of object KASPERSK-F13F4E\EQ2 Event occurred at an attempt to access the file by the application: D:\Program Files\WinRAR\WinRAR.exe.
2007-4-1 23:04:19 AMON file C:\Documents and Settings\EQ2\Local Settings\Temporary Internet Files\Content.IE5\0V0P4DGD\logo[1].jpg a variant of Win32/TrojanDownloader.Ani.Gen trojan error while cleaning - operation unavailable for this type of object KASPERSK-F13F4E\EQ2 Event occurred on a file modified by the application: D:\Program Files\GreenBrowser\GreenBrowser.exe. The file was moved to quarantine. You may close this window.
2007-4-1 23:04:19 AMON file C:\Documents and Settings\EQ2\Local Settings\Temporary Internet Files\Content.IE5\4R8T8HWJ\logo[1].jpg a variant of Win32/TrojanDownloader.Ani.Gen trojan error while cleaning - operation unavailable for this type of object KASPERSK-F13F4E\EQ2 Event occurred on a file modified by the application: D:\Program Files\GreenBrowser\GreenBrowser.exe. The file was moved to quarantine. You may close this window.
2007-4-1 23:03:14 IMON file http://www.m5k8.com/logo.jpg a variant of Win32/TrojanDownloader.Ani.Gen trojan  KASPERSK-F13F4E\EQ2
2007-4-1 23:03:14 IMON file http://www.m5k8.com/logo.jpg a variant of Win32/TrojanDownloader.Ani.Gen trojan  KASPERSK-F13F4E\EQ2

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
dikex
发表于 2007-4-1 23:08:44 | 显示全部楼层
http://www.m5k8.com/ma.exe
The EQs
 楼主| 发表于 2007-4-1 23:15:07 | 显示全部楼层
感谢刺猬。。。已经上报了。。。。55555555
蓝色牛仔裤
发表于 2007-4-1 23:49:12 | 显示全部楼层
Starting the file scan:

Begin scan in 'D:\Downloads'
D:\Downloads\
  ma.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!
蓝色牛仔裤
发表于 2007-4-1 23:50:21 | 显示全部楼层
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\logo[1].rar'
C:\Documents and Settings\Administrator\桌面\
  logo[1].rar
    [0] Archive type: RAR
    --> logo[1].jpg
        [DETECTION] Contains signature of the exploits EXP/MS05-002.Ani.A
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!
小飞侠.net
发表于 2007-4-2 00:55:44 | 显示全部楼层
原帖由 dikex 于 2007-4-1 23:08 发表
http://www.m5k8.com/ma.exe


这只下不了,能上传吗?
Nblock
发表于 2007-4-2 01:07:05 | 显示全部楼层
AntiVir Found TR/Crypt.NSPM.Gen
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found GenPack:Trojan.Downloader.Small.AHQ
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found Trojan-Downloader.Win32.Small.eli
Fortinet Found nothing
Kaspersky Anti-Virus Found Trojan-Downloader.Win32.Small.eli
NOD32 Found nothing
Norman Virus Control Found Sandbox: W32/Malware; [ General information ]

* File length: 9317 bytes.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM32\ssopure.exe.

[ Changes to registry ]
* Creates key "HKLM\Software\Microsoft\Active Setup\Installed Components\{63E16148-3A71-99D9-2524-FE3574645AFF}".
* Sets value "StubPath"="C:\WINDOWS\SYSTEM32\ssopure.exe" in key "HKLM\Software\Microsoft\Active Setup\Installed Components\{63E16148-3A71-99D9-2524-FE3574645AFF}".

[ Process/window information ]
* Modifies other process memory.
* Modifies execution flow of a remote process.
Panda Antivirus Found nothing
Rising Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found Trojan-Downloader.Win32.Small.eji
2007-04-02 01:04:36 处理成功 未知间谍软件 C:\WINDOWS\SYSTEM32\SSOPURE.EXE E:\SOFT_KILLER\MA.EXE
2007-04-02 01:04:36 处理成功 未知间谍软件 E:\SOFT_KILLER\MA.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

HKLM\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{63E16148-3A71-99D9-2524-FE3574645AFF}\ STUBPATH  C:\WINDOWS\SYSTEM32\SSOPURE.EXE E:\SOFT_KILLER\MA.EXE

HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\RING0MSG\ IMAGEPATH  \??\E:\SOFT_KILLER\RING0MSG_1175334246\RING0MSG.SYS C:\WINDOWS\SYSTEM32\SERVICES.EXE

[ 本帖最后由 Nblock 于 2007-4-2 01:10 编辑 ]
jlennon
头像被屏蔽
发表于 2007-4-2 01:37:53 | 显示全部楼层


[ 本帖最后由 jlennon 于 2007-4-2 01:45 编辑 ]

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
bridgewr
发表于 2007-4-2 14:56:12 | 显示全部楼层
微点杀

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
曲中求
发表于 2007-4-2 14:57:36 | 显示全部楼层
NOD 32:

E:\病毒\logo[1].rar »RAR »logo[1].jpg - a variant of Win32/TrojanDownloader.Ani.Gen trojan
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-3-28 20:32 , Processed in 0.130575 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表