servet

显示全部楼层 · 发表于 2007-4-4 19:27:53

木马名称:Trojan-PSW.Win32.WOW.aeg

程序:
C:\DOCUMENTS AND SETTINGS\OUYANG\LOCAL SETTINGS\TEMP\IE777.EXE
是木马程序!

程序:
C:\DOCUMENTS AND SETTINGS\OUYANG\桌面\SERVET\CMDBC.EXE
木马程序生成以下文件:
1) C:\WINDOWS\CMDBC.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\OUYANG\桌面\SERVET\MPPDS.EXE
木马程序生成以下文件:
1) C:\WINDOWS\MPPDS.EXE
2) C:\WINDOWS\SYSTEM32\MPPDS.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\OUYANG\桌面\SERVET\MSCCRT.EXE
木马程序生成以下文件:
1) C:\WINDOWS\MSCCRT.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\OUYANG\桌面\SERVET\UPXDND.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\OUYANG\LOCAL SETTINGS\TEMP\UPXDND.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\OUYANG\桌面\SERVET\WINFORM.EXE
木马程序生成以下文件:
1) C:\WINDOWS\WINFORM.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\OUYANG\桌面\SERVET\WSTTRS.EXE
木马程序生成以下文件:
1) C:\WINDOWS\WSTTRS.EXE
2) C:\WINDOWS\SYSTEM32\WSTTRS.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\OUYANG\桌面\SERVET\8.EXE
木马程序生成以下文件:
是否删除木马程序及其衍生物?

微点都抓到了，PS我的微点还没升级的老版本啊。一升级到老版本就不能用了。

显示全部楼层 · 发表于 2007-4-4 19:29:46

扫描进行于：2007-4-4 19:19
扫描日志
NOD32版本 2167 (20070403) NT
命令行： C:\Documents and Settings\OUYANG\桌面\servet.rar

日期： 4.4.2007 时间：19:19:55
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\OUYANG\桌面\servet.rar
C:\Documents and Settings\OUYANG\桌面\servet.rar >>RAR >>servet.exe - Win32/TrojanDownloader.Delf.NRX trojan
C:\Documents and Settings\OUYANG\桌面\servet.rar >>RAR >>upxdnd.exe - a variant of Win32/PSW.Agent.NDF trojan
C:\Documents and Settings\OUYANG\桌面\servet.rar >>RAR >>msccrt.exe - a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\OUYANG\桌面\servet.rar >>RAR >>mppds.exe - a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\OUYANG\桌面\servet.rar >>RAR >>winform.exe - probably a variant of Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\OUYANG\桌面\servet.rar >>RAR >>8.exe - Win32/TrojanDropper.Delf.NDN trojan
C:\Documents and Settings\OUYANG\桌面\servet.rar >>RAR >>cmdbc.exe - a variant of Win32/PSW.Agent.NCC trojan
已扫描的文件数目：9
已发现的病毒数目：7
完成时间： 19:20:00 总扫描时间：5 秒 (00:00:05)

NOD32发现7个，特征码杀软来说可以接受咯

显示全部楼层 · 发表于 2007-4-4 22:58:51

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\servet.rar'
C:\Documents and Settings\morgan\My Documents\
  servet.rar
[0] Archive type: RAR
--> servet.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> svchost.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> upxdnd.exe
      [DETECTION] Is the Trojan horse TR/Agent.9728.21
      [WARNING] Infected files in archives cannot be repaired!
--> msccrt.exe
      [DETECTION] Is the Trojan horse TR/Agent.9216.19
      [WARNING] Infected files in archives cannot be repaired!
--> wsttrs.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.MS
      [WARNING] Infected files in archives cannot be repaired!
--> mppds.exe
      [DETECTION] Is the Trojan horse TR/Agent.10240.32
      [WARNING] Infected files in archives cannot be repaired!
--> winform.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.MQ.11
      [WARNING] Infected files in archives cannot be repaired!
--> 8.exe
      [DETECTION] Is the Trojan horse TR/PSW.WOW.EC.27
      [WARNING] Infected files in archives cannot be repaired!
--> cmdbc.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.1413
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

End of the scan: 2007年4月4日  07:59
Used time: 00:08 min

The scan has been done completely.

   0 Scanning directories
   10 Files were scanned
   9 viruses and/or unwanted programs were found
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   9 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-4-5 07:42:20

不愧为红伞,全灭了

Starting the file scan:

Begin scan in 'C:\Documents and Settings\FEAR\My Documents\servet.rar'
C:\Documents and Settings\FEAR\My Documents\servet.rar
  [0] Archive type: RAR
  --> servet.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> svchost.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> upxdnd.exe
   [DETECTION] Is the Trojan horse TR/Agent.9728.21
  --> msccrt.exe
   [DETECTION] Is the Trojan horse TR/Agent.9216.19
  --> wsttrs.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.MS
  --> mppds.exe
   [DETECTION] Is the Trojan horse TR/Agent.10240.32
  --> winform.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.MQ.11
  --> 8.exe
   [DETECTION] Is the Trojan horse TR/PSW.WOW.EC.27
  --> cmdbc.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.1413
   [INFO]    The file was moved to '4686382b.qua'!

[病毒样本] servet