睡前来一个[MD5: DD9D20]

redalert0239

[:27:]

aerbeisi

The requested URL http://bbs.kafan.cn/attachment.php?aid=85741 is infected with Trojan-Downloader.Win32.Small.etc virus

mofunzone

原文件杀不出来
来个杀生成物大比拼

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\system32.rar'
C:\Documents and Settings\Administrator\My Documents\
  system32.rar
    [0] Archive type: RAR
    --> winlogo.exe
    --> winpcap.exe
        [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/NSPack). Please verify the origin of the file
        [WARNING]   Infected files in archives cannot be repaired!
    --> yxmtaxyl.d1l
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> yxmtaxyl.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 5in1.exe
        [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
        [WARNING]   Infected files in archives cannot be repaired!
    --> fut1.exe
        [DETECTION] Contains signature of the dropper DR/PcClient.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> fut3.exe
        [DETECTION] Contains suspicious code HEUR/Crypted
        [WARNING]   Infected files in archives cannot be repaired!
    --> inf.dll
        [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
        [WARNING]   Infected files in archives cannot be repaired!
    --> love.exe
    --> SVVH0ST.EXE
    --> verclsid.exe.bak
    --> MSq01vn.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> yxmtaxyl.sys
        [WARNING]   The file was ignored!


End of the scan: 2007年6月10日  11:49
Used time: 00:08 min

The scan has been done completely.

      0 Scanning directories
     14 Files were scanned
      8 viruses and/or unwanted programs were found
      4 classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      9 Warnings
      0 Notes
      0 Hidden objects were found

扫描日志
NOD32版本 2320 (20070609) NT
命令行： C:\Documents and Settings\Administrator\My  ?
?Documents\system32.rar
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 10.6.2007  时间：11:49:57
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?Administrator\My Documents\system32.rar
C:\Documents and Settings\Administrator\My Documents\ ?
?system32.rar >>RAR >>winlogo.exe - Win32/Delf.AWY 木马
C:\Documents and Settings\Administrator\My Documents\ ?
?system32.rar >>RAR >>winpcap.exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\ ?
?system32.rar >>RAR >>yxmtaxyl.d1l - 是正常的
C:\Documents and Settings\Administrator\My Documents\ ?
?system32.rar >>RAR >>yxmtaxyl.dll - 是正常的
C:\Documents and Settings\Administrator\My Documents\ ?
?system32.rar >>RAR >>5in1.exe - Win32/PSW.Lineage.DN  ?
?木马的变种
C:\Documents and Settings\Administrator\My Documents\ ?
?system32.rar >>RAR >>fut1.exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\ ?
?system32.rar >>RAR >>fut3.exe - 未查明的 NewHeur_PE  ?
?病毒 [7]
C:\Documents and Settings\Administrator\My Documents\ ?
?system32.rar >>RAR >>inf.dll - 是正常的
C:\Documents and Settings\Administrator\My Documents\ ?
?system32.rar >>RAR >>love.exe >>UPX v12_m2 - 是正常的
C:\Documents and Settings\Administrator\My Documents\ ?
?system32.rar >>RAR >>SVVH0ST.EXE - 是正常的
C:\Documents and Settings\Administrator\My Documents\ ?
?system32.rar >>RAR >>verclsid.exe.bak - 是正常的
C:\Documents and Settings\Administrator\My Documents\ ?
?system32.rar >>RAR >>MSq01vn.dll - Win32/PSW.Lineage.DN  ?
?木马的变种
C:\Documents and Settings\Administrator\My Documents\ ?
?system32.rar >>RAR >>yxmtaxyl.sys - 是正常的
已扫描的文件数目：13
已发现的病毒数目：4
完成时间： 11:50:07 总扫描时间：10 秒 (00:00:10)
注意：
[7] 该文件可能感染上未知病毒。

[Scan path] C:\Documents and Settings\Administrator\My Documents\system32.rar
>>C:\Documents and Settings\Administrator\My Documents\system32.rar\winlogo.exe infected with Trojan.Sniff
>C:\Documents and Settings\Administrator\My Documents\system32.rar\winpcap.exe infected with BackDoor.Pigeon.1604
>C:\Documents and Settings\Administrator\My Documents\system32.rar\yxmtaxyl.d1l infected with BackDoor.PcClient
>C:\Documents and Settings\Administrator\My Documents\system32.rar\yxmtaxyl.dll infected with BackDoor.PcClient
>>C:\Documents and Settings\Administrator\My Documents\system32.rar\5in1.exe infected with Trojan.MulDrop.6870
>C:\Documents and Settings\Administrator\My Documents\system32.rar\fut1.exe infected with BackDoor.PcClient
>>>C:\Documents and Settings\Administrator\My Documents\system32.rar\fut3.exe\data001 - Ok
>>C:\Documents and Settings\Administrator\My Documents\system32.rar\fut3.exe\data002 infected with BackDoor.Pigeon.1604
>>>C:\Documents and Settings\Administrator\My Documents\system32.rar\fut3.exe\data003 infected with Trojan.Sniff
>C:\Documents and Settings\Administrator\My Documents\system32.rar\fut3.exe - archive contains infected objects
>>C:\Documents and Settings\Administrator\My Documents\system32.rar\inf.dll - Ok
>>C:\Documents and Settings\Administrator\My Documents\system32.rar\love.exe probably infected with DLOADER.Trojan
>C:\Documents and Settings\Administrator\My Documents\system32.rar\SVVH0ST.EXE - Ok
>C:\Documents and Settings\Administrator\My Documents\system32.rar\verclsid.exe.bak - Ok
>C:\Documents and Settings\Administrator\My Documents\system32.rar\MSq01vn.dll infected with Trojan.PWS.Lineage
>C:\Documents and Settings\Administrator\My Documents\system32.rar\yxmtaxyl.sys infected with BackDoor.PcClient
C:\Documents and Settings\Administrator\My Documents\system32.rar - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 17
Infected objects found: 10
Objects with modifications found: 0
Suspicious objects found: 1
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 509 Kb/s
Scan time: 00:00:02

foxhound

看了virustotal和Jotti以后确实是比较汗的~~

A-Squared	Found nothing
AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found Trojan-Downloader.Win32.Small.etc
Fortinet	Found nothing
Kaspersky Anti-Virus	Found Trojan-Downloader.Win32.Small.etc
NOD32	Found nothing
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

1688388728

回复

taihuxian

Virus: Trojan-Downloader.Win32.Small.etc

Virus found while downloading Web content.

Address: bbs.kafan.cn

wangjay1980

生成物

detected: virus Worm.Win32.Delf.ck        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/winlogo.exe
detected: Trojan program Backdoor.Win32.PcClient.yw        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/yxmtaxyl.d1l
detected: Trojan program Backdoor.Win32.PcClient.yw        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/yxmtaxyl.dll
detected: Trojan program Trojan-PSW.Win32.Agent.ma        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/5in1.exe//UPX
detected: Trojan program Trojan.Win32.Agent.xr        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/fut1.exe
detected: virus Worm.Win32.Delf.ck        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/fut3.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.wb        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/inf.dll//UPack
detected: virus Worm.Win32.Mefir.b        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/love.exe//UPX
detected: virus Worm.Win32.Delf.ck        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/SVVH0ST.EXE
detected: Trojan program Trojan-Spy.Win32.Agent.pn        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/MSq01vn.dll
detected: Trojan program Backdoor.Win32.PcClient.yw        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/yxmtaxyl.sys

scottxzt

运行后修改系统时间，微点提示没有注册，随后自动恢复系统时间，一切正常。

没有看见微点的拦截动作，也可能再后台就处理了。主动防御挺牛的！

promised

壳王挂
生成物杀7个

l784588

avast 报Win32:Agent-EPC [Trj].