virus

tonger2003

[MD5: 4D2193 31D792 F55099 C52CF1 E7AA00 E420A4 4CACE7 BEE3CD C3936D 1CE617]

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.fq        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/3.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fq        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/4.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fq        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/5.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.xz        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/6.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fq        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/7.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fq        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/8.exe
detected: virus Heur.Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/9.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fq        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/0.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fq        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/1.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fq        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/2.exe

红心王子

斧头砍掉8个

ghsy_2007

一个

yurius

IKARUS - T3SCAN V1.25 (WIN32)
         T3 V1.01.08
         Copyright (c) 2003 - 2007 by IKARUS Software.
         Written by Richard Schmoegner.
         All rights reserved.

Signature-database from 24.6.2007 17:05:40 (Build: 69117)

C:\virus\样本.rar:\3.exe - Signature 'Packed.Win32.NSAnti.p' found
C:\virus\样本.rar:\4.exe - Signature 'Packed.Win32.NSAnti.p' found
C:\virus\样本.rar:\5.exe - Signature 'Packed.Win32.NSAnti.p' found
C:\virus\样本.rar:\6.exe - Signature 'Trojan-PWS.Win32.Nilage.bbr' found
C:\virus\样本.rar:\7.exe - Signature 'Packed.Win32.NSAnti.p' found
C:\virus\样本.rar:\8.exe - Signature 'Packed.Win32.NSAnti.p' found
C:\virus\样本.rar:\9.exe - Signature 'Trojan-PWS.Win32.Nilage.bbr' found
C:\virus\样本.rar:\0.exe - Signature 'Packed.Win32.NSAnti.p' found
C:\virus\样本.rar:\1.exe - Signature 'Packed.Win32.NSAnti.p' found
C:\virus\样本.rar:\2.exe - Signature 'Packed.Win32.NSAnti.p' found

yurius

vba32

C:\virus\样本.rar:<RAR>\3.exe : infected MalwareScope.Worm.Viking.3
C:\virus\样本.rar:<RAR>\4.exe : infected MalwareScope.Worm.Viking.3
C:\virus\样本.rar:<RAR>\5.exe : infected MalwareScope.Worm.Viking.3
C:\virus\样本.rar:<RAR>\6.exe : infected MalwareScope.Trojan-PSW.Game.1
C:\virus\样本.rar:<RAR>\7.exe : infected MalwareScope.Worm.Viking.3
C:\virus\样本.rar:<RAR>\8.exe : infected MalwareScope.Worm.Viking.3
C:\virus\样本.rar:<RAR>\9.exe : infected MalwareScope.Trojan-PSW.Game.1
C:\virus\样本.rar:<RAR>\0.exe : infected MalwareScope.Worm.Viking.3
C:\virus\样本.rar:<RAR>\1.exe : infected MalwareScope.Worm.Viking.3
C:\virus\样本.rar:<RAR>\2.exe : infected MalwareScope.Worm.Viking.3

vba32报围巾就是报壳

[ 本帖最后由 yurius 于 2007-6-25 11:54 编辑 ]

wangjay1980

NSAnti.p' 也是壳王

yurius

C:\virus\
  样本.rar
  样本.rar:Zone.Identifier
    [0] Archive type: RAR
    --> 3.exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 4.exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 5.exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 6.exe
        [DETECTION] Is the Trojan horse TR/Agent.34708.B
        [WARNING]   Infected files in archives cannot be repaired!
    --> 7.exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 8.exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 9.exe
        [DETECTION] Is the Trojan horse TR/Agent.34708.B
        [WARNING]   Infected files in archives cannot be repaired!
    --> 0.exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1.exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 2.exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

yurius

bd

C:\virus\样本.rar        OK
C:\virus\样本.rar=>3.exe        Infected: Packer.Malware.NSAnti.F
C:\virus\样本.rar=>4.exe        Infected: Packer.Malware.NSAnti.F
C:\virus\样本.rar=>5.exe        Infected: Packer.Malware.NSAnti.F
C:\virus\样本.rar=>6.exe        Infected: BehavesLike:Win32.ExplorerHijack
C:\virus\样本.rar=>7.exe        Infected: Packer.Malware.NSAnti.F
C:\virus\样本.rar=>8.exe        Infected: Packer.Malware.NSAnti.F
C:\virus\样本.rar=>9.exe        Infected: BehavesLike:Win32.ExplorerHijack
C:\virus\样本.rar=>0.exe        Infected: Packer.Malware.NSAnti.F
C:\virus\样本.rar=>1.exe        Infected: Packer.Malware.NSAnti.F
C:\virus\样本.rar=>2.exe        Infected: Packer.Malware.NSAnti.F
C:\virus\样本.rar=>:Zone.Identifier        OK

wangjay1980

可爱的壳