12
返回列表 发新帖
楼主: allenhippo
收起左侧

[病毒样本] 33个一大包,有几个可能不是

[复制链接]
Giggs
发表于 2007-6-30 20:26:16 | 显示全部楼层
Start of the scan: 2007年6月30日  20:26

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\新建文件夹'
C:\Documents and Settings\Administrator\桌面\新建文件夹\virus[1].part1.rar
  [0] Archive type: RAR
  --> ~tmp157.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> 00110.dll
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Agent.mvz
      [INFO]      A backup was created as '46f84c4f.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\新建文件夹\virus[1].part2.rar
  [0] Archive type: RAR
  --> 1634[1].exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 1638[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGam.QW
  --> 4.exe
      [DETECTION] Is the Trojan horse TR/Agent.anj.6
  --> 445.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 587.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> 602.exe
      [DETECTION] Is the Trojan horse TR/Dldr.VB.VDQ
  --> 805.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 805~.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 819.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      A backup was created as '46f84c51.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\新建文件夹\virus[1].part3.rar
  [0] Archive type: RAR
  --> bb.exe
      [DETECTION] Is the Trojan horse TR/Agent.24576.137
  --> bd4[1].rar
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      A backup was created as '46f84c52.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\新建文件夹\virus[1].part5.rar
  [0] Archive type: RAR
  --> loadadv579.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> LYLOADER.EXE
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      A backup was created as '4748beff.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: 2007年6月30日  20:26
Used time: 00:05 min

The scan has been done completely.

      1 Scanning directories
     28 Files were scanned
     15 viruses and/or unwanted programs were found
      3 classified as suspicious:
      4 files were deleted
      0 files were repaired
      4 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     10 Files not concerned
      5 Archives were scanned
      0 Warnings
      1 Notes
      0 Hidden objects were found
hj5abc
发表于 2007-6-30 20:58:25 | 显示全部楼层
完整版.

Scanned disks, folders and files: F:\virus[1]\
F:\virus[1]\00110.dll - is OK
F:\virus[1]\rundllforour.exe - is OK
F:\virus[1]\tbhelper.dll - is OK
F:\virus[1]\4.exe - is OK
F:\virus[1]\445.exe - is OK
F:\virus[1]\805[1].exe ?NSIS ?805~.exe - is OK
F:\virus[1]\805~.exe - is OK
F:\virus[1]\barsetup[1] - is OK
F:\virus[1]\bb.exe - is OK
F:\virus[1]\cc.exe ?ASPack v2.12 - is OK
F:\virus[1]\cdnswp[1].exe ?ASPack v2.12 - is OK
F:\virus[1]\dllh8jkd1q6.exe - is OK
F:\virus[1]\hh.exe ?ASPack v2.12 - is OK
F:\virus[1]\kernelwind32.exe - is OK
F:\virus[1]\10012[1].exe - a variant of Win32/Agent.NEO trojan
F:\virus[1]\1066.exe - Win32/TrojanDownloader.Delf.NUH trojan
F:\virus[1]\132.exe - probably a variant of Win32/Genetik trojan
F:\virus[1]\1630[1].exe - a variant of Win32/PSW.Agent.NEC trojan
F:\virus[1]\1633[1].exe - probably a variant of Win32/Genetik trojan
F:\virus[1]\1634[1].exe - a variant of Win32/PSW.Legendmir.NEP trojan
F:\virus[1]\1638[1].exe - a variant of Win32/PSW.OnLineGames.RC trojan
F:\virus[1]\1[1].exe - probably a variant of Win32/Viking virus
F:\virus[1]\587.exe - Win32/Small.NBT trojan
F:\virus[1]\602.exe - probably unknown NewHeur_PE virus [7]
F:\virus[1]\805.exe - probably a variant of Win32/Agent.NAU worm
F:\virus[1]\805[1].exe ?NSIS ?805.exe - probably a variant of Win32/Agent.NAU worm
F:\virus[1]\805[1].exe ?NSIS ?805~~.exe - probably a variant of Win32/Agent.NEO trojan
F:\virus[1]\805~~.exe - probably a variant of Win32/Agent.NEO trojan
F:\virus[1]\819.exe - probably a variant of Win32/Agent.NAU worm
F:\virus[1]\bd4[1].rar - a variant of Win32/TrojanDownloader.QQHelper trojan
F:\virus[1]\host[1].exe - Win32/TrojanDropper.Delf.NEY trojan
F:\virus[1]\loadadv579.exe - a variant of Win32/TrojanDownloader.Small.NUS trojan
F:\virus[1]\LYLOADER.EXE - a variant of Win32/PSW.Agent.NEC trojan
F:\virus[1]\mminstall[1] - Win32/TrojanDownloader.QQHelper.NDF trojan
F:\virus[1]\~tmp157.exe - a variant of Win32/PSW.Delf.NHI trojan
Number of scanned files: 36
Number of threats found: 21
Number of files cleaned: 20
Time of completion: 20:52:44 Total scanning time: 19 sec (00:00:19)
woai_jolin
发表于 2007-6-30 23:05:48 | 显示全部楼层
2007/6/30 22:59:17        Scanning Log
2007/6/30 22:59:17        Version of virus signature database: 2365 (20070630)
2007/6/30 22:59:17        Date: 30.6.2007  Time: 22:59:17
2007/6/30 22:59:17        Scanned disks, folders and files: D:\病毒上报\
2007/6/30 22:59:20        D:\病毒上报\10012[1].exe - a variant of Win32/Agent.NEO trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:20        D:\病毒上报\1066.exe - Win32/TrojanDownloader.Delf.NUH trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:22        D:\病毒上报\132.exe - probably a variant of Win32/Genetik trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:23        D:\病毒上报\1630[1].exe - a variant of Win32/PSW.Agent.NEC trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:25        D:\病毒上报\1633[1].exe - probably a variant of Win32/Genetik trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:26        D:\病毒上报\1634[1].exe - a variant of Win32/PSW.Legendmir.NEP trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:27        D:\病毒上报\1638[1].exe - a variant of Win32/PSW.OnLineGames.RC trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:29        D:\病毒上报\1[1].exe - probably a variant of Win32/Viking virus - deleted - quarantined
2007/6/30 22:59:36        D:\病毒上报\587.exe - Win32/Small.NBT trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:37        D:\病毒上报\602.exe - probably unknown NewHeur_PE virus [7] - deleted - quarantined
2007/6/30 22:59:39        D:\病毒上报\805.exe - probably a variant of Win32/Agent.NAU worm - cleaned by deleting - quarantined [1]
2007/6/30 22:59:41        D:\病毒上报\805[1].exe - multiple threats - deleted - quarantined
2007/6/30 22:59:41        D:\病毒上报\805[1].exe » NSIS:SFX=32256 » 805.exe - probably a variant of Win32/Agent.NAU worm
2007/6/30 22:59:41        D:\病毒上报\805[1].exe » NSIS:SFX=32256 » 805~~.exe - probably a variant of Win32/Agent.NEO trojan
2007/6/30 22:59:42        D:\病毒上报\805~~.exe - probably a variant of Win32/Agent.NEO trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:43        D:\病毒上报\819.exe - probably a variant of Win32/Agent.NAU worm - cleaned by deleting - quarantined [1]
2007/6/30 22:59:44        D:\病毒上报\bd4[1].rar - a variant of Win32/TrojanDownloader.QQHelper trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:48        D:\病毒上报\host[1].exe - Win32/TrojanDropper.Delf.NEY trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:49        D:\病毒上报\loadadv579.exe - a variant of Win32/TrojanDownloader.Small.NUS trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:50        D:\病毒上报\LYLOADER.EXE - a variant of Win32/PSW.Agent.NEC trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:51        D:\病毒上报\mminstall[1] - Win32/TrojanDownloader.QQHelper.NDF trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:52        D:\病毒上报\~tmp157.exe - a variant of Win32/PSW.Delf.NHI trojan - cleaned by deleting - quarantined [1]
2007/6/30 22:59:52        Number of scanned files: 36
2007/6/30 22:59:52        Number of threats found: 21
2007/6/30 22:59:52        Time of completion: 22:59:52  Total scanning time: 35 sec (00:00:35)
2007/6/30 22:59:52        Notes:
2007/6/30 22:59:52        [1] File has been deleted as it contained only the virus body.
2007/6/30 22:59:52        [7] File is probably infected with an unknown virus.
Whkroran
发表于 2007-7-1 02:22:20 | 显示全部楼层
卡7 31个
deleted: Trojan program Backdoor.Win32.Agent.ahj        File: E:\virus sample\virus01.zip/132.exe
deleted: Trojan program Backdoor.Win32.Small.oo        File: E:\virus sample\virus01.zip/445.exe
deleted: Trojan program Backdoor.Win32.Small.nx        File: E:\virus sample\virus01.zip/587.exe
deleted: Trojan program Trojan-Downloader.Win32.VB.atk        File: E:\virus sample\virus01.zip/602.exe
deleted: virus Worm.Win32.Agent.t        File: E:\virus sample\virus01.zip/805.exe//PE_Patch.PECompact//PecBundle//PECompact
deleted: virus Worm.Win32.Agent.t        File: E:\virus sample\virus01.zip/805[1].exe//data0002//PE_Patch.PECompact//PecBundle//PECompact
deleted: Trojan program Trojan-Downloader.Win32.Delf.bgp        File: E:\virus sample\virus01.zip/805[1].exe//data0003
deleted: Trojan program Backdoor.Win32.Agent.ahj        File: E:\virus sample\virus01.zip/805[1].exe//data0004
deleted: Trojan program Trojan-Downloader.Win32.Delf.bgp        File: E:\virus sample\virus01.zip/805~.exe
deleted: Trojan program Backdoor.Win32.Agent.ahj        File: E:\virus sample\virus01.zip/805~~.exe
deleted: virus Worm.Win32.Agent.t        File: E:\virus sample\virus01.zip/819.exe//PE_Patch.PECompact//PecBundle//PECompact
deleted: Trojan program Trojan-Downloader.Win32.Banload.bpo        File: E:\virus sample\virus01.zip/1066.exe//PE_Patch.PECompact//PecBundle//PECompact
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.nn        File: E:\virus sample\virus01.zip/1630[1].exe
deleted: Trojan program Trojan-Downloader.Win32.Small.czl        File: E:\virus sample\virus01.zip/1633[1].exe//UPack//PE_Patch
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.mk        File: E:\virus sample\virus01.zip/1634[1].exe//PE_Patch//UPack//PE_Patch
deleted: Trojan program Trojan-Spy.Win32.Agent.pn        File: E:\virus sample\virus01.zip/1638[1].exe//PE_Patch.UPX//UPX
deleted: Trojan program Backdoor.Win32.Agent.ahj        File: E:\virus sample\virus01.zip/10012[1].exe
deleted: Trojan program Trojan-Dropper.Win32.Agent.ayy        File: E:\virus sample\virus01.zip/barsetup[1]
deleted: Trojan program Trojan-Downloader.Win32.QQHelper.wr        File: E:\virus sample\virus01.zip/bb.exe
deleted: Trojan program Trojan-Downloader.Win32.QQHelper.ws        File: E:\virus sample\virus01.zip/bd4[1].rar
deleted: adware not-a-virus:AdWare.Win32.AdMoke.ba        File: E:\virus sample\virus01.zip/hh.exe//ASPack
deleted: adware not-a-virus:AdWare.Win32.Agent.ck        File: E:\virus sample\virus01.zip/host[1].exe
deleted: Trojan program Trojan-Downloader.Win32.Tibs.mp        File: E:\virus sample\virus01.zip/kernelwind32.exe
deleted: Trojan program Trojan-Downloader.Win32.LoadAdv.e        File: E:\virus sample\virus01.zip/loadadv579.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.nn        File: E:\virus sample\virus01.zip/LYLOADER.EXE//PE_Patch//UPack
deleted: Trojan program Trojan-Downloader.Win32.Agent.bbb        File: E:\virus sample\virus01.zip/mminstall[1]
deleted: adware not-a-virus:AdWare.Win32.Agent.dd        File: E:\virus sample\virus01.zip/tbhelper.dll
deleted: Trojan program Trojan-Spy.Win32.Delf.vr        File: E:\virus sample\virus01.zip/~tmp157.exe//UPX
deleted: virus Worm.Win32.Viking.lu        File: E:\virus sample\virus01.zip/1[1].exe
deleted: Trojan program Trojan.Win32.Agent.anj        File: E:\virus sample\virus01.zip/4.exe//PE_Patch//UPack
deleted: adware not-a-virus:AdWare.Win32.Softomate.ah        File: E:\virus sample\virus01.zip/00110.dll
红心王子
发表于 2007-7-1 04:48:56 | 显示全部楼层
狮子吃掉9个
剩下漏掉的上报

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-5-8 01:24 , Processed in 0.103006 second(s), 15 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表