四支针对卡巴的[MD5: 6BBAFE 179C54 5ABA1E 31654A]

promised

[ 本帖最后由 promised 于 2007-7-3 15:58 编辑 ]

promised

C:\ABC\样本.rar:\SBQQ.exe - Signature 'Trojan-PWS.Win32.QQPass.pf' found
C:\ABC\样本.rar:\QQ20071.exe - Signature 'Trojan-Downloader.Win32.Agent.aqr' found
C:\ABC\样本.rar:\stupe.exe - Signature 'Trojan-PWS.Win32.QQPass.hn' found
C:\ABC\样本.rar:\DD.exe - Signature 'Trojan-Spy.Win32.Bancos.ha' found
C:\ABC\样本.rar

        5 Files scanned
          (1 Archiv with 4 files)
        4 Signatures found
        0 Suspect code-parts found
        Used time: 0:00.078
谀哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪姆
?            VirusBlokAda (Console scanner)             ?
?Vba32 Windows/CL 3.12.0.2 / 2007.07.01 21:45 (Vba32.W) ?
?         Copyright (c) 1993-2007 by VBA Ltd.           ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯图
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Computer: PROMISED-CE046A
System: Windows XP
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /sfx /af+ /fd+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Program settings:
/r=susp.rpt /ha=3 /collect_suspects /nc /sfx /af+ /fd+ /ar+ /qu+ /ml+ /rw+
*:
C:\
C:\ABC\样本.rar:<RAR>\SBQQ.exe : infected MalwareScope.Trojan-PSW.Game.7
C:\ABC\样本.rar:<RAR>\QQ20071.exe : is suspected of Embedded.Trojan-PSW.Win32.QQPass.wc
C:\ABC\样本.rar:<RAR>\stupe.exe : infected MalwareScope.Trojan-PSW.Game.7
C:\ABC\样本.rar:<RAR>\DD.exe : infected Trojan-PSW.Win32.QQPass.mi
Program execution terminated by user

Directories       : 3       Files in archives:      Files on disks:
Archives:                   - total       : 4       - total       : 12   
- scanned         : 1       -  scanned    : 4       - scanned     : 12   
- contain viruses : 1       -  infected   : 3       - infected    : 1     
- deleted         : 0       -  suspicious : 1       - suspicious  : 0     
Startup    : 15:56:11 03-07-2007
End        : 15:56:16 03-07-2007
Total time : 00:00:05

wangjay1980

detected: Trojan program Trojan-PSW.Win32.QQPass.kr        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\&Ntilde;ù±&frac34;.rar/stupe.exe//ASPack//#
detected: Trojan program Trojan-PSW.Win32.QQPass.rj        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\&Ntilde;ù±&frac34;.rar/DD.exe//UPack
上报

啊弥陀佛

微点砍掉

1688388728

反病毒专家 AntiVirusKit 2007 扫描病毒日志记录
版本
双引擎反病毒签名 7/3/2007
开始时间: 7/3/2007 16:22
引擎: KAV 引擎 (AVK 17.5830), AVST 引擎 (AVKB 17.284)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: DD.exe
        路径: E:\病毒库\样本
狀態: 无法清除病毒
        病毒: Trojan-PSW.Win32.QQPass.rj (KAV 引擎), Win32:Nilage-AI [Trj] (AVST 引擎)
对象: QQ20071.exe
        路径: E:\病毒库\样本
狀態: 无法清除病毒
        病毒: Win32:QQPass-IB [Trj] (AVST 引擎)
对象: SBQQ.exe
        路径: E:\病毒库\样本
狀態: 无法清除病毒
        病毒: Win32:Nilage-AI [Trj] (AVST 引擎)
对象: stupe.exe
        路径: E:\病毒库\样本
狀態: 无法清除病毒
        病毒: Win32:QQPass-EV [Trj] (AVST 引擎)
扫描完成: 7/3/2007 16:22
    已检查 4 个文件
    已发现 4 个染毒文件
    发现 0 个可疑文件

harrystopet

瑞星三个C:\Documents and Settings\wujiawei\Local Settings\Temporary Internet Files\Content.IE5\ZAOYHHVX\样本[1].rar>>QQ20071.exe  Trojan.DL.Win32.Delf.yqj

C:\Documents and Settings\wujiawei\桌面\样本.rar>>stupe.exe>>Aspack212r
Trojan.DL.Win32.Delf.yqj

C:\Documents and Settings\wujiawei\桌面\样本.rar>>DD.exe>>upack0.34
Trojan.PSW.QQRobber.bfd

zengmingwh

Begin scan in 'C:\download\bingdu\样本.rar'
C:\download\bingdu\样本.rar
  [0] Archive type: RAR
  --> SBQQ.exe
      [DETECTION] Is the Trojan horse TR/PSW.Stealer.41560
  --> QQ20071.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQPass.WD.1
  --> stupe.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQPass.KR
  --> DD.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.26708
      [INFO]      The file was deleted!

fireworld

金山毒霸只报了QQpass 一个其它没有保

The EQs

Scan performed at: 2007-7-3 17:24:31
Scanning Log
NOD32 version 2373 (20070703) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.rar
Operating memory - is OK

Date: 3.7.2007  Time: 17:24:35
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.rar
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?SBQQ.exe - a variant of Win32/PSW.QQShou.NAU trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?QQ20071.exe - probably a variant of Win32/PSW.QQPass.VD trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?stupe.exe - probably a variant of Win32/PSW.QQShou.EH trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?DD.exe - a variant of Win32/PSW.QQShou.NAU trojan
Number of scanned files: 5
Number of threats found: 4
Number of files cleaned: 1
Time of completion: 17:24:37 Total scanning time: 2 sec (00:00:02)

蓝色牛仔裤

[Scan path] C:\Documents and Settings\Administrator\桌面\样本.rar
>>C:\Documents and Settings\Administrator\桌面\样本.rar\SBQQ.exe infected with Trojan.PWS.Qqpass.origin
>>>C:\Documents and Settings\Administrator\桌面\样本.rar\QQ20071.exe infected with Trojan.PWS.Wow
>>>>C:\Documents and Settings\Administrator\桌面\样本.rar\stupe.exe infected with Trojan.PWS.Qqpass.209
>>C:\Documents and Settings\Administrator\桌面\样本.rar\DD.exe infected with Trojan.PWS.Qqpass.375
C:\Documents and Settings\Administrator\桌面\样本.rar - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 6
Infected objects found: 4
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 640 Kb/s
Scan time: 00:00:01