[MD5: 07cb03]哈尼綜合生活網樣本(黑衣-魂样本)

显示全部楼层 · 发表于 2007-7-4 22:22:23

飘过kv2007.

显示全部楼层 · 发表于 2007-7-4 22:35:25

在AVPCLUB
這裡有人分析過了！
http://www.avpclub.ddns.info/discuz/thread-3446-1-1.html

[ 本帖最后由 a256886572008 于 2007-7-4 22:38 编辑 ]

显示全部楼层 · 发表于 2007-7-4 22:37:57

Starting the file scan:

Begin scan in 'F:\病毒样本\?ェ侯?ネ?.rar'
F:\病毒样本\?ェ侯?ネ?.rar
  [0] Archive type: RAR
  --> 6143.htm
   [DETECTION] Contains suspicious code HEUR/Exploit.HTML
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-4 22:45:50

ms是昨天的样本?

F:\0627xh[1].exe及其生成物.rar ?RAR ?ネΘ?\drive\C\windows\Web\printers\images\drcerwq.dll - a variant of Win32/PSW.Lineage.DN trojan

显示全部楼层 · 发表于 2007-7-4 22:57:36

极尽变态的更新速度

C:\ABC\?ェ侯?ネ?.rar:\20070418a.exe\tt.bat - Signature 'Win32.SuspectCrc' found
C:\ABC\?ェ侯?ネ?.rar:\20070418a.exe\soft.vbs - Signature 'Win32.SuspectCrc' found
C:\ABC\?ェ侯?ネ?.rar:\20070418a.exe
C:\ABC\?ェ侯?ネ?.rar:\6143.htm - Signature 'Exploit.JS.ADODB.Stream' found
C:\ABC\?ェ侯?ネ?.rar

5 Files scanned
(1 Archiv with 4 files)
3 Signatures found
0 Suspect code-parts found
Used time: 0:00.109

显示全部楼层 · 发表于 2007-7-4 23:07:10

微点未反应？？？
上面的生成物倒是杀了

[ 本帖最后由野马于 2007-7-4 23:11 编辑 ]

显示全部楼层 · 发表于 2007-7-4 23:15:02

gztest.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs

0627xh.exe
   [DETECTION] Is the Trojan horse TR/PSW.Lineage.UZH.27

drcerwq.dll
   [DETECTION] Is the Trojan horse TR/PSW.Magania.MY.3

drcerwq.exe
   [DETECTION] Is the Trojan horse TR/PSW.Lineage.UZH.27

显示全部楼层 · 发表于 2007-7-5 06:35:27

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.
Trojan.Downloader.VBS.AX

显示全部楼层 · 发表于 2007-7-5 06:35:47

显示全部楼层 · 发表于 2007-7-5 07:34:22

Scan performed at: 2007-7-5 7:33:48
Scanning Log
NOD32 version 2379 (20070704) NT
Command line: D:\0627xh.exe及其生成物.rar D:\gztest_new.part1.rar D:\gztest_new.part2.rar
C:\Program Files\Eset\nod32.exe - is OK

Date: 5.7.2007 Time: 07:33:49
Anti-Stealth technology is enabled.
Scanned disks, folders and files: D:\0627xh.exe及其生成物.rar; D:\gztest_new.part1.rar; D:\gztest_new.part2.rar
D:\0627xh.exe及其生成物.rar ?RAR ?0627xh.exe - is OK
D:\0627xh.exe及其生成物.rar ?RAR ?ネΘ?\drive\C\windows\SbiePst.dat - is OK
D:\0627xh.exe及其生成物.rar ?RAR ?ネΘ?\drive\C\windows\Web\printers\images\drcerwq.dll - a variant of Win32/PSW.Lineage.DN trojan
D:\0627xh.exe及其生成物.rar ?RAR ?ネΘ?\drive\C\windows\Web\printers\images\drcerwq.exe - is OK
D:\gztest_new.part1.rar ?RAR ?gztest.exe - next archive volume not found
Number of scanned files: 5
Number of threats found: 1
Number of active threats: 1
Time of completion: 07:33:51 Total scanning time: 2 sec (00:00:02)

[MD5: 07cb03]哈尼綜合生活網樣本(黑衣-魂样本)

本帖子中包含更多资源

本帖子中包含更多资源

Trojan.Downloader.Agent.YHJ