14个一包

allenhippo

[MD5: 37C45F 8ECEED 6E3CBA 6C59A9 4B601C 4CEEA1 74C888 91BE9E 4D5F19 955225 ACFDEC 842F32 0FD097 94ABF0]


比谁中毒凶

promised

c:\ABC\virus\msccrt.dll - Signature 'Trojan-PWS.Win32.OnLineGames.es' found
c:\ABC\virus\msccrt.exe
c:\ABC\virus\msdebug.dll - Signature 'Trojan-Proxy.Win32.Small.DU' found
c:\ABC\virus\netsrvcs.dll - Signature 'Trojan-Proxy.Win32.Small.DU' found
c:\ABC\virus\RAV008C.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
c:\ABC\virus\RAV00AE.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
c:\ABC\virus\RemoteDbg.dll - Signature 'Trojan.Win32.Agent.abf' found
c:\ABC\virus\rising835.exe - Signature 'Trojan.Delf.NEB' found
c:\ABC\virus\sys237.exe - Signature 'BehavesLikeWin32.ExplorerHijack' found
c:\ABC\virus\SysInfo.yer - Signature 'Trojan.Delf.NEB' found
c:\ABC\virus\systeme1.exe - Signature 'Trojan-PWS.OnlineGames.AYD' found
c:\ABC\virus\systeme2.exe - Signature 'Trojan-PWS.OnlineGames.AYD' found
c:\ABC\virus\windds32.dll - Signature 'Trojan-Proxy.Win32.Small.DU' found
c:\ABC\virus\windhcp.ocx

        14 Files scanned
          (0 Archives with 0 files)
        12 Signatures found
        0 Suspect code-parts found
        Used time: 0:00.235

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\virus.rar'
F:\病毒样本\virus.rar
  [0] Archive type: RAR
  --> msccrt.dll
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
  --> msccrt.exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
  --> msdebug.dll
      [DETECTION] Is the Trojan horse TR/Agent.22016.B
  --> netsrvcs.dll
      [DETECTION] Is the Trojan horse TR/Agent.22016.B
  --> RAV008C.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGam.QW
  --> RAV00AE.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGam.QW
  --> rising835.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.25496
  --> sys237.exe
      [DETECTION] Is the Trojan horse TR/Hijack.Explor.3642
  --> SysInfo.yer
      [DETECTION] Is the Trojan horse TR/PSW.Steal.25496
  --> systeme1.exe
      [DETECTION] Is the Trojan horse TR/PSW.Onlinegames.AYD.204
  --> windds32.dll
      [DETECTION] Is the Trojan horse TR/Agent.22016.B
      [INFO]      The file was deleted!


End of the scan: 2007年7月6日  20:05
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
     16 Files were scanned
     11 viruses and/or unwanted programs were found
      0 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      5 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

The EQs

Scan performed at: 2007-7-6 20:04:49
Scanning Log
NOD32 version 2382 (20070706) NT
Command line: C:\Documents and Settings\EQ2\桌面\virus.rar
Operating memory - is OK

Date: 6.7.2007  Time: 20:04:55
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\virus.rar
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?msccrt.dll - a variant of Win32/PSW.OnLineGames.NBZ trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?msccrt.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?msdebug.dll - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?netsrvcs.dll - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?RAV008C.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?RAV00AE.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?RemoteDbg.dll - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?rising835.exe - a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?sys237.exe - probably a variant of Win32/TrojanDownloader.Delf.NJH trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?SysInfo.yer - a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?systeme1.exe - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?systeme2.exe - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?windds32.dll - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\EQ2\桌面\virus.rar ?RAR ?windhcp.ocx - a variant of Win32/Agent.NIK trojan
Number of scanned files: 15
Number of threats found: 14
Number of files cleaned: 1
Time of completion: 20:04:56 Total scanning time: 1 sec (00:00:01)

allenhippo

这次nod真猛 和BD一样了

wangjay1980

detected: virus Heur.Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/msccrt.exe
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/RAV008C.exe//PE_Patch//UPack
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/RAV00AE.exe//PE_Patch//UPack
detected: virus Heur.Downloader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/rising835.exe
detected: virus Heur.Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/sys237.exe


Hello,

msccrt.dll, msccrt.exe_, RAV008C.exe_, RAV00AE.exe_ - Trojan-PSW.Win32.OnLineGames.es,
msdebug.dll, netsrvcs.dll, RemoteDbg.dll, systeme1.exe_, systeme2.exe_, windds32.dll, windhcp.ocx - Trojan-Proxy.Win32.Small.du,
rising835.exe_, SysInfo.yer - Trojan-PSW.Win32.Delf.qc,
sys237.exe_ - Trojan-Downloader.Win32.Agent.bwg

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: virus14.zip

[ 本帖最后由 wangjay1980 于 2007-7-6 21:53 编辑 ]

小邪邪

BD引擎挺变态的

tracydk

原帖由 小邪邪 于 2007-7-6 20:07 发表
BD引擎挺变态的

BD,好强啊

promised

壳王１３个

moonsilver

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.OnlineGames.czg
病毒： Trojan.PSW.Win32.QQPass.qkd
病毒： Trojan.PSW.Win32.QQPass.qkd

用户来源：互联网

软件版本：19.30.42