捡个便宜15个（我把死尸删掉了）

promised

http://bbs.kafan.cn/viewthread.php?tid=107562&extra=page%3D1&page=4
[MD5: 0BB6FE 60D982 72E3D8 C9DB55 81F068 CD1E84 DA2816 A1F589 1A6C6D BB663D 97F430 1723C1 4FF0DE 47DD27 F7BFE8]

[ 本帖最后由 promised 于 2007-7-13 17:44 编辑 ]

promised

C:\ABC\1093\1093\1012.exe - 特征码 'Trojan-PWS.Win32.Agent.BU' 被发现
C:\ABC\1093\1093\1064.exe - 可疑代码段 被发现 (Level: 150)
C:\ABC\1093\1093\1093.exe - 特征码 'Trojan-Downloader.Win32.Banload.ami' 被发现
C:\ABC\1093\1093\19008.exe - 特征码 'Trojan-Downloader.26574' 被发现
C:\ABC\1093\1093\2209.exe - 特征码 'Trojan-PWS.Win32.Agent.BU' 被发现
C:\ABC\1093\1093\62205.exe - 特征码 'Trojan-PWS.Win32.Agent.BU' 被发现
C:\ABC\1093\1093\802.exe - 特征码 'Worm.Win32.Agent.t' 被发现
C:\ABC\1093\1093\80325.exe - 特征码 'Trojan-PWS.Win32.Agent.BU' 被发现
C:\ABC\1093\1093\cc_231.exe - 特征码 'Trojan-PWS.Win32.Agent.BU' 被发现
C:\ABC\1093\1093\dodolook264.exe - 特征码 'not-a-virus:AdWare.Win32.Cinmus.f' 被发现
C:\ABC\1093\1093\downloader1.exe - 特征码 'Trojan-Downloader.Win32.Cryptic.c' 被发现
C:\ABC\1093\1093\host.exe - 特征码 'not-a-virus:AdWare.Win32.Agent.ck' 被发现
C:\ABC\1093\1093\pv0018.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\1093\1093\s5888.exe - 特征码 'Trojan-PWS.Win32.Agent.BU' 被发现
C:\ABC\1093\1093\Server.exe - 特征码 'Trojan.Delf.NEB' 被发现

        15 个文件被扫描
          (0 个压缩档 0 个文件)
        14 个特征码被侦测
        1 个可疑代码段被发现
        耗时: 0:00.312

FBAV

风暴胜者V2 贺岁精简网络版本
_________您的安全是我们的责任_______________
作者：Sanhuan222@163.com   TM:469428271
个人Blog：http://hi.baidu.com/迅者/



===============================================
   ___________病毒查杀结果__________________


===============================================

2007年5月13日17时36分52秒 开始查杀C:\Documents and Settings\Administrator\桌面\virus\1093
威胁性文件：C:\Documents and Settings\Administrator\桌面\virus\1093\1093\1012.exe
C:\Documents and Settings\Administrator\桌面\virus\1093\1093\1064.exe 发现未知可疑文件:Win32.NkHack.PEC.A 操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\virus\1093\1093\1093.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\virus\1093\1093\19008.exe
C:\Documents and Settings\Administrator\桌面\virus\1093\1093\2209.exe 发现未知可疑文件:Win32.Nop _2? 操作:阻止运行
C:\Documents and Settings\Administrator\桌面\virus\1093\1093\62205.exe 发现未知可疑文件:Win32.Nop ? 操作:阻止运行
C:\Documents and Settings\Administrator\桌面\virus\1093\1093\802.exe 发现未知可疑文件:Win32.NkHack.PEC.A 操作:阻止运行
C:\Documents and Settings\Administrator\桌面\virus\1093\1093\80325.exe 发现未知可疑文件:Win32.Nop _2? 操作:阻止运行
C:\Documents and Settings\Administrator\桌面\virus\1093\1093\cc_231.exe 发现未知可疑文件:Win32.Nop VtF$ 操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\virus\1093\1093\dodolook264.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\virus\1093\1093\host.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\virus\1093\1093\pv0018.exe
C:\Documents and Settings\Administrator\桌面\virus\1093\1093\s5888.exe 发现未知可疑文件:Win32.Nop _2? 操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\virus\1093\1093\Server.exe
****************************
您应该引起注意的文件:

-----------------------------------------


=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。


C:\Documents and Settings\Administrator\桌面\virus\1093\1093\downloader1.exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\virus\1093\1093\Server.exe 带壳文件:UPX加壳
-----------------------------------------

2007年5月13日17时36分53秒收起线程…100% 查杀完毕！
扫描文件：15查杀病毒：14

  代码重写的……

[ 本帖最后由 FBAV 于 2007-7-13 17:37 编辑 ]

The EQs

Scan performed at: 2007-7-13 17:38:06
Scanning Log
NOD32 version 2396 (20070712) NT
Command line: C:\Documents and Settings\EQ2\桌面\1093.rar
Operating memory - is OK

Date: 13.7.2007  Time: 17:38:15
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\1093.rar
C:\Documents and Settings\EQ2\桌面\1093.rar ?RAR ?1093\1012.exe - a variant of Win32/Agent.NEO trojan
C:\Documents and Settings\EQ2\桌面\1093.rar ?RAR ?1093\1064.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\1093.rar ?RAR ?1093\1093.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\1093.rar ?RAR ?1093\2209.exe - probably a variant of Win32/Agent.NEO trojan
C:\Documents and Settings\EQ2\桌面\1093.rar ?RAR ?1093\62205.exe - probably a variant of Win32/Agent.NEO trojan
C:\Documents and Settings\EQ2\桌面\1093.rar ?RAR ?1093\802.exe - probably a variant of Win32/Agent.NAU worm
C:\Documents and Settings\EQ2\桌面\1093.rar ?RAR ?1093\80325.exe - probably a variant of Win32/Agent.NEO trojan
C:\Documents and Settings\EQ2\桌面\1093.rar ?RAR ?1093\cc_231.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\1093.rar ?RAR ?1093\dodolook264.exe ?NSIS ?1246.exe ?NSIS ?acpidisk.sys - a variant of Win32/Adware.Cinmus application - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\1093.rar ?RAR ?1093\downloader1.exe - Win32/TrojanDownloader.VB.APY trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\1093.rar ?RAR ?1093\host.exe - Win32/TrojanDropper.Delf.NEY trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\1093.rar ?RAR ?1093\s5888.exe - probably a variant of Win32/Agent.NEO trojan
Number of scanned files: 19
Number of threats found: 12
Number of files cleaned: 1
Time of completion: 17:38:20 Total scanning time: 5 sec (00:00:05)

Notes:
[7] File is probably infected with an unknown virus.

quansen83

Begin scan in 'C:\Documents and Settings\Administrator\桌面\15个.rar'
C:\Documents and Settings\Administrator\桌面\15个.rar
  [0] Archive type: RAR
  --> 1093\1012.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.ahj.726 Backdoor server programs
  --> 1093\1064.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 1093\1093.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 1093\19008.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 1093\2209.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> 1093\62205.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> 1093\802.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 1093\80325.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> 1093\cc_231.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> 1093\dodolook264.exe
      [DETECTION] Contains signature of the dropper DR/Cinmus.J.187
  --> 1093\downloader1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> 1093\host.exe
      [DETECTION] Contains signature of the dropper DR/Agent.BZ.7
  --> 1093\s5888.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> 1093\Server.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.27210
      [INFO]      The file was deleted!

coppola

****************************
* Scan On Demond By Mcafee *
*     07/13/07 17:48:11    *
****************************

D:\Downloads\1093.rar\1012.EXE                        New Malware.dm(Trojan)
D:\Downloads\1093.rar\1093.EXE                        Generic Downloader.p(Trojan)
D:\Downloads\1093.rar\19008.EXE\00002230.EXE        Generic Downloader.af(Trojan)
D:\Downloads\1093.rar\2209.EXE                        New Malware.dm(Trojan)
D:\Downloads\1093.rar\62205.EXE                        New Malware.dm(Trojan)
D:\Downloads\1093.rar\80325.EXE                        New Malware.dm(Trojan)
D:\Downloads\1093.rar\CC_231.EXE                        New Malware.dm(Trojan)
D:\Downloads\1093.rar\PV0018.EXE                        New Malware.aj(Trojan)
D:\Downloads\1093.rar\S5888.EXE                        New Malware.dm(Trojan)
D:\Downloads\1093.rar\SERVER.EXE\SERVER.EXE                PWS-QQPass(Trojan)

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\1093.rar'
F:\病毒样本\1093.rar
  [0] Archive type: RAR
  --> 1093\1012.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.ahj.726 Backdoor server programs
  --> 1093\1064.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 1093\1093.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 1093\19008.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 1093\2209.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> 1093\62205.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> 1093\802.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 1093\80325.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> 1093\cc_231.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> 1093\dodolook264.exe
      [DETECTION] Contains signature of the dropper DR/Cinmus.J.187
  --> 1093\downloader1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> 1093\host.exe
      [DETECTION] Contains signature of the dropper DR/Agent.BZ.7
  --> 1093\pv0018.exe
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> 1093\s5888.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> 1093\Server.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.27210
      [INFO]      The file was deleted!


End of the scan: 2007年7月13日  17:50
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
     17 Files were scanned
     15 viruses and/or unwanted programs were found
      6 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     -4 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

shenrenrenren

卡巴报了好多启发，15个
已删除: 木马程序 Backdoor.Win32.Agent.ahj 文件: E:\我的电影\1093.rar/1093\1012.exe
已隔离: 病毒 Downloader (变种) 文件: E:\我的电影\1093.rar/1093\1064.exe//PE_Patch.PECompact//PecBundle//PECompact
已删除: 木马程序 Trojan-Downloader.Win32.Banload.bpo 文件: E:\我的电影\1093.rar/1093\1093.exe//PE_Patch.PECompact//PecBundle//PECompact
已删除: 木马程序 Trojan-Downloader.Win32.Tiny.gn 文件: E:\我的电影\1093.rar/1093\19008.exe
已隔离: 病毒 Trojan.Generic (变种) 文件: E:\我的电影\1093.rar/1093\2209.exe
已隔离: 病毒 Trojan.Generic (变种) 文件: E:\我的电影\1093.rar/1093\62205.exe
已隔离: 病毒 Trojan.Generic (变种) 文件: E:\我的电影\1093.rar/1093\802.exe//PE_Patch.PECompact//PecBundle//PECompact
已隔离: 病毒 Trojan.Generic (变种) 文件: E:\我的电影\1093.rar/1093\80325.exe
已删除: 广告程序 not-a-virus:AdWare.Win32.Cinmus.j 文件: E:\我的电影\1093.rar/1093\dodolook264.exe//data0003//data0003
已删除: 广告程序 not-a-virus:AdWare.Win32.Cinmus.j 文件: E:\我的电影\1093.rar/1093\dodolook264.exe//data0003//data0004
已删除: 木马程序 Trojan-Downloader.Win32.Cryptic.gen 文件: E:\我的电影\1093.rar/1093\downloader1.exe
已删除: 广告程序 not-a-virus:AdWare.Win32.Agent.ck 文件: E:\我的电影\1093.rar/1093\host.exe
已删除: 木马程序 Trojan-Downloader.Win32.Agent.bto 文件: E:\我的电影\1093.rar/1093\pv0018.exe//PE_Patch//UPack
已隔离: 病毒 Trojan.Generic (变种) 文件: E:\我的电影\1093.rar/1093\s5888.exe
已删除: 木马程序 Trojan-Spy.Win32.Delf.vr 文件: E:\我的电影\1093.rar/1093\Server.exe//UPX

风雪

1184320758,2007-7-13 17:59:18,Heuri.Possible/Packed,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\1093\1012.exe,Realtime scan
1184320763,2007-7-13 17:59:23,Heuri.Possible/Packed,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\1093\1012.exe,Manual scan
1184320763,2007-7-13 17:59:23,TrojanDownloader.Delf.bqm.mjik,木马,mygood,D:\3\新建文件夹\新建文件夹\1093\1093.exe,Manual scan
1184320763,2007-7-13 17:59:23,TrojanDownloader.Agent.wez.qogt,木马,mygood,D:\3\新建文件夹\新建文件夹\1093\19008.exe,Manual scan
1184320763,2007-7-13 17:59:23,Heuri.Possible/Packed,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\1093\2209.exe,Manual scan
1184320763,2007-7-13 17:59:23,Heuri.Possible/Packed,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\1093\62205.exe,Manual scan
1184320763,2007-7-13 17:59:23,Heuri.Possible/Packed,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\1093\80325.exe,Manual scan
1184320763,2007-7-13 17:59:23,Heuri.Possible/Packed,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\1093\cc_231.exe,Manual scan
1184320763,2007-7-13 17:59:23,Trojan.Cinmeng.ijeb.arc,木马,mygood,D:\3\新建文件夹\新建文件夹\1093\dodolook264.exe,Manual scan
1184320763,2007-7-13 17:59:23,Dropper.Agent.b.wliv,病毒,mygood,D:\3\新建文件夹\新建文件夹\1093\host.exe,Manual scan
1184320763,2007-7-13 17:59:23,TrojanDownloader.Agent.wlr.dupc,木马,mygood,D:\3\新建文件夹\新建文件夹\1093\pv0018.exe,Manual scan
1184320763,2007-7-13 17:59:23,Heuri.Possible/Packed,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\1093\s5888.exe,Manual scan
1184320763,2007-7-13 17:59:23,TrojanSpy.Delf.vr.rfnn,木马,mygood,D:\3\新建文件夹\新建文件夹\1093\Server.exe,Manual scan
费尔。

scottxzt

1012.exe;D:\Documents and Settings\dell\桌面\新建文件夹\1093;Trojan.Popwin;;
1064.exe;D:\Documents and Settings\dell\桌面\新建文件夹\1093;Trojan.DownLoader.27530;;
1093.exe;D:\Documents and Settings\dell\桌面\新建文件夹\1093;Trojan.DownLoader.26659;;
19008.exe;D:\Documents and Settings\dell\桌面\新建文件夹\1093;Trojan.DownLoader.26574;;
2209.exe;D:\Documents and Settings\dell\桌面\新建文件夹\1093;Trojan.Popwin;;
62205.exe;D:\Documents and Settings\dell\桌面\新建文件夹\1093;BackDoor.QQChin;;
802.exe;D:\Documents and Settings\dell\桌面\新建文件夹\1093;Win32.HLLW.Autoruner.253;;
80325.exe;D:\Documents and Settings\dell\桌面\新建文件夹\1093;Trojan.Popwin;;
downloader1.exe;D:\Documents and Settings\dell\桌面\新建文件夹\1093;Trojan.DownLoader.14143;;
pv0018.exe;D:\Documents and Settings\dell\桌面\新建文件夹\1093;Trojan.Resun;;
s5888.exe;D:\Documents and Settings\dell\桌面\新建文件夹\1093;Trojan.Popwin;;
Server.exe;D:\Documents and Settings\dell\桌面\新建文件夹\1093;Trojan.PWS.Gamania.2453;;