毒毒网

小飞侠.net

htt p://61.129.76.80/down?cid=1E02C7D6FC797D5870BC968429DAA9F5523F3565&t=304&fmt=-  

Date,Virus Name,Virus Type,User,Filename,Scan Type
2007-07-15 17:58:44,JS.Decoder.u,病毒,小飞侠.net,C:\Documents and Settings\小飞侠.net\Local Settings\Temporary Internet Files\Content.IE5\61FOPOZQ\Q014[1].htm,Realtime scan
2007-07-15 17:58:43,VBS.Decoder.j,病毒,小飞侠.net,C:\Documents and Settings\小飞侠.net\Local Settings\Temporary Internet Files\Content.IE5\61FOPOZQ\2[1].htm,Realtime scan
2007-07-15 17:58:43,VBS.Decoder.j,病毒,小飞侠.net,C:\Documents and Settings\小飞侠.net\Local Settings\Temporary Internet Files\Content.IE5\X51233PE\ani[1].htm,Realtime scan
2007-07-15 17:58:42,VBS.Decoder.j,病毒,小飞侠.net,C:\Documents and Settings\小飞侠.net\Local Settings\Temporary Internet Files\Content.IE5\RZP3B54W\2[1].htm,Realtime scan
2007-07-15 17:58:41,JS.Decoder.u,病毒,小飞侠.net,C:\Documents and Settings\小飞侠.net\Local Settings\Temporary Internet Files\Content.IE5\YXYTOHKN\Q014[1].htm,Realtime scan
2007-07-15 17:58:32,VBS.Decoder.j,病毒,小飞侠.net,C:\Documents and Settings\小飞侠.net\Local Settings\Temporary Internet Files\Content.IE5\T4GBD1O5\ani[1].htm,Realtime scan

费尔爆爆喔

liaoying112

有些是恶意代码注入的哦

1688388728

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\I0GU558Q\ah[1].c - infected with Exploit.ANIFile

PPwangS

霏凡表情都过来了

小飞侠.net

Q014.htm --> ht tp://www.ndnd.info/cai/qq.exe
2.htm --> ht tp://www.88889999.info/cai/qq.exe
ani.htm --> ah.c --> ht tp://www.88889999.info/cai/qq.exe

qq.exe 下载
ht[:17:] tp://xz.88889999.info/1.exe
ht[:17:] tp://xz.88889999.info/2.exe
ht[:17:] tp://xz.88889999.info/3.exe
ht[:17:] tp://xz.88889999.info/4.exe
ht[:17:] tp://xz.88889999.info/5.exe
ht[:17:] tp://xz.88889999.info/6.exe
ht[:17:] tp://xz.88889999.info/7.exe
ht[:17:] tp://xz.88889999.info/8.exe
ht[:17:] tp://xz.88889999.info/9.exe
ht[:17:] tp://xz.88889999.info/10.exe
ht[:17:] tp://xz.88889999.info/11.exe
ht[:17:] tp://xz.88889999.info/12.exe
ht[:17:] tp://xz.88889999.info/13.exe
ht[:17:] tp://xz.88889999.info/14.exe
ht[:17:] tp://xz.88889999.info/15.exe

promised

C:\ABC\ABC.zip:\2.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.zb' 被发现
C:\ABC\ABC.zip:\3.exe - 特征码 'Trojan-PWS.WSGame.AV' 被发现
C:\ABC\ABC.zip:\4.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\ABC.zip:\5.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\ABC.zip:\6.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\ABC.zip:\7.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\ABC.zip:\8.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\ABC.zip:\9.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.es' 被发现
C:\ABC\ABC.zip:\qq.exe - 特征码 'Trojan-PWS.Win32.QQPass.pb' 被发现
C:\ABC\ABC.zip:\1.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\ABC.zip:\10.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\ABC.zip
12 个文件被扫描
   (1 个压缩档 11 个文件)
11 个特征码被侦测
0 个可疑代码段被发现
耗时: 0:00.218

[ 本帖最后由 promised 于 2007-7-15 19:31 编辑 ]

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\ABC.zip'
F:\病毒样本\ABC.zip
  [0] Archive type: ZIP
  --> 2.exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
  --> 3.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
  --> 4.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 5.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 6.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 7.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 8.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 9.exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
  --> qq.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 1.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 10.exe
      [DETECTION] Is the Trojan horse TR/Hook.Shell.152
      [INFO]      The file was deleted!

hj5abc

Scanning Log
NOD32 version 2399 (20070714) NT
Command line: F:\ABC
Operating memory - is OK

Date: 15.7.2007  Time: 19:22:12
Anti-Stealth technology is enabled.
Scanned disks, folders and files: F:\ABC\
F:\ABC\2.exe - probably a variant of Win32/PSW.OnLineGames.YA trojan
F:\ABC\3.exe - a variant of Win32/PSW.OnLineGames.YA trojan
F:\ABC\qq.exe - a variant of Win32/TrojanDownloader.Delf.BHO trojan
Number of scanned files: 11
Number of threats found: 3
Number of files cleaned: 3

hj5abc

1,4,5,6,7,8,9,10 好像是同一个.nod32一并过了..

[ 本帖最后由 hj5abc 于 2007-7-15 19:33 编辑 ]

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.zb        File: C:\Documents and Settings\Owner\×ÀÃæ\ABC.zip/2.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.yn        File: C:\Documents and Settings\Owner\×ÀÃæ\ABC.zip/3.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.es        File: C:\Documents and Settings\Owner\×ÀÃæ\ABC.zip/9.exe
detected: virus Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\ABC.zip/qq.exe//PE_Patch.UPX
detected: Trojan program Trojan-Spy.Win32.Delf.uv        File: C:\Documents and Settings\Owner\×ÀÃæ\ABC.zip/10.exe//UPack