今日蜜罐19个

FBAV

风暴微塔……



[ 本帖最后由 FBAV 于 2007-7-19 18:56 编辑 ]

zxy900906

Scan performed at: 2007-7-19 18:50:38
Scanning Log
NOD32 version 2406 (20070719) NT
Command line: C:\Documents and Settings\Administrator\桌面\蜜罐.rar

Date: 19.7.2007  Time: 18:50:40
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Administrator\桌面\蜜罐.rar
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?TIMHost.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?mppds.exe - is OK
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?c_362.nls - Win32/Alman.NAA virus - was a part of the deleted object
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?AVPSrv.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?WinForm.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?WinForm.dll - is OK
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?TIMHost.dll - is OK
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?nwizzhuxians.exe - a variant of Win32/PSW.Agent.NEW trojan
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?nwizzhuxians.dll - is OK
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?mppds.dll - is OK
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?k11795711836.exe - a variant of Win32/PSW.OnLineGames.NCU trojan
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?k11795711836.DAT - is OK
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?k11795711814.exe - a variant of Win32/PSW.OnLineGames.NCU trojan
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?k11795711814.DAT - probably a variant of Win32/PSW.OnLineGames.NCU trojan
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?k11795711803.exe - a variant of Win32/PSW.OnLineGames.NCU trojan
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?k11795711803.DAT - is OK
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?AVPSrv.dll - a variant of Win32/PSW.OnLineGames.NBZ trojan
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?9157BFC4.EXE - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Administrator\桌面\蜜罐.rar ?RAR ?35457B14.DLL - probably a variant of Win32/Genetik trojan
Number of scanned files: 20
Number of threats found: 12
Number of files cleaned: 1
Time of completion: 18:50:42 Total scanning time: 2 sec (00:00:02)

1688388728

探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.yn 文件: E:\病毒库\蜜罐.rar/TIMHost.exe
探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.abx 文件: E:\病毒库\蜜罐.rar/mppds.exe
探测到: 木马程序 Backdoor.Win32.Agent.anp 文件: E:\病毒库\蜜罐.rar/c_362.nls
探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.zb 文件: E:\病毒库\蜜罐.rar/AVPSrv.exe
探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.acf 文件: E:\病毒库\蜜罐.rar/WinForm.exe//PE_Patch.UPX//UPX
探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.acf 文件: E:\病毒库\蜜罐.rar/WinForm.dll
探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.yn 文件: E:\病毒库\蜜罐.rar/TIMHost.dll
探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.acc 文件: E:\病毒库\蜜罐.rar/nwizzhuxians.exe//PE_Patch//UPack
探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.abs 文件: E:\病毒库\蜜罐.rar/nwizzhuxians.dll
探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.abx 文件: E:\病毒库\蜜罐.rar/mppds.dll
探测到: 病毒 Trojan.Generic (变种) 文件: E:\病毒库\蜜罐.rar/k11795711836.exe//PE_Patch//UPack
探测到: 病毒 Trojan.Generic (变种) 文件: E:\病毒库\蜜罐.rar/k11795711814.exe//PE_Patch//UPack
探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.aci 文件: E:\病毒库\蜜罐.rar/k11795711803.exe//PE_Patch//UPack
探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.zb 文件: E:\病毒库\蜜罐.rar/AVPSrv.dll
未找到: 病毒 Trojan.Generic (变种) 文件: E:\病毒库\蜜罐.rar/9157BFC4.EXE//ASPack

[ 本帖最后由 1688388728 于 2007-7-19 19:23 编辑 ]

自由

卡巴13个
1.已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.yn URL: http://bbs.kafan.cn/attachment.php?aid=102694/TIMHost.exe
2.已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.yn 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\TIMHost.exe
3.已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.abx 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\mppds.exe
4.已删除: 木马程序 Backdoor.Win32.Agent.anp 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\c_362.nls
5.已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.zb 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\AVPSrv.exe
6.已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.acf 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\WinForm.exe/PE_Patch.UPX/UPX
7.已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.acf 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\WinForm.dll
8.已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.yn 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\TIMHost.dll
9.已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.acc 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\nwizzhuxians.exe/PE_Patch/UPack
10.已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.abs 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\nwizzhuxians.dll
11.已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.abx 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\mppds.dll
12.已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.aci 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\k11795711803.exe/PE_Patch/UPack
13.已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.zb 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\AVPSrv.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\蜜罐\k11795711803.DAT/UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\蜜罐\k11795711814.DAT/UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\蜜罐\k11795711814.exe/PE_Patch/UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\蜜罐\k11795711836.DAT/UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.abt 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\蜜罐\k11795711836.exe/PE_Patch/UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.acc 文件: C:\Documents and Settings\wing\桌面\蜜罐.rar\蜜罐\nwizzhuxians.exe/PE_Patch/UPack

[ 本帖最后由 自由 于 2007-7-19 23:09 编辑 ]

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/18 08:11:18 (811592 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 831933
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~OD1.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files in the directory: F:\v\
        0 ms F:\v\35457B14.DLL                                            Trojan Hupigon.gen66 ()
     1578 ms F:\v\9157BFC4.EXE                                          
       16 ms F:\v\AVPSrv.dll                                             
        0 ms F:\v\AVPSrv.exe                                              Trojan W32/OnLineGames.IBB ()
       31 ms F:\v\c_362.nls                                               Backdoor W32/Agent.BTTB ()
        0 ms F:\v\k11795711803.DAT                                        Security Risk W32/Suspicious_U.gen ()
        0 ms F:\v\k11795711803.exe                                        Security Risk W32/Suspicious_U.gen ()
        0 ms F:\v\k11795711814.DAT                                        Security Risk W32/Suspicious_U.gen ()
        0 ms F:\v\k11795711814.exe                                        Security Risk W32/Suspicious_U.gen ()
        0 ms F:\v\k11795711836.DAT                                        Security Risk W32/Suspicious_U.gen ()
        0 ms F:\v\k11795711836.exe                                        Security Risk W32/Suspicious_U.gen ()
        0 ms F:\v\mppds.dll                                               Trojan OnlineGames.gen11 ()
        0 ms F:\v\mppds.exe                                               Trojan W32/OnLineGames.IRD ()
       15 ms F:\v\nwizzhuxians.dll                                       
        0 ms F:\v\nwizzhuxians.exe                                        Security Risk W32/Suspicious_U.gen ()
        0 ms F:\v\TIMHost.dll                                            
        0 ms F:\v\TIMHost.exe                                             Trojan W32/OnLineGames.ICG ()
        0 ms F:\v\WinForm.dll                                            
     9468 ms F:\v\WinForm.exe                                            
- File F:\v\35457B14.DLL quarantined.
- File F:\v\35457B14.DLL deleted.
- File F:\v\AVPSrv.exe quarantined.
- File F:\v\AVPSrv.exe deleted.
- File F:\v\c_362.nls quarantined.
- File F:\v\c_362.nls deleted.
- File F:\v\k11795711803.DAT quarantined.
- File F:\v\k11795711803.DAT deleted.
- File F:\v\k11795711803.exe quarantined.
- File F:\v\k11795711803.exe deleted.
- File F:\v\k11795711814.DAT quarantined.
- File F:\v\k11795711814.DAT deleted.
- File F:\v\k11795711814.exe quarantined.
- File F:\v\k11795711814.exe deleted.
- File F:\v\k11795711836.DAT quarantined.
- File F:\v\k11795711836.DAT deleted.
- File F:\v\k11795711836.exe quarantined.
- File F:\v\k11795711836.exe deleted.
- File F:\v\mppds.dll quarantined.
- File F:\v\mppds.dll deleted.
- File F:\v\mppds.exe quarantined.
- File F:\v\mppds.exe deleted.
- File F:\v\nwizzhuxians.exe quarantined.
- File F:\v\nwizzhuxians.exe deleted.
- File F:\v\TIMHost.exe quarantined.
- File F:\v\TIMHost.exe deleted.

===================================================================================================

The scanning started: 2007/07/19 18:58:05
               ended: 2007/07/19 18:58:17
Logged on as        : Administrator
on hostname         : BE29C0E1C4C9406

Scanning results:
   Total number of files found..............................:      19
   Number of files scanned..................................:      19
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       0
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:      13

Copyright (c) 1993-2005 Norman ASA.

promised

通杀
C:\ABC\蜜罐\35457B14.DLL - 特征码 'Trojan-PWS.Win32.Nilage.lp' 被发现
C:\ABC\蜜罐\9157BFC4.EXE - 特征码 'Win32.SuspectCrc' 被发现
C:\ABC\蜜罐\AVPSrv.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.es' 被发现
C:\ABC\蜜罐\AVPSrv.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.es' 被发现
C:\ABC\蜜罐\c_362.nls - 特征码 'Virus.Win32.Alman.a' 被发现
C:\ABC\蜜罐\k11795711803.DAT - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\蜜罐\k11795711803.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\蜜罐\k11795711814.DAT - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\蜜罐\k11795711814.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\蜜罐\k11795711836.DAT - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\蜜罐\k11795711836.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\蜜罐\mppds.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.es' 被发现
C:\ABC\蜜罐\mppds.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.abx' 被发现
C:\ABC\蜜罐\nwizzhuxians.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.sl' 被发现
C:\ABC\蜜罐\nwizzhuxians.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\蜜罐\TIMHost.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.yn' 被发现
C:\ABC\蜜罐\TIMHost.exe - 特征码 'Trojan-PWS.WSGame.AV' 被发现
C:\ABC\蜜罐\WinForm.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.es' 被发现
C:\ABC\蜜罐\WinForm.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.es' 被发现

        19 个文件被扫描
          (0 个压缩档 0 个文件)
        19 个特征码被侦测
        0 个可疑代码段被发现
        耗时: 0:00.187

woai_jolin

原帖由 promised 于 2007-7-19 19:13 发表
通杀
C:\ABC\蜜罐\35457B14.DLL - 特征码 'Trojan-PWS.Win32.Nilage.lp' 被发现
C:\ABC\蜜罐\9157BFC4.EXE - 特征码 'Win32.SuspectCrc' 被发现
C:\ABC\蜜罐\AVPSrv.dll - 特征码 'Trojan-PWS.Win32.OnLineG ...

快无敌咯

hahacomcn

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\蜜罐.rar'
C:\Documents and Settings\Administrator\桌面\蜜罐.rar
  [0] Archive type: RAR
  --> TIMHost.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
  --> mppds.exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
  --> AVPSrv.exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
  --> WinForm.exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
  --> WinForm.dll
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
  --> TIMHost.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> nwizzhuxians.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGam.QW
  --> nwizzhuxians.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> mppds.dll
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
  --> k11795711836.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> k11795711836.DAT
      [DETECTION] Contains suspicious code HEUR/Malware
  --> k11795711814.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGam.QW
  --> k11795711814.DAT
      [DETECTION] Is the Trojan horse TR/Agent.6915
  --> k11795711803.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> k11795711803.DAT
      [DETECTION] Contains suspicious code HEUR/Malware
  --> AVPSrv.dll
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
  --> 9157BFC4.EXE
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Exaal.45056 Backdoor server programs

风雪

1184843858,2007-7-19 19:17:38,Heuri.Possible/Packed,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\蜜罐.rar>>9157BFC4.EXE,Manual scan
1184843858,2007-7-19 19:17:38,TrojanPSW.OnLineGames.zb.ntpe.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\蜜罐.rar>>AVPSrv.dll,Manual scan
1184843858,2007-7-19 19:17:38,TrojanPSW.OnLineGames.zb.erlu,木马,mygood,D:\3\新建文件夹\新建文件夹\蜜罐.rar>>AVPSrv.exe,Manual scan
1184843858,2007-7-19 19:17:38,TrojanDownloader.Agent.ira.tlwr.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\蜜罐.rar>>c_362.nls,Manual scan
1184843858,2007-7-19 19:17:38,Heuri.ERNM,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\蜜罐.rar>>k11795711803.exe,Manual scan
1184843858,2007-7-19 19:17:38,TrojanPSW.GamePass.smw.cxet.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\蜜罐.rar>>k11795711814.DAT,Manual scan
1184843858,2007-7-19 19:17:38,TrojanPSW.GamePass.spu.zxid,木马,mygood,D:\3\新建文件夹\新建文件夹\蜜罐.rar>>k11795711814.exe,Manual scan
1184843858,2007-7-19 19:17:38,Heuri.ERNM,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\蜜罐.rar>>k11795711836.exe,Manual scan
1184843858,2007-7-19 19:17:38,TrojanPSW.GamePass.rdv.psix,木马,mygood,D:\3\新建文件夹\新建文件夹\蜜罐.rar>>nwizzhuxians.exe,Manual scan
1184843858,2007-7-19 19:17:38,TrojanPSW.OnLineGames.yn.rqdy.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\蜜罐.rar>>TIMHost.dll,Manual scan
1184843858,2007-7-19 19:17:38,TrojanPSW.OnLineGames.yn.fqor,木马,mygood,D:\3\新建文件夹\新建文件夹\蜜罐.rar>>TIMHost.exe,Manual scan
费尔

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.yn        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/TIMHost.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.abx        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/mppds.exe
detected: Trojan program Backdoor.Win32.Agent.anp        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/c_362.nls
detected: Trojan program Trojan-PSW.Win32.OnLineGames.zb        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/AVPSrv.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.acf        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/WinForm.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.acf        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/WinForm.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.yn        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/TIMHost.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.acc        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/nwizzhuxians.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.abs        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/nwizzhuxians.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.abx        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/mppds.dll
detected: virus Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/k11795711836.exe//PE_Patch//UPack
detected: virus Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/k11795711814.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.aci        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/k11795711803.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.zb        File: C:\Documents and Settings\Owner\×ÀÃæ\ÃÛ¹Þ.rar/AVPSrv.dll