3个[MD5: 1DA408 2462AA 036BA8]

zane_xzz

再来3个，不知道发过没有，md5没有重复

quansen83

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本[1]'
C:\Documents and Settings\Administrator\桌面\样本[1]\I.scr
  [0] Archive type: RAR SFX (self extracting)
  --> svchostc.exe
      [DETECTION] Is the Trojan horse TR/Drop.Age.92160.B
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本[1]\wo.scr
  [0] Archive type: RAR SFX (self extracting)
  --> smsss.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.115200.1
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\样本[1]\you.scr
  [0] Archive type: RAR SFX (self extracting)
  --> smsss.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.115200.1
      [INFO]      The file was deleted!

xxwpk007

已删除: 木马程序 Trojan-PSW.Win32.Maran.is        文件: G:\样本\样本\样本[1]\wo.scr//data.rar/smsss.exe//PE_Patch.PECompact//PecBundle//PECompact
已删除: 木马程序 Trojan-PSW.Win32.Maran.is        文件: G:\样本\样本\样本[1]\I.scr//data.rar/svchostc.exe//PE_Patch.PECompact//PecBundle//PECompact
已删除: 木马程序 Trojan-PSW.Win32.Maran.is        文件: G:\样本\样本\样本[1]\you.scr//data.rar/smsss.exe//PE_Patch.PECompact//PecBundle//PECompact

曲中求

NOD

Scan performed at: 2007-7-24 9:27:38
Scanning Log
NOD32 version 2415 (20070723) NT
Command line: C:\Documents and Settings\Administrator\桌面\wo.scr C:\Documents and Settings\Administrator\桌面\you.scr C:\Documents and Settings\Administrator\桌面\I.scr

Date: 24.7.2007  Time: 09:27:40
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Administrator\桌面\wo.scr; C:\Documents and Settings\Administrator\桌面\you.scr; C:\Documents and Settings\Administrator\桌面\I.scr
C:\Documents and Settings\Administrator\桌面\wo.scr ?RAR ?smsss.exe - a variant of Win32/PSW.Maran trojan
C:\Documents and Settings\Administrator\桌面\you.scr ?RAR ?smsss.exe - a variant of Win32/PSW.Maran trojan
C:\Documents and Settings\Administrator\桌面\I.scr ?RAR ?svchostc.exe - a variant of Win32/PSW.Maran trojan
Number of scanned files: 6
Number of threats found: 3
Time of completion: 09:27:47 Total scanning time: 7 sec (00:00:07)

微点卫士

金山,费尔全挂!!!
图片没有预览
微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$DI00.406\YOU.SCR
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RARSFX0\SMSSS.EXE
2) C:\WINDOWS.0\SYSTEM32\OD3MDI.DLL
是否删除木马程序及其衍生物?

dragonkf

Start of the scan: 2007年7月24日  09:35

Starting the file scan:

Begin scan in 'E:\测试'
E:\测试\样本[1].part1.rar
  [0] Archive type: RAR
    --> wo.scr
      [1] Archive type: RAR SFX (self extracting)
      --> smsss.exe
          [DETECTION] Is the Trojan horse TR/PSW.Steal.115200.1
    --> I.scr
      [1] Archive type: RAR SFX (self extracting)
      --> svchostc.exe
          [DETECTION] Is the Trojan horse TR/Drop.Age.92160.B
      [INFO]      The file was deleted!

part 2 没有报=。=

[ 本帖最后由 dragonkf 于 2007-7-24 09:38 编辑 ]

yashoo

咖啡不报。。。

yashoo

Thank you for your submission.                                             

Analysis ID: 3924397

File Name            Findings                       Detection                    Type         Extra
--------------------|------------------------------|----------------------------|------------|-----
i.scr               |current detection             |generic pws.y               |Trojan      |no
wo.scr              |current detection             |generic pws                 |Trojan      |no
you.scr             |current detection             |generic pws                 |Trojan      |no

current detection [i.scr wo.scr you.scr]                                   

红心王子

Trojan.PSW.Win32.OnlineGames.cvo

tracydk

avast报毒