毒网产物20个

promised

[MD5: 491D1C B2D858 1317CD B6DD44 830BD0 C386E3 9427DF 287373 62A862 D5B93E BECB94 61F3A5 F03820 2AEFCE 47768F 8B21A1 F1FAA6 208C04 A53BB3 0E5512]

曲中求

东西呢？

曲中求

Scan performed at: 2007-7-26 14:13:05
Scanning Log
NOD32 version 2421 (20070725) NT
Command line: F:\virus\样本

Date: 26.7.2007  Time: 14:13:07
Anti-Stealth technology is enabled.
Scanned disks, folders and files: F:\virus\样本\
F:\virus\样本\1.exe - Win32/TrojanDropper.Rime.Gen trojan
F:\virus\样本\10.exe - Win32/TrojanDropper.Rime.Gen trojan
F:\virus\样本\11.exe - probably unknown NewHeur_PE virus [7]
F:\virus\样本\12.exe - Win32/TrojanDropper.Rime.Gen trojan
F:\virus\样本\13.exe - probably a variant of Win32/PSW.QQPass.VD trojan
F:\virus\样本\14.exe - a variant of Win32/PSW.OnLineGames.NDA trojan
F:\virus\样本\15.exe - a variant of Win32/Agent.NIK trojan
F:\virus\样本\16.exe - Win32/TrojanDropper.Rime.Gen trojan
F:\virus\样本\17.exe - a variant of Win32/PSW.Legendmir.NEP trojan
F:\virus\样本\18.exe - a variant of Win32/PSW.OnLineGames.NDA trojan
F:\virus\样本\19.exe - probably unknown NewHeur_PE virus [7]
F:\virus\样本\3.exe - Win32/TrojanDropper.Rime.Gen trojan
F:\virus\样本\4.exe - a variant of Win32/PSW.OnLineGames.NDA trojan
F:\virus\样本\5.exe - Win32/TrojanDropper.Rime.Gen trojan
F:\virus\样本\6.exe - a variant of Win32/PSW.OnLineGames.YA trojan
F:\virus\样本\7.exe - Win32/TrojanDropper.Rime.Gen trojan
F:\virus\样本\8.exe - Win32/TrojanDropper.Rime.Gen trojan
F:\virus\样本\9.exe - Win32/TrojanDropper.Rime.Gen trojan
F:\virus\样本\down.exe - probably a variant of Win32/PSW.Delf.NHI trojan
Number of scanned files: 20
Number of threats found: 19
Time of completion: 14:13:14 Total scanning time: 7 sec (00:00:07)

Notes:
[7] File is probably infected with an unknown virus.

woai_jolin

Nerazzurri

Start of the scan: 2007年7月26日  14:15

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar'
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar
  [0] Archive type: RAR
  --> 4.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 6.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
  --> 11.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> 13.exe
      [DETECTION] Is the Trojan horse TR/Drop.Age.32873.C
  --> 14.exe
      [DETECTION] Is the Trojan horse TR/Hook.Shell.206
  --> 15.exe
      [DETECTION] Is the Trojan horse TR/Agent.22016.B
  --> 17.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> 18.exe
      [DETECTION] Is the Trojan horse TR/Drop.ShellHook.A
  --> 19.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.YPT.1 Backdoor server programs
  --> down.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年7月26日  14:15
Used time: 00:11 min

The scan has been done completely.

      0 Scanning directories
     21 Files were scanned
     10 viruses and/or unwanted programs were found
      1 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     10 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

___________
NOD

Scan performed at: 2007-7-26 14:20:54
Date: 26.7.2007  Time: 14:21:33
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?3.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?4.exe - a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?5.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?6.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?7.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?8.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?9.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?10.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?11.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?12.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?13.exe - probably a variant of Win32/PSW.QQPass.VD trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?14.exe - a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?15.exe - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?16.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?17.exe - a variant of Win32/PSW.Legendmir.NEP trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?18.exe - a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?19.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?down.exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\Kevin\Desktop\病毒样本\样本.rar ?RAR ?1.exe - Win32/TrojanDropper.Rime.Gen trojan
Number of scanned files: 21
Number of threats found: 19
Number of active threats: 1
Time of completion: 14:21:44 Total scanning time: 11 sec (00:00:11)
Notes:
[7] File is probably infected with an unknown virus.

[ 本帖最后由 Kav6.0 于 2007-7-26 14:23 编辑 ]

moonsilver

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.Win32.Agent.iog   
病毒： Trojan.PSW.Win32.QQPass.qnw
病毒： Trojan.PSW.Win32.OnlineGames.dow
病毒： Trojan.PSW.Win32.OnlineGames.dqa
病毒： Trojan.PSW.Win32.QQHX.l  
病毒： Trojan.Mnless.lpi        

用户来源：互联网

软件版本：19.33.30

卡江东N

卡巴4个,费尔10个,NOD32 15个,全是启发.

The EQs

LZ的签名是个X。。。

The EQs

原帖由 卡江东N 于 2007-7-26 14:17 发表
卡巴4个,费尔10个,NOD32 15个,全是启发.

Scan performed at: 2007-7-26 14:19:50
Scanning Log
NOD32 version 2421 (20070725) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.rar
Operating memory - is OK
Date: 26.7.2007  Time: 14:19:59
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.rar
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?3.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?4.exe - a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?5.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?6.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?7.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?8.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?9.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?10.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?11.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?12.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?13.exe - probably a variant of Win32/PSW.QQPass.VD trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?14.exe - a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?15.exe - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?16.exe - Win32/TrojanDropper.Rime.Gen trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?17.exe - a variant of Win32/PSW.Legendmir.NEP trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?18.exe - a variant of Win32/PSW.OnLineGames.NDA trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?19.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?down.exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?1.exe - Win32/TrojanDropper.Rime.Gen trojan
Number of scanned files: 21
Number of threats found: 19
Number of files cleaned: 1
Time of completion: 14:20:03 Total scanning time: 4 sec (00:00:04)
Notes:
[7] File is probably infected with an unknown virus.

微点卫士

金山报17个

微点:
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\3.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\5.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\7.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\9.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\10.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\12.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\13.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\16.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.guk

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\18.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Backdoor.Win32.Delf.bkj

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\19.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\DOWN.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\4.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\XYFPRI.DLL
2) C:\DELETEFILEDOS.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\4.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\XYFPRI.DLL
2) C:\DELETEFILEDOS.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\6.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\TIMHOST.EXE
2) C:\WINDOWS.0\SYSTEM32\TIMHOST.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\8.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\QJSO.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\QJSO0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\11.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\DRIVERS\USBINTE.SYS
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\14.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\DHBPRI.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\15.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\WINDHCP.OCX
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\WINDOWS.0\SYSTEM32\WINDHCP.OCX
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\17.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\1.EXE
是否删除木马程序及其衍生物?

2.EXE一运行就退出