两个下载者和一堆产物

zane_xzz

[MD5: E47559 9819C8 7E656F DF3886 26859E A8EAB5 092E87 40808A D55A9A 4A02AC 0B50D5 1EA204 285FDD 2EB7FC A897B3 CC38E5 68E844 E31EF5 646412 10F0B4 7AFED5 1E3096 F79EFE 49D55C FE51DD 1E2917 05AD3F E37436 491D1C 0B9BFC]

xxwpk007

26个
已检测到: 木马程序 Trojan-Spy.Win32.Delf.wa        文件: G:\样本\样本\样本[1]\1.exe//UPack
已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.bs        文件: G:\样本\样本\样本[1]\11.exe
已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.qo        文件: G:\样本\样本\样本[1]\12.exe
已检测到: 病毒 Virus.Win32.AutoRun.fl        文件: G:\样本\样本\样本[1]\14.exe//PE_Patch//NSPack
已检测到: 木马程序 Trojan-PSW.Win32.Nilage.bjp        文件: G:\样本\样本\样本[1]\2.exe
已检测到: 木马程序 Backdoor.Win32.Agent.alh        文件: G:\样本\样本\样本[1]\20.exe//UPack
已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.zb        文件: G:\样本\样本\样本[1]\3.exe
已检测到: 木马程序 Trojan-Spy.Win32.Delf.uv        文件: G:\样本\样本\样本[1]\4.exe//UPack
已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.abv        文件: G:\样本\样本\样本[1]\5.exe
已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.bs        文件: G:\样本\样本\样本[1]\6.exe
已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.qo        文件: G:\样本\样本\样本[1]\7.exe
已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.bs        文件: G:\样本\样本\样本[1]\8.exe
已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.abx        文件: G:\样本\样本\样本[1]\9.exe
已检测到: 木马程序 Trojan-Downloader.Win32.Delf.bhd        文件: G:\样本\样本\样本[1]\down.exe
已检测到: 木马程序 Trojan-Downloader.Win32.Delf.bnc        文件: G:\样本\样本\样本[1]\qq.exe//UPack
已检测到: 木马程序 Backdoor.Win32.Delf.awy        文件: G:\样本\样本\样本[1]\WindowsXP-KB138309-x86-CHS.exe
已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.abr        文件: G:\样本\样本\样本[1]\WindowsXP-KB238104-x86-CHS.exe//PE_Patch.UPX//UPX
已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.yr        文件: G:\样本\样本\样本[1]\WindowsXP-KB284302-x86-CHS.exe
已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.acf        文件: G:\样本\样本\样本[1]\WindowsXP-KB284303-x86-CHS.exe//PE_Patch.UPX//UPX
已检测到: 木马程序 Trojan-Spy.Win32.Delf.uv        文件: G:\样本\样本\样本[1]\WindowsXP-KB328207-x86-CHS.exe//UPack
已检测到: 病毒 Worm.Win32.Mefir.k        文件: G:\样本\样本\样本[1]\WindowsXP-KB383300-x86-CHS.exe
已检测到: 木马程序 Trojan.Win32.LipGame.cd        文件: G:\样本\样本\样本[1]\WindowsXP-KB398305-x86-CHS.exe//PE_Patch.UPX//UPX
已检测到: 木马程序 Trojan-Downloader.Win32.Small.exh        文件: G:\样本\样本\样本[1]\WindowsXP-KB423807-x86-CHS.exe//UPack
已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.abr        文件: G:\样本\样本\样本[1]\WindowsXP-KB468603-x86-CHS.exe//PE_Patch.UPX//UPX
已检测到: 病毒 Virus.Win32.AutoRun.en        文件: G:\样本\样本\样本[1]\WindowsXP-KB828301-x86-CHS.exe//UPX
已检测到: 木马程序 Trojan.BAT.Dater.a        文件: G:\样本\样本\样本[1]\WindowsXP-KB838201-x86-CHS.exe

1688388728

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\1.exe - infected with Trojan.PWS.Gamania.3029
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\11.exe - infected with Trojan.PWS.Wsgame
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\12.exe - infected with Trojan.PWS.Wsgame
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\14.exe - infected with Trojan.PWS.Qqpass.1131
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\2.exe - infected with Trojan.PWS.Wsgame
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\20.exe - infected with Trojan.Arpspoof
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\3.exe - infected with Trojan.MulDrop.8000
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\4.exe - infected with Trojan.PWS.Gamania.3030
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\5.exe - infected with Trojan.PWS.Wsgame
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\6.exe - infected with Trojan.PWS.Wsgame
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\7.exe - infected with Trojan.PWS.Wsgame
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\8.exe - infected with Trojan.PWS.Wsgame
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\9.exe - infected with Trojan.PWS.Gamania.2807
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\down.exe - infected with BackDoor.Pigeon.1604
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\qq.exe - infected with Trojan.DownLoader.28711
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\B64X7CKM\样本[1].part1.rar\WindowsXP-KB138308-x86-CHS.exe - infected with Trojan.Inject.251
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\I0GU558Q\样本[1].part2.rar\WindowsXP-KB238104-x86-CHS.exe - infected with Trojan.PWS.Wsgame
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\I0GU558Q\样本[1].part2.rar\WindowsXP-KB284302-x86-CHS.exe - probably infected with MULDROP.Trojan
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\I0GU558Q\样本[1].part2.rar\WindowsXP-KB284303-x86-CHS.exe - infected with Trojan.PWS.Wsgame.1048
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\I0GU558Q\样本[1].part2.rar\WindowsXP-KB383300-x86-CHS.exe - infected with Trojan.Inject.251
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\I0GU558Q\样本[1].part2.rar\WindowsXP-KB398305-x86-CHS.exe - probably infected with BINARYRES
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\I0GU558Q\样本[1].part2.rar\WindowsXP-KB468603-x86-CHS.exe - probably infected with BINARYRES
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\I0GU558Q\样本[1].part2.rar\WindowsXP-KB828301-x86-CHS.exe - infected with BINARYRES
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\I0GU558Q\样本[1].part2.rar\WindowsXP-KB838201-x86-CHS.exe - infected with Trojan.Inject.251
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\I0GU558Q\样本[1].part2.rar\WindowsXP-KB878206-x86-CHS.exe - infected with Trojan.Inject.251

Archive contains 9 infected items

Archive contains 16 infected items

snakebone

Exported events:

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.OnLineGames.BS.259
      [TR/PSW.OnLineGames.BS.259]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\6.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.OnLineGames.QO.21 [TR/PSW.OnLineGames.QO.21]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\7.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.OnLineGames.BS.260
      [TR/PSW.OnLineGames.BS.260]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\8.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'BDS/Agent.alh.32 [BDS/Agent.alh.32]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\20.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/Spy.Delf.UV.28 [TR/Spy.Delf.UV.28]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\WindowsXP-KB328207-x86-CHS.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.12287.1 [TR/PSW.12287.1]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\5.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.Agent.20480 [TR/PSW.Agent.20480]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\WindowsXP-KB284303-x86-CHS.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'BDS/Delf.awy.46 [BDS/Delf.awy.46]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\WindowsXP-KB138309-x86-CHS.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.Agent.20480 [TR/PSW.Agent.20480]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\WindowsXP-KB238104-x86-CHS.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.Agent.20480 [TR/PSW.Agent.20480]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\WindowsXP-KB238104-x86-CHS.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/Dldr.Delf.bnc.5 [TR/Dldr.Delf.bnc.5]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\qq.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.Agent.20480 [TR/PSW.Agent.20480]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\9.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/Dldr.Delf.bhd.3 [TR/Dldr.Delf.bhd.3]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\down.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.Agent.20480 [TR/PSW.Agent.20480]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\WindowsXP-KB284302-x86-CHS.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.Steal.31292 [TR/PSW.Steal.31292]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\14.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/Drop.Age.32873.C [TR/Drop.Age.32873.C]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\WindowsXP-KB828301-x86-CHS.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/Dropper.Small.NCB [TR/Dropper.Small.NCB]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\12.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.OnlineGames.AVG.9 [TR/PSW.OnlineGames.AVG.9]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\11.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'HEUR/Malware [HEUR/Malware]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\WindowsXP-KB983306-x86-CHS.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/Hook.Shell.202 [TR/Hook.Shell.202]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\1.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'BDS/Rizo.A.146 [BDS/Rizo.A.146]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\WindowsXP-KB838201-x86-CHS.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.OnLineGames.YN.146
      [TR/PSW.OnLineGames.YN.146]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\WindowsXP-KB398305-x86-CHS.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/Dldr.Agent.36135 [TR/Dldr.Agent.36135]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\WindowsXP-KB383300-x86-CHS.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/ShellHook.2.B [TR/ShellHook.2.B]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\4.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.OnLineGame.YF [TR/PSW.OnLineGame.YF]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\3.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.Agent.20480 [TR/PSW.Agent.20480]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\WindowsXP-KB468603-x86-CHS.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/Hook.Shell.209 [TR/Hook.Shell.209]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\WindowsXP-KB423807-x86-CHS.exe.
      Action performed: Delete file

2007-7-29 18:38 [Guard] Malware found
      Virus or unwanted program 'TR/PSW.Nilage.bjp.196 [TR/PSW.Nilage.bjp.196]'
      detected in file 'C:\Documents and
      Settings\Administrator\桌面\新建文件夹\jieyashiyan\2.exe.
      Action performed: Delete file

扫描开始时间: 2007-7-29 18:44:22
扫描日志
NOD32 版本 2427 (20070728) NT
命令行: F:\virus\样本1

日期: 2007年7月29日  时间: 18:44:23
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\virus\样本1\
F:\virus\样本1\1.exe<病毒 - Win32/PSW.OnLineGames.NDA 木马 变种>
F:\virus\样本1\11.exe<病毒 - 可能是 Win32/PSW.Agent.NDP 木马 变种>
F:\virus\样本1\12.exe<病毒 - 可能是 Win32/PSW.Agent.NDP 木马 变种>
F:\virus\样本1\14.exe<病毒 - 可能是 Win32/PSW.QQPass.VD 木马 变种>
F:\virus\样本1\2.exe<病毒 - 可能是 Win32/PSW.Agent.NDP 木马 变种>
F:\virus\样本1\20.exe<病毒 - Win32/Agent.NEM 木马>
F:\virus\样本1\3.exe<病毒 - Win32/PSW.OnLineGames.YA 木马 变种>
F:\virus\样本1\4.exe<病毒 - Win32/PSW.OnLineGames.NDA 木马 变种>
F:\virus\样本1\5.exe<病毒 - 可能是 Win32/PSW.Agent.NDP 木马 变种>
F:\virus\样本1\6.exe<病毒 - 可能是 Win32/PSW.Agent.NDP 木马 变种>
F:\virus\样本1\7.exe<病毒 - 可能是 Win32/PSW.Agent.NDP 木马 变种>
F:\virus\样本1\8.exe<病毒 - 可能是 Win32/PSW.Agent.NDP 木马 变种>
F:\virus\样本1\9.exe<病毒 - Win32/PSW.OnLineGames.ABX 木马>
F:\virus\样本1\down.exe<病毒 - Win32/TrojanDownloader.Delf.NSA 木马 变种>
F:\virus\样本1\qq.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
F:\virus\样本1\WindowsXP-KB138308-x86-CHS.exe<病毒 - Win32/TrojanDropper.Rime.Gen 木马>
F:\virus\样本1\WindowsXP-KB138309-x86-CHS.exe<病毒 - Win32/TrojanDropper.Rime.Gen 木马>
F:\virus\样本1\WindowsXP-KB238104-x86-CHS.exe<病毒 - Win32/PSW.OnLineGames.YA 木马 变种>
F:\virus\样本1\WindowsXP-KB284302-x86-CHS.exe<病毒 - 可能是 Win32/PSW.OnLineGames.YA 木马 变种>
F:\virus\样本1\WindowsXP-KB284303-x86-CHS.exe<病毒 - Win32/PSW.OnLineGames.YA 木马 变种>
F:\virus\样本1\WindowsXP-KB328207-x86-CHS.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
F:\virus\样本1\WindowsXP-KB383300-x86-CHS.exe<病毒 - Win32/TrojanDropper.Rime.Gen 木马>
F:\virus\样本1\WindowsXP-KB398305-x86-CHS.exe<病毒 - Win32/PSW.OnLineGames.YA 木马 变种>
F:\virus\样本1\WindowsXP-KB423807-x86-CHS.exe<病毒 - Win32/PSW.OnLineGames.NDA 木马 变种>
F:\virus\样本1\WindowsXP-KB468603-x86-CHS.exe<病毒 - Win32/PSW.OnLineGames.YA 木马 变种>
F:\virus\样本1\WindowsXP-KB828301-x86-CHS.exe<病毒 - 可能是 Win32/PSW.QQPass.VD 木马 变种>
F:\virus\样本1\WindowsXP-KB838201-x86-CHS.exe<病毒 - Win32/TrojanDropper.Rime.Gen 木马>
F:\virus\样本1\WindowsXP-KB878206-x86-CHS.exe<病毒 - Win32/TrojanDropper.Rime.Gen 木马>
F:\virus\样本1\WindowsXP-KB983306-x86-CHS.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
已扫描文件数量: 30
已发现病毒数量: 29
完成时间: 18:44:28 总共扫描时间: 5 秒 (00:00:05)

lsyer

眼熟
这包东西
各个论坛~
至少看到第3遍了

欠妳緈諨

金山24，AVAST23

promised

WindowsXP-KB888303-x86-CHS.exe又是运行显示影子关机时间的
这包东西里面的好像我都已经发过了
http://bbs.kafan.cn/viewthread.php?tid=112027
20个MD5一样的
还有我找找
好像是我老早以前发的

[ 本帖最后由 promised 于 2007-7-29 19:12 编辑 ]

runsisi

其中有一个是死的

gho

detected: Trojan program Trojan-Spy.Win32.Delf.wa        URL: http://bbs.kafan.cn/attachment.php?aid=106532//1.exe//UPack