三个小毒[MD5: 5623B3 93D212 96EBDD]

显示全部楼层 · 发表于 2007-7-31 20:55:15

始终没猜出来fil的这个ernm是什么意思……

显示全部楼层 · 发表于 2007-7-31 21:09:36

其实norman报了的
看看fs报的就知道了

显示全部楼层 · 发表于 2007-7-31 21:20:57

KAV不让我下

显示全部楼层 · 发表于 2007-7-31 21:27:52

virus.rar
  [0] Archive type: RAR
  --> help.exe
   [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> 1630[1].exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> LYLOADER.EXE
   [DETECTION] Is the Trojan horse TR/Spy.Gen

显示全部楼层 · 发表于 2007-7-31 21:32:46

+ -- ArcaVir 2007 -- + version: 1.0.5
+ Bases date:  16:37  30-07-2007

OK c:\malware\viru32123s.rar
OK c:\malware\viru32123s.rar<RAR>:help.exe
OK c:\malware\viru32123s.rar<RAR>:help.exe<UPX>:help.exe
OK c:\malware\viru32123s.rar<RAR>:help.exe<UPX>:help.exe<DLLRES>:DATAINFO0.exe
OK c:\malware\viru32123s.rar<RAR>:1630[1].exe
OK c:\malware\viru32123s.rar<RAR>:1630[1].exe<DLLRES>:LYLOADER.EXE0.exe
OK c:\malware\viru32123s.rar<RAR>:1630[1].exe<DLLRES>:LYLOADER.EXE0.exe<UPack>:LYLOADER.EXE0.exe
OK c:\malware\viru32123s.rar<RAR>:1630[1].exe<DLLRES>:LYLOADER.EXE0.exe<UPack>:LYLOADER.EXE0.exe<DLLRES>:LYMANGR.DLL0.exe
VIR: Variant:Trojan.Psw.Onlinegames.Te c:\malware\viru32123s.rar<RAR>:1630[1].exe<DLLRES>:LYLOADER.EXE0.exe<UPack>:LYLOADER.EXE0.exe<DLLRES>:LYMANGR.DLL0.exe<UPack>:LYMANGR.DLL0.exe
ACTION OK LEAVE
OK c:\malware\viru32123s.rar<RAR>:1630[1].exe<DLLRES>:LYLOADER.EXE0.exe<UPack>:LYLOADER.EXE0.exe<DLLRES>:MSDEG32.DLL1.exe
VIR: Variant:Trojan.Psw.Onlinegames.Te c:\malware\viru32123s.rar<RAR>:1630[1].exe<DLLRES>:LYLOADER.EXE0.exe<UPack>:LYLOADER.EXE0.exe<DLLRES>:MSDEG32.DLL1.exe<UPack>:MSDEG32.DLL1.exe
ACTION OK LEAVE
OK c:\malware\viru32123s.rar<RAR>:LYLOADER.EXE
OK c:\malware\viru32123s.rar<RAR>:LYLOADER.EXE<UPack>:LYLOADER.EXE
OK c:\malware\viru32123s.rar<RAR>:LYLOADER.EXE<UPack>:LYLOADER.EXE<DLLRES>:LYMANGR.DLL0.exe
VIR: Variant:Trojan.Psw.Onlinegames.Te c:\malware\viru32123s.rar<RAR>:LYLOADER.EXE<UPack>:LYLOADER.EXE<DLLRES>:LYMANGR.DLL0.exe<UPack>:LYMANGR.DLL0.exe
ACTION OK LEAVE
OK c:\malware\viru32123s.rar<RAR>:LYLOADER.EXE<UPack>:LYLOADER.EXE<DLLRES>:MSDEG32.DLL1.exe
VIR: Variant:Trojan.Psw.Onlinegames.Te c:\malware\viru32123s.rar<RAR>:LYLOADER.EXE<UPack>:LYLOADER.EXE<DLLRES>:MSDEG32.DLL1.exe<UPack>:MSDEG32.DLL1.exe
ACTION OK LEAVE

Scan summary:

------------------------

Scanned:

Files          :  5
Directories    :  1
Archives       :  5
Files in archives :  16
Embedded files :  7
Embedded objects  :  0
Excluded files :  0
All             :  17

Found:

Infected       :  4
Cured          :  0
Deleted          :  0
Renamed          :  0

Remaining infected : 4

显示全部楼层 · 发表于 2007-7-31 21:54:24

Virus: Win32:Delf-FFN [Trj], Win32:OnLineGames-SR [Trj], Win32:OnLineGames-SS [Trj]

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2007-7-31 22:10:37

费尔扫描,启发报一个

微点:
木马名称:Trojan-PSW.Win32.Delf.eou

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\HELP.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\LYLOADER.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\LYLOADER.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYMANGR.DLL
3) C:\WINDOWS.0\SYSTEM32\LYMANGR.DLL
4) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MSDEG32.DLL
5) C:\WINDOWS.0\SYSTEM32\MSDEG32.DLL
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYLOADER.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-7-31 22:20:40

显示全部楼层 · 发表于 2007-7-31 22:46:24

卡巴新仿真器

deleted: virus Heur.Downloader (modification) File: C:\virus\virus.rar/help.exe
deleted: virus Heur.Invader (modification) File: C:\virus\virus.rar/1630[1].exe
deleted: virus Heur.Invader (modification) File: C:\virus\virus.rar/LYLOADER.EXE
deleted: virus Heur.Invader (modification) File: c:\virus\virus.rar/LYLOADER.EXE//PE_Patch//UPack

[病毒样本] 三个小毒[MD5: 5623B3 93D212 96EBDD]

本帖子中包含更多资源

回复 #8 tracydk 的帖子

回复 #7 tracydk 的帖子

本帖子中包含更多资源