8个马,md5内见

风野胤

这样上报了就不只是加一个特征码
上报才有效果

IllusionWing

UGuard v3.6.0
HC0.rlb = 2.6.0
HC2.rlb = 2.3.7
FN0.rlb = 2.3.0

[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\病毒测试\Downloads.rar>>01.exe 检测到 Win32.Unknown.b.1
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\病毒测试\Downloads.rar>>02.exe 检测到 Win32.Unknown.b.1
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\病毒测试\Downloads.rar>>03.exe 检测到 Win32.Unknown.b.1
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\病毒测试\Downloads.rar>>04.exe 检测到 Win32.Unknown.b.1
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\病毒测试\Downloads.rar>>05.exe 检测到 Win32.Unknown.b.1
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\病毒测试\Downloads.rar>>06.exe 检测到 Trojan.OnLineGames.nn.b
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\病毒测试\Downloads.rar>>07.exe 检测到 Win32.Unknown.b.1
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\病毒测试\Downloads.rar>>08.exe 检测到 Win32.Unknown.b.1
任务 扫描 完成。共耗费的时间：0-00-00 00:00:00:0380，共扫描的文件数量：9，共扫描到的威胁数量：8，威胁率：0.88888889

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 1452
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\08.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\02.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\03.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\04.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\05.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\06.exe - Suspicious of Win32.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\07.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\01.exe - Suspicious of Trojan-PSW.OnLineGames.2

8 Files scanned
0 Infected files found
8 Suspicious files found
0 Files cured
0 Files deleted

碧水寒潭

Start of the scan: 2007年9月2日  12:14

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\Downloads.rar
  [0] Archive type: RAR
  --> 08.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 02.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 03.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 04.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 05.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 06.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> 07.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 01.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!


End of the scan: 2007年9月2日  12:14
Used time: 00:13 min

The scan has been done completely.

      1 Scanning directories
      9 Files were scanned
      8 viruses and/or unwanted programs were found
      7 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     -6 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

promised

C:\ABC\Downloads.rar:\08.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\Downloads.rar:\02.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\Downloads.rar:\03.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\Downloads.rar:\04.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\Downloads.rar:\05.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\Downloads.rar:\06.exe - 特征码 'Trojan-Proxy.Win32.Delf.AN' 被发现
C:\ABC\Downloads.rar:\07.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\Downloads.rar:\01.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现

458506

免杀对偶的TRUSTPORT用处不大，

你能同时过了BD+DRWEB+AVG+NORMAN　吗

PS。偶还有一个卡巴。。不监控。。

The EQs

只要一个themida。。。你的组合就全挂

微点卫士

微点：
木马名称:Trojan-PSW.Win32.OnLineGames.jss

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\03.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\02.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVGJMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVGJMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\01.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVWDMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVWDMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\08.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVZTMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVZTMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\04.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVQJMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVQJMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\05.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\MSSQL.DLL
2) C:\WINDOWS.0\SYSTEM32\MSSOCK.SYS
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\06.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSWIN64.JMP
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\WINSYS64.SYS
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\07.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVDHMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVDHMON.DAT
是否删除木马程序及其衍生物?

微笑的前奏

原帖由 浪滔天 于 2007-9-2 08:48 发表
已隔离: 病毒 Heur.Trojan.Generic (变种)        文件: J:\Downloads.rar/08.exe//PE_Patch//UPack
已隔离: 病毒 Heur.Trojan.Generic (变种)        文件: J:\Downloads.rar/02.exe//PE_Patch//UPack
已隔离: 病毒 Heur.Trojan ...

detected: Trojan program Trojan-Downloader.Win32.Small.fjm File: C:\Downloads.rar/08.exe//PE_Patch//UPack
detected: Trojan program Trojan-Downloader.Win32.Small.fjk File: C:\Downloads.rar/02.exe//PE_Patch//UPack
detected: Trojan program Trojan-Downloader.Win32.Agent.csd File: C:\Downloads.rar/03.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bko File: C:\Downloads.rar/04.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.Agent.pc File: C:\Downloads.rar/05.exe//PE_Patch//UPack
detected: Trojan program Backdoor.Win32.WinterLove.bi File: C:\Downloads.rar/06.exe//UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bkq File: C:\Downloads.rar/07.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bkr File: C:\Downloads.rar/01.exe//PE_Patch//UPack
我的卡巴全报了呀，更新不会这么快吧？

IllusionWing

原帖由 EQ2 于 2007-9-2 12:32 发表
只要一个themida。。。你的组合就全挂

某些报壳王直接把Themida报Malware....再说了,即便themida是vm执行,最终还是要映射到系统函数上