在疑难解答区挖来的

显示全部楼层 · 发表于 2007-9-8 13:10:33

[MD5: CC7FCA 0C8596 1DC07F 5B9830 EAB99C 0C4D2F E6EA3F 720926 272974 43C0E8 B99ADC 991628 EA1275 84EDB8 348887 B4F320 472C0E 16D64F 11B4BE]

显示全部楼层 · 发表于 2007-9-8 13:13:20

扫描报告
2007年9月8日 13:13:28 - 13:13:31
计算机名称: 2FF87FC2B9AB46F
扫描类型: 扫描目标
目标: F:\v\样本1.rar

--------------------------------------------------------------------------------

结果: 找到 16 恶意软件
Trojan-PSW.Win32.OnLineGames.bms (病毒)
F:\v\样本1.rar\1.exe
Trojan-Spy.Win32.Delf.ach (病毒)
F:\v\样本1.rar\10.exe
Trojan-PSW.Win32.OnLineGames.blx (病毒)
F:\v\样本1.rar\11.exe
Trojan-PSW.Win32.OnLineGames.bmj (病毒)
F:\v\样本1.rar\13.exe
Trojan-PSW.Win32.OnLineGames.box (病毒)
F:\v\样本1.rar\12.exe
Trojan-Dropper.Win32.Agent.aqq (病毒)
F:\v\样本1.rar\16.exe
Trojan-Spy.Win32.Delf.abi (病毒)
F:\v\样本1.rar\18.exe
Trojan-PSW.Win32.OnLineGames.bwr (病毒)
F:\v\样本1.rar\17.exe
Trojan-PSW.Win32.OnLineGames.bou (病毒)
F:\v\样本1.rar\15.exe
Trojan-PSW.Win32.Agent.pl (病毒)
F:\v\样本1.rar\14.exe
Trojan-Downloader.Win32.Agent.csr (病毒)
F:\v\样本1.rar\6.exe
Trojan-PSW.Win32.OnLineGames.bgr (病毒)
F:\v\样本1.rar\7.exe
Trojan-PSW.Win32.OnLineGames.blb (病毒)
F:\v\样本1.rar\2.exe
Trojan-PSW.Win32.OnLineGames.bnx (病毒)
F:\v\样本1.rar\4.exe
Trojan-Downloader.Win32.Small.czl (病毒)
F:\v\样本1.rar\19.exe
Trojan-Downloader.Win32.Injecter.f (病毒)
F:\v\样本1.rar\xxx.exe

--------------------------------------------------------------------------------

统计信息
已扫描:
文件: 20
未扫描: 0
结果:
病毒: 16
间谍软件: 0
可疑项目: 0
危险软件: 0
操作:
已杀毒: 0
已重命名: 0
删除: 0
已隔离: 0
失败: 0
启动扇区:
已扫描: 0
受感染: 0
可疑项目: 0
已杀毒: 0

--------------------------------------------------------------------------------

选项
定义版本:
病毒: 2007-09-07_08
间谍软件: 2007-09-07_07
扫描引擎:
F-Secure AVP: 7.00.171, 2007-09-07
F-Secure Libra: 2.04.01, 2007-09-07
F-Secure Orion: 1.02.37, 2007-09-07
F-Secure Draco: 1.00.35, 2007-09-03
扫描选项:
扫描所有文件
扫描内部存档
操作:
病毒: 扫描后询问
间谍软件: 扫描后询问

显示全部楼层 · 发表于 2007-9-8 13:14:20

C:\ABC\样本1\1.exe - 特征码 'Generic.PWS.Games.3' 被发现
C:\ABC\样本1\10.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本1\11.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本1\12.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本1\13.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本1\14.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本1\15.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本1\16.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本1\17.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.wp' 被发现
C:\ABC\样本1\18.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本1\19.exe - 特征码 'Virus.Win32.Crypt.VA' 被发现
C:\ABC\样本1\2.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本1\4.exe - 特征码 'Generic.PWS.Games.1' 被发现
C:\ABC\样本1\6.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.wp' 被发现
C:\ABC\样本1\7.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.wp' 被发现
C:\ABC\样本1\8.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\样本1\9.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本1\system22.exe - 特征码 'Worm.Win32.Viking.lj' 被发现
C:\ABC\样本1\xxx.exe - 特征码 'Trojan-PWS.Win32.QQPass.pb' 被发现

显示全部楼层 · 发表于 2007-9-8 13:18:03

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本1.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本1.rar
[0] Archive type: RAR
--> 1.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 10.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.acb
      [WARNING] Infected files in archives cannot be repaired!
--> 11.exe
      [DETECTION] Is the Trojan horse TR/Agent.12767
      [WARNING] Infected files in archives cannot be repaired!
--> 13.exe
      [DETECTION] Is the Trojan horse TR/Agent.12580
      [WARNING] Infected files in archives cannot be repaired!
--> 12.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.26778.A
      [WARNING] Infected files in archives cannot be repaired!
--> 16.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.alh.37 Backdoor server programs
      [WARNING] Infected files in archives cannot be repaired!
--> 18.exe
      [DETECTION] Is the Trojan horse TR/Agent.12366
      [WARNING] Infected files in archives cannot be repaired!
--> 17.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 15.exe
      [DETECTION] Is the Trojan horse TR/Agent.11800
      [WARNING] Infected files in archives cannot be repaired!
--> 14.exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.PL
      [WARNING] Infected files in archives cannot be repaired!
--> 6.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 7.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLine.bds.1
      [WARNING] Infected files in archives cannot be repaired!
--> 8.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 9.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> 2.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.blb
      [WARNING] Infected files in archives cannot be repaired!
--> 4.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.bnx.2
      [WARNING] Infected files in archives cannot be repaired!
--> 19.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> xxx.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Injecter.F
      [WARNING] Infected files in archives cannot be repaired!
--> system22.exe
      [DETECTION] Contains detection pattern of the worm WORM/Viking.DLL.2
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

End of the scan: 2007年9月7日  22:17
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   20 Files were scanned
   18 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   20 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-9-8 13:18:56

SYSTEM32.exe微点无视

，楼上的签名

显示全部楼层 · 发表于 2007-9-8 13:20:54

不会巴
那个是viking

那么明显的动作

显示全部楼层 · 发表于 2007-9-8 13:21:55

显示全部楼层 · 发表于 2007-9-8 13:22:27

结果: 找到 16 恶意软件
Trojan-PSW.Win32.OnLineGames.bms (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\1.exe
Trojan-Spy.Win32.Delf.ach (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\10.exe
Trojan-PSW.Win32.OnLineGames.blx (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\11.exe
Trojan-PSW.Win32.OnLineGames.bmj (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\13.exe
Trojan-PSW.Win32.OnLineGames.box (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\12.exe
Trojan-Dropper.Win32.Agent.aqq (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\16.exe
Trojan-Spy.Win32.Delf.abi (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\18.exe
Trojan-PSW.Win32.OnLineGames.bwr (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\17.exe
Trojan-PSW.Win32.OnLineGames.bou (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\15.exe
Trojan-PSW.Win32.Agent.pl (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\14.exe
Trojan-Downloader.Win32.Agent.csr (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\6.exe
Trojan-PSW.Win32.OnLineGames.bgr (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\7.exe
Trojan-PSW.Win32.OnLineGames.blb (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\2.exe
Trojan-PSW.Win32.OnLineGames.bnx (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\4.exe
Trojan-Downloader.Win32.Small.czl (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\19.exe
Trojan-Downloader.Win32.Injecter.f (病毒)
C:\Documents and Settings\ssy\桌面\1.rar\xxx.exe

显示全部楼层 · 发表于 2007-9-8 13:29:59

全杀

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 3.6.2
HC0.rlb = 2.7.0
HC2.rlb = 2.3.8
FN0.rlb = 2.3.0
[扫描] [Level 2] 在 C:\Documents and Settings\new\桌面\VS\样本1\1.exe 检测到 Generic.Upack -> Dwing
[扫描] [Level 2] 在 C:\Documents and Settings\new\桌面\VS\样本1\10.exe 检测到 Generic.Upack -> Dwing
[扫描] [Level 2] 在 C:\Documents and Settings\new\桌面\VS\样本1\11.exe 检测到 Generic.Upack -> Dwing
[扫描] [Level 2] 在 C:\Documents and Settings\new\桌面\VS\样本1\13.exe 检测到 Generic.Upack -> Dwing
[扫描] [Level 2] 在 C:\Documents and Settings\new\桌面\VS\样本1\12.exe 检测到 Generic.Upack -> Dwing
[扫描] [Level 1] 在 C:\Documents and Settings\new\桌面\VS\样本1\16.exe 检测到
[扫描] [Level 2] 在 C:\Documents and Settings\new\桌面\VS\样本1\18.exe 检测到 Trojan.Delf.uv
[扫描] [Level 2] 在 C:\Documents and Settings\new\桌面\VS\样本1\17.exe 检测到 Trojan.Generic
[扫描] [Level 2] 在 C:\Documents and Settings\new\桌面\VS\样本1\15.exe 检测到 Generic.Upack -> Dwing
[扫描] [Level 2] 在 C:\Documents and Settings\new\桌面\VS\样本1\14.exe 检测到 Generic.Upack -> Dwing
[扫描] [Level 1] 在 C:\Documents and Settings\new\桌面\VS\样本1\6.exe 检测到
[扫描] [Level 2] 在 C:\Documents and Settings\new\桌面\VS\样本1\7.exe 检测到 Trojan.Generic
[扫描] [Level 2] 在 C:\Documents and Settings\new\桌面\VS\样本1\8.exe 检测到 Win32.Unknown.b.1
[扫描] [Level 1] 在 C:\Documents and Settings\new\桌面\VS\样本1\9.exe 检测到
[扫描] [Level 1] 在 C:\Documents and Settings\new\桌面\VS\样本1\2.exe 检测到
[扫描] [捆绑检测] 在 C:\Documents and Settings\new\桌面\VS\样本1\4.exe 检测到 Binder.Generic
[扫描] [Level 2] 在 C:\Documents and Settings\new\桌面\VS\样本1\19.exe 检测到 Backdoor.Generic
[扫描] [Level 2] 在 C:\Documents and Settings\new\桌面\VS\样本1\xxx.exe 检测到 Win32.AutorunU
[扫描] [捆绑检测] 在 C:\Documents and Settings\new\桌面\VS\样本1\system22.exe 检测到 Binder.Generic
任务扫描完成。共耗费的时间：0-00-00 00:00:00:0203，共扫描的文件数量：19，共扫描到的威胁数量：19，威胁率：1

显示全部楼层 · 发表于 2007-9-8 13:32:33

楼上不会脱upack？

[病毒样本] 在疑难解答区挖来的

本帖子中包含更多资源

回复 5楼微点卫士的帖子

本帖子中包含更多资源

回复 9楼 gankeyu 的帖子

[病毒样本] 在疑难解答区挖来的

本帖子中包含更多资源

回复 5楼 微点卫士 的帖子

本帖子中包含更多资源

回复 9楼 gankeyu 的帖子

回复 5楼微点卫士的帖子