一包22个（MD5内详）

wulm

[MD5: CF1FEB C3F57F 6A351D C46834 5EF432 68A021 9D18C6 149354 728A61 6D1762 F3671A CEB6DE BD37F3 8F01DB E076CF 8BB7A6 2C82D5 69DAFF 7B6FEA]

不知道怎么少了几个

[ 本帖最后由 wulm 于 2007-9-10 12:34 编辑 ]

风野胤

总文件数19.。。。。。。

欠妳緈諨

[ 本帖最后由 欠你幸福 于 2007-9-10 12:33 编辑 ]

欠妳緈諨

Win32/Genetik trojan无敌了
自从有了这个Win32/Genetik trojan，NOD32在样本区的侦测率飙升

wangjay1980

detected: Trojan program Trojan-Spy.Win32.Delf.agy        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/rsmyasp.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bos        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/EA.tmp.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.Delf.aat        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/WinFormA9.exe//UPack
detected: Trojan program Trojan-PSW.Win32.Delf.aay        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/a.exe//UPX
detected: Trojan program Trojan-Dropper.Win32.Agent.btv        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/LYLOADMR.EXE//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.Delf.zn        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/avzxast.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bou        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/kaqhcaz.exe//UPack
detected: Trojan program Trojan-Spy.Win32.Delf.agp        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/rarjatl.exe//UPack
detected: Trojan program Trojan-Spy.Win32.Delf.agz        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/kvdxbis.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bow        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/raqjatl.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.cfu        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/LYLOADER.EXE//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.Delf.zm        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/kvmxbis.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bmj        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/rsjzasp.exe//UPack

平淡

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本.rar
    [0] Archive type: RAR
    --> rsmyasp.exe
        [DETECTION] Is the Trojan horse TR/Spy.Delf.agy
        [WARNING]   Infected files in archives cannot be repaired!
    --> EA.tmp.exe
        [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> WinFormA9.exe
        [DETECTION] Is the Trojan horse TR/PSW.Delf.aat
        [WARNING]   Infected files in archives cannot be repaired!
    --> a.exe
        [DETECTION] Is the Trojan horse TR/PSW.Delf.QC.69
        [WARNING]   Infected files in archives cannot be repaired!
    --> LYLOADMR.EXE
        [DETECTION] Is the Trojan horse TR/PSW.OnLine.agb.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> avzxast.exe
        [DETECTION] Is the Trojan horse TR/Agent.13023
        [WARNING]   Infected files in archives cannot be repaired!
    --> kaqhcaz.exe
        [DETECTION] Is the Trojan horse TR/Agent.11800
        [WARNING]   Infected files in archives cannot be repaired!
    --> rarjatl.exe
        [DETECTION] Is the Trojan horse TR/Agent.12484
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvdxbis.exe
        [DETECTION] Is the Trojan horse TR/Spy.Delf.agz
        [WARNING]   Infected files in archives cannot be repaired!
    --> raqjatl.exe
        [DETECTION] Is the Trojan horse TR/Agent.13017
        [WARNING]   Infected files in archives cannot be repaired!
    --> LYLOADER.EXE
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvmxbis.exe
        [DETECTION] Is the Trojan horse TR/Agent.12716
        [WARNING]   Infected files in archives cannot be repaired!
    --> rsjzafg.dll
    --> rsjzasp.exe
        [DETECTION] Is the Trojan horse TR/Agent.12580
        [WARNING]   Infected files in archives cannot be repaired!
    --> kaqhacs.dll
    --> rarjani.dll
    --> kvdxacf.dll
    --> rsmyafg.dll
    --> avzxain.dll
        [WARNING]   The file was ignored!


End of the scan: 2007年9月9日  21:35
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
     20 Files were scanned
     13 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      7 Files not concerned
      1 Archives were scanned
     14 Warnings
      0 Notes

自由

木马名称:Trojan-PSW.Win32.OnLineGames.khj

程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\EA.TMP.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.Delf.eyy

程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\WINFORMA9.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.Delf.fal

程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\A.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.Agent.eri

程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\LYLOADMR.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.Delf.eyz

程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\AVZXAST.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\RSMYASP.EXE
1) C:\DFD10517437.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\RSMYASP.EXE
可疑程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\RSMYAPM.DLL
2) C:\DFD10517437.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\RSJZASP.EXE
1) C:\DFD10541515.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\RSJZASP.EXE
1) C:\DFD10541515.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\KVDXBIS.EXE
1) C:\DFD10566109.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\KVDXBIS.EXE
1) C:\DFD10566109.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\RARJATL.EXE
1) C:\DFD10590031.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\RARJATL.EXE
1) C:\DFD10590031.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\KAQHCAZ.EXE
1) C:\DFD10612359.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\KAQHCAZ.EXE
1) C:\DFD10612359.BAT
是否删除可疑程序?
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\LYLOADER.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\LYLOADER.EXE
2) C:\DOCUMENTS AND SETTINGS\WINGCHEN\LOCAL SETTINGS\TEMP\LYMANGR.DLL
3) C:\WINDOWS\SYSTEM32\LYMANGR.DLL
4) C:\DOCUMENTS AND SETTINGS\WINGCHEN\LOCAL SETTINGS\TEMP\MSDEG32.DLL
5) C:\WINDOWS\SYSTEM32\MSDEG32.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\KVMXBIS.EXE
1) C:\DFD10692265.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\WINGCHEN\桌面\样本\KVMXBIS.EXE
1) C:\DFD10692265.BAT
是否删除可疑程序?
这些交给微点测

ykz1991

OSS真是无敌

欠妳緈諨

都是报壳，厉害