再来继续发样本

显示全部楼层 · 发表于 2007-9-13 16:57:04

扫扫看

显示全部楼层 · 发表于 2007-9-13 17:04:04

Scan performed at: 2007-9-13 17:02:49
Scanning Log
NOD32 version 2527 (20070913) NT
Command line: C:\Documents and Settings\Don johnson\桌面\V1
Operating memory - is OK

Date: 13.9.2007 Time: 17:02:52
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\V1\
C:\Documents and Settings\Don johnson\桌面\V1\1659.exe ?NSIS ?acpidisk.sys - a variant of Win32/Adware.Cinmus application - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\V1\DiskMan32.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\V1\LYLOADER.EXE - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Don johnson\桌面\V1\ravmsmon.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\V1\TempA.exe ?NSIS ?1659.exe ?NSIS ?acpidisk.sys - a variant of Win32/Adware.Cinmus application - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\V1\TempD.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\V1\TempE.exe - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Don johnson\桌面\V1\TempF.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\V1\TempG.exe - probably a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\V1\upxdnd.exe - probably a variant of Win32/PSW.OnLineGames.YA trojan
Number of scanned files: 28
Number of threats found: 10
Number of files cleaned: 10
Time of completion: 17:02:54 Total scanning time: 2 sec (00:00:02)

显示全部楼层 · 发表于 2007-9-13 17:09:44

Start of the scan: 2007年9月13日  17:08

Starting the file scan:

Begin scan in 'E:\病毒\V1[1].part2'
E:\病毒\V1[1].part2\AIS_2308_0.EXE
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Boran.AS
   [WARNING] The file was ignored!
E:\病毒\V1[1].part2\DiskMan32.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [WARNING] The file was ignored!
E:\病毒\V1[1].part2\LYLOADER.EXE
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [WARNING] The file was ignored!
E:\病毒\V1[1].part2\ravmsmon.exe
   [DETECTION] Is the Trojan horse TR/Hijack.Exp.S.3.B
   [WARNING] The file was ignored!
E:\病毒\V1[1].part2\TempB.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [WARNING] The file was ignored!
E:\病毒\V1[1].part2\TempC.exe
   [DETECTION] Contains detection pattern of the dropper DR/Boran.AS
   [WARNING] The file was ignored!
E:\病毒\V1[1].part2\TempD.exe
   [DETECTION] Is the Trojan horse TR/Hijack.Exp.S.3.B
   [WARNING] The file was ignored!
E:\病毒\V1[1].part2\TempE.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [WARNING] The file was ignored!
E:\病毒\V1[1].part2\TempF.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [WARNING] The file was ignored!
E:\病毒\V1[1].part2\TempG.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ckp.2
   [WARNING] The file was ignored!
E:\病毒\V1[1].part2\upxdnd.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ckp.2
   [WARNING] The file was ignored!

End of the scan: 2007年9月13日  17:08
Used time: 00:10 min

The scan has been done completely.

   1 Scanning directories
   13 Files were scanned
   10 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   0 Archives were scanned
   11 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-9-13 17:46:01

F:\V1[1].rar >>RAR >>V1[1]\TempE.exe - Win32/PSW.Agent.NEC 木马的变种
F:\V1[1].rar >>RAR >>V1[1]\TempF.exe - Win32/PSW.OnLineGames.YA 木马的变种
F:\V1[1].rar >>RAR >>V1[1]\TempG.exe - 可能是 Win32/PSW.OnLineGames.YA 木马的一个变种
F:\V1[1].rar >>RAR >>V1[1]\upxdnd.exe - 可能是 Win32/PSW.OnLineGames.YA 木马的一个变种
F:\V1[1].rar >>RAR >>V1[1]\1659.exe >>NSIS >>acpidisk.sys - Win32/Adware.Cinmus 应用程序的变种
F:\V1[1].rar >>RAR >>V1[1]\DiskMan32.exe - Win32/PSW.OnLineGames.YA 木马的变种
F:\V1[1].rar >>RAR >>V1[1]\LYLOADER.EXE - Win32/PSW.Agent.NEC 木马的变种
F:\V1[1].rar >>RAR >>V1[1]\ravmsmon.exe - 可能是 Win32/PSW.OnLineGames.NEP 木马的一个变种
F:\V1[1].rar >>RAR >>V1[1]\TempA.exe >>NSIS >>1659.exe >>NSIS >>acpidisk.sys - Win32/Adware.Cinmus 应用程序的变种
F:\V1[1].rar >>RAR >>V1[1]\TempD.exe - 可能是 Win32/PSW.OnLineGames.NEP 木马的一个变种

显示全部楼层 · 发表于 2007-9-13 17:50:09

已删除：广告程序 not-a-virus:AdWare.Win32.Boran.as 文件　: D:\病毒库\V1[2]\AIS_2308_0.EXE
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.cpk 文件　: D:\病毒库\V1[2]\DiskMan32.exe//PE_Patch.UPX//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.cny 文件　: D:\病毒库\V1[2]\LYLOADER.EXE//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.clj 文件　: D:\病毒库\V1[2]\ravmsmon.exe
已删除：广告程序 not-a-virus:AdWare.Win32.Boran.as 文件　: D:\病毒库\V1[2]\TempC.exe//stream//data0001
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.clj 文件　: D:\病毒库\V1[2]\TempD.exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.cny 文件　: D:\病毒库\V1[2]\TempE.exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.cpk 文件　: D:\病毒库\V1[2]\TempF.exe//PE_Patch.UPX//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.cps 文件　: D:\病毒库\V1[2]\TempG.exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.cps 文件　: D:\病毒库\V1[2]\upxdnd.exe

显示全部楼层 · 发表于 2007-9-13 17:53:34

显示全部楼层 · 发表于 2007-9-13 18:04:58

----------
[凝逸反毒] (http://hi.baidu.com/503165656)

[凝逸.扫描病毒引擎-日志] 2007.9.13 18:4:20

文件:F:\070914\V1[1]\TempF.exe | 感染:BINARYRES [53>20070911_ny0016.axx]3(1.1)
操作:删除文件
文件:F:\070914\V1[1]\AIS_2308_0.EXE | 感染:virus [891>20070906_ny0013.axx]3(1.1)
操作:删除文件
文件:F:\070914\V1[1]\DiskMan32.exe | 感染:BINARYRES [53>20070911_ny0016.axx]3(1.1)
操作:删除文件
文件:F:\070914\V1[1]\TempA.exe | 感染:virus [309>20070824_ny0011.axx]3(21.21)
操作:清除病毒

扫描完成|病毒:4 文件:13|耗时:6029
----------

----------

显示全部楼层 · 发表于 2007-9-13 18:16:43

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 4729
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\TempE.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\TempF.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\TempG.exe - Suspicious of Trojan-PSW.OnLineGames.1
C:\Documents and Settings\uhthn\Desktop\New Folder\upxdnd.exe - Suspicious of Trojan-PSW.OnLineGames.1
C:\Documents and Settings\uhthn\Desktop\New Folder\1659.exe - OK
C:\Documents and Settings\uhthn\Desktop\New Folder\AIS_2308_0.EXE - OK
C:\Documents and Settings\uhthn\Desktop\New Folder\DiskMan32.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\LYLOADER.EXE - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\ravmsmon.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\TempA.exe - Suspicious of Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\TempB.exe - Suspicious of Trojan-Downloader.Small.2
C:\Documents and Settings\uhthn\Desktop\New Folder\TempC.exe - Suspicious of Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\TempD.exe - Suspicious of Trojan-PSW.OnLineGames.2

13 Files scanned
0 Infected files found
11 Suspicious files found
0 Files cured
0 Files deleted

显示全部楼层 · 发表于 2007-9-13 19:50:53

微点：
木马名称:Trojan-PSW.Win32.OnLineGames.kqf

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\V1[1]\TEMPF.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.kqf

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\V1[1]\DISKMAN32.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.koq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\V1[1]\RAVMSMON.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.koq

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\V1[1]\TEMPD.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\WINDOWS.0\SYSTEM32\DRIVERS\ACPIDISK.SYS
是否删除RootKit程序?
程序:
C:\WINDOWS.0\SYSTEM32\WINLIB .DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\V1[1]\AIS_2308_0.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\OLNW\YVXG.DLL
2) C:\PROGRAM FILES\OLNW\BYAJ.DLL
3) C:\PROGRAM FILES\OLNW\DACL.DLL
4) C:\PROGRAM FILES\OLNW\GDFO.DLL
5) C:\PROGRAM FILES\OLNW\URTC.DLL
6) C:\~DED.TMP
是否删除木马程序及其衍生物?
木马名称:Trojan-PSW.Win32.OnLineGames.kqw

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYMANGR.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\V1[1]\LYLOADER.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\LYLOADER.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYMANGR.DLL
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MSDEG32.DLL
4) C:\WINDOWS.0\SYSTEM32\MSDEG32.DLL
5) C:\WINDOWS.0\SYSTEM32\LYLOADER.EXE
是否删除木马程序及其衍生物?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\V1[1]\TEMPB.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1603
远端地址:58.211.7.36(江苏·苏州)
远端端口:80
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\V1[1]\TEMPB.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMPAQ
2) C:\WINDOWS.0\SYSTEM32\DRIVERS\4QEG7KBE.SYS
是否删除木马程序及其衍生物?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\INSSHELL.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYLOADER.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\V1[1]\TEMPG.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\UPXDND.EXE
2) C:\WINDOWS.0\SYSTEM32\UPXDND.DLL
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\V1[1]\UPXDND.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

都能拦截

显示全部楼层 · 发表于 2007-9-13 22:31:03

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.

[病毒样本] 再来继续发样本

本帖子中包含更多资源

10

本帖子中包含更多资源