午餐来一包

显示全部楼层 · 发表于 2007-9-20 12:27:28

D:\Documents and Settings\EKINCHENG\桌面\v2.rar » RAR » v2\FADD740C.EXE - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\v2.rar » RAR » v2\gzpntb.exe - a variant of Win32/PSW.OnLineGames.YA trojan
D:\Documents and Settings\EKINCHENG\桌面\v2.rar » RAR » v2\DiskMan32.exe - a variant of Win32/PSW.OnLineGames.YA trojan
D:\Documents and Settings\EKINCHENG\桌面\v2.rar » RAR » v2\avzxbst.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\v2.rar - multiple threats - deleted - quarantined
D:\Documents and Settings\EKINCHENG\桌面\v2.rar » RAR » v2\mppds.dll - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\v2.rar » RAR » v2\LYLOADER.EXE - a variant of Win32/PSW.Agent.NEC trojan
D:\Documents and Settings\EKINCHENG\桌面\v2.rar » RAR » v2\Kvsc3.dll - probably a variant of Win32/Genetik trojan
nod32 7个

显示全部楼层 · 发表于 2007-9-20 12:30:23

Filename Result
rsztafg.dll  CLEAN

The file 'rsztafg.dll' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

Filename Result
wpcap.dll  KNOWN CLEAN

The file 'wpcap.dll' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'WinPcap 3.1'.

Filename Result
WanPacket.dll  KNOWN CLEAN

The file 'WanPacket.dll' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'WinPcap 3.1'.

Filename Result
Packet.dll  KNOWN CLEAN

The file 'Packet.dll' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'WinPcap 3.1'.

Filename Result
npptools.dll  KNOWN CLEAN

显示全部楼层 · 发表于 2007-9-20 13:34:01

v2.rar >>RAR >>v2\avzxbst.exe - 可能是 Win32/Genetik 木马的一个变种
v2.rar >>RAR >>v2\DiskMan32.exe - Win32/PSW.OnLineGames.YA 木马的变种
v2.rar >>RAR >>v2\gzpntb.exe - Win32/PSW.OnLineGames.YA 木马的变种
v2.rar >>RAR >>v2\FADD740C.EXE - 可能是 Win32/Genetik 木马的一个变种
v2.rar >>RAR >>v2\Kvsc3.dll - 可能是 Win32/Genetik 木马的一个变种
v2.rar >>RAR >>v2\LYLOADER.EXE - Win32/PSW.Agent.NEC 木马的变种
v2.rar >>RAR >>v2\mppds.dll - 可能是 Win32/Genetik 木马的一个变种

显示全部楼层 · 发表于 2007-9-20 18:20:12

微点一解压就把全部exe宰了,剩下4个dll

时间处理结果木马名称木马进程名木马文件创建者
2007-09-20 18:20:40 处理成功 Trojan-PSW.Win32.OnLineGames.lzg C:\DOCUMENTS AND SETTINGS\DSL\桌面\新建文件夹\V2\MSDEG32.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-09-20 18:20:38 处理成功 Trojan-PSW.Win32.OnLineGames.lzf C:\DOCUMENTS AND SETTINGS\DSL\桌面\新建文件夹\V2\MPPDS.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-09-20 18:20:36 处理成功 Trojan-PSW.Win32.OnLineGames.lze C:\DOCUMENTS AND SETTINGS\DSL\桌面\新建文件夹\V2\LYMANGR.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-09-20 18:20:34 处理成功 Trojan-PSW.Win32.Agent.adp C:\DOCUMENTS AND SETTINGS\DSL\桌面\新建文件夹\V2\LYLOADER.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-09-20 18:20:32 处理成功 Trojan-PSW.Win32.OnLineGames.lzd C:\DOCUMENTS AND SETTINGS\DSL\桌面\新建文件夹\V2\KVSC3.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-09-20 18:20:30 处理成功 Backdoor.Win32.Agent.crx C:\DOCUMENTS AND SETTINGS\DSL\桌面\新建文件夹\V2\FADD740C.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-09-20 18:20:28 处理成功 Trojan-PSW.Win32.Agent.est C:\DOCUMENTS AND SETTINGS\DSL\桌面\新建文件夹\V2\DISKMAN32.DLL C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-09-20 18:20:26 处理成功 Trojan-PSW.Win32.OnLineGames.lqy C:\DOCUMENTS AND SETTINGS\DSL\桌面\新建文件夹\V2\GZPNTB.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-09-20 18:20:23 处理成功 Trojan-PSW.Win32.OnLineGames.lqy C:\DOCUMENTS AND SETTINGS\DSL\桌面\新建文件夹\V2\DISKMAN32.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-09-20 18:20:21 处理成功 Trojan-PSW.Win32.OnLineGames.lzc C:\DOCUMENTS AND SETTINGS\DSL\桌面\新建文件夹\V2\AVZXBST.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-09-20 18:20:19 处理成功 Trojan.Win32.Agent.hqv C:\DOCUMENTS AND SETTINGS\DSL\桌面\新建文件夹\V2\1.EXE C:\PROGRAM FILES\WINRAR\WINRAR.EXE

显示全部楼层 · 发表于 2007-9-20 18:24:22

費爾還慘~~才2個

显示全部楼层 · 发表于 2007-9-20 18:27:55

费尔开最高启发，4个。。。。我的费尔要努力啊

显示全部楼层 · 发表于 2007-9-20 18:35:22

dr.web 10个
[Scan path] C:\Documents and Settings\Administrator\桌面\v2.rar
>>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\1.exe - Ok
>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\avzxain.dll - Ok
>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\rsztafg.dll - Ok
>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\wpcap.dll - Ok
>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\WanPacket.dll - Ok
>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\Packet.dll - Ok
>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\npptools.dll - Ok
>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\wlgini.dll - Ok
>>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\avzxbst.exe infected with Trojan.PWS.Gamania.4214
>>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\DiskMan32.exe infected with Trojan.PWS.Wsgame.1271
>>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\gzpntb.exe infected with Trojan.PWS.Wsgame.1271
>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\D5828D34.DLL probably infected with DLOADER.Trojan
>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\DiskMan32.dll - Ok
>>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\FADD740C.EXE infected with Trojan.Popwin.origin
>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\Kvsc3.dll infected with Trojan.PWS.Wsgame.1272
>>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\LYLOADER.EXE probably infected with MULDROP.Trojan
>>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\LYMANGR.DLL infected with Trojan.PWS.Wsgame.origin
>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\mppds.dll infected with Trojan.PWS.Wsgame.origin
>>C:\Documents and Settings\Administrator\桌面\v2.rar\v2\MSDEG32.DLL infected with Trojan.PWS.Wsgame.origin
C:\Documents and Settings\Administrator\桌面\v2.rar - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 21
Infected objects found: 8
Objects with modifications found: 0
Suspicious objects found: 2
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Cured: 0
Deleted: 0
Renamed: 0
Moved: 0
Ignored: 0
Scan speed: 306 Kb/s
Scan time: 00:00:02

显示全部楼层 · 发表于 2007-9-20 18:37:14

瑞星12个。

显示全部楼层 · 发表于 2007-9-20 20:05:58

AVK杀12个

[病毒样本] 午餐来一包