下载者及其产物18只

残缺的唯美

D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » 10.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » 1.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » ravztmon.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » avpzx.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » 3.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » 2.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » 12.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » 11.exe - probably a variant of Win32/AutoRun.Q worm
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » 9.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » 8.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » WinSys64.Sys - probably a variant of Win32/AutoRun.Q worm
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » 5.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » ma.exe - probably unknown NewHeur_PE virus
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » uaulcq.sys - probably unknown NewHeur_PE virus
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » rsmyapm.dll - probably a variant of Win32/PSW.OnLineGames.NEN trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » kvdxcma.dll - a variant of Win32/PSW.OnLineGames.NEN trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar - multiple threats - deleted - quarantined

wangjay1980

15
detected: Trojan program Trojan-PSW.Win32.OnLineGames.del        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/avpzx.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.cqb        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/ravztmon.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.WOW.xm        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/1.exe//PE_Patch//UPack
detected: virus Heur.Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/10.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.czj        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/11.exe//UPX
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/12.exe//PE_Patch//UPack
detected: Trojan program Trojan-Dropper.Win32.Agent.bxi        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/3.exe//UPack
detected: Trojan program Trojan-PSW.Win32.Delf.acj        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/5.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.czv        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/WinSys64.Sys
detected: Trojan program Trojan-PSW.Win32.OnLineGames.dem        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/8.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.dfs        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/9.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.dfs        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/kvdxcma.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.dem        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/rsmyapm.dll
detected: Trojan program Trojan-Spy.Win32.Delf.aji        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/avwlamn.dll
detected: Trojan program Trojan-Downloader.Win32.Small.fsl        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/ma.exe//PE_Patch.UPX//UPX

风野胤

原帖由 jimmyleo 于 2007-9-21 20:26 发表
干嘛啊 风野？

没什么
只是这两天都没看见你
有点奇怪而已

jimmyleo

hehe 我在做一些幕后工作 和sick交涉（就是那个html的作者……）
叫他加一些利用国内软件漏洞的网页侦测~ 嘿嘿~

king6808

已清除：木马程序 Trojan-Dropper.Win32.VB.rv        文件　: G:\9.21\样本3.rar

风野胤

原帖由 jimmyleo 于 2007-9-21 21:06 发表
hehe 我在做一些幕后工作 和sick交涉（就是那个html的作者……）
叫他加一些利用国内软件漏洞的网页侦测~ 嘿嘿~

辛苦了
主要是web迅雷吧

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\��.rar'
C:\Documents and Settings\Administrator\My Documents\
  ��.rar
    [0] Archive type: RAR
    --> avpzx.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineG.TF.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> ravztmon.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cqb
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1.exe
        [DETECTION] Is the Trojan horse TR/PSW.WOW.XM
        [WARNING]   Infected files in archives cannot be repaired!
    --> 10.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLine.ddm.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> 11.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.czv
        [WARNING]   Infected files in archives cannot be repaired!
    --> 12.exe
        [DETECTION] Is the Trojan horse TR/Hijack.Explor.4377
        [WARNING]   Infected files in archives cannot be repaired!
    --> 2.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLine.ddm.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> 3.exe
        [DETECTION] Is the Trojan horse TR/Drop.Agent.bxi
        [WARNING]   Infected files in archives cannot be repaired!
    --> 5.exe
        [DETECTION] Is the Trojan horse TR/PSW.Steal.22654
        [WARNING]   Infected files in archives cannot be repaired!
    --> WinSys64.Sys
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.czv
        [WARNING]   Infected files in archives cannot be repaired!
    --> 8.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.dem
        [WARNING]   Infected files in archives cannot be repaired!
    --> 9.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.dfs
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvdxcma.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> rsmyapm.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.dem.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> avwlamn.dll
        [DETECTION] Is the Trojan horse TR/Spy.Delf.aji
        [WARNING]   Infected files in archives cannot be repaired!
    --> uaulcq.dll
    --> uaulcq.sys
        [DETECTION] Is the Trojan horse TR/Rootkit.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> ma.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Soael
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年9月21日  07:59
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
     19 Files were scanned
     16 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
     18 Warnings
      0 Notes

yurius

Scanned files summary Scanned : 19
Infected : 14

J:\virus\样本.rar BehavesLike:Trojan.WUDisable Infected
J:\virus\样本.rar BehavesLike:Win32.ExplorerHijack Infected
J:\virus\样本.rar BehavesLike:Win32.ExplorerHijack Infected
J:\virus\样本.rar BehavesLike:Win32.ExplorerHijack Infected
J:\virus\样本.rar BehavesLike:Win32.ExplorerHijack Infected
J:\virus\样本.rar DeepScan:Generic.Dld.Agent.0AC18752 Infected
J:\virus\样本.rar DeepScan:Generic.Dld.Agent.A287AE87 Infected
J:\virus\样本.rar DeepScan:Generic.Dld.Agent.BB03FA6E Infected
J:\virus\样本.rar Generic.Malware.SBdldg.D5BE7F21 Infected
J:\virus\样本.rar Generic.Malware.dld!.BA8607CF Suspect
J:\virus\样本.rar Generic.PWS.Games.1.BAC15690 Infected
J:\virus\样本.rar Generic.PWS.Games.2.FB54C067 Infected
J:\virus\样本.rar Generic.PWStealer.2DBD6010 Infected
J:\virus\样本.rar Generic.PWStealer.3FB2CF66 Infected
J:\virus\样本.rar Generic.PWStealer.4A286F8E Infected

红心王子

2007-9-22        5:19:10        1190409550        Administrator        1536        Sign of "Win32:Onlinegames-AUU [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\avpzx.exe\[Upack]\[Embedded#9060]\[Upack]" file.  
2007-9-22        5:19:13        1190409553        Administrator        1536        Sign of "Win32:Small-HRV [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\ravztmon.exe\[Upack]\[Embedded#9060]\[Upack]" file.  
2007-9-22        5:19:13        1190409553        Administrator        1536        Sign of "Win32:Onlinegames-BBH [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\1.exe\[Upack]\[Embedded#9060]\[Upack]" file.  
2007-9-22        5:19:13        1190409553        Administrator        1536        Sign of "Win32:Autorun-BS [Wrm]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\11.exe\[UPX]\[Embedded#05ef8]" file.  
2007-9-22        5:19:13        1190409553        Administrator        1536        Sign of "Win32:Delf-FVM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\3.exe\[Upack]\[Embedded#MUSIC]" file.  
2007-9-22        5:19:13        1190409553        Administrator        1536        Sign of "Win32:Delf-FFM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\5.exe\[Upack]\[Embedded#KK]" file.  
2007-9-22        5:19:13        1190409553        Administrator        1536        Sign of "Win32:Autorun-BS [Wrm]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\WinSys64.Sys" file.  
2007-9-22        5:19:13        1190409553        Administrator        1536        Sign of "Win32:Onlinegames-BCC [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\8.exe\[Upack]\[Embedded#MUSIC]" file.  
2007-9-22        5:19:13        1190409553        Administrator        1536        Sign of "Win32:Onlinegames-BCC [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\9.exe\[Upack]\[Embedded#MUSIC]" file.  
2007-9-22        5:19:13        1190409553        Administrator        1536        Sign of "Win32:Onlinegames-BCC [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\kvdxcma.dll" file.  
2007-9-22        5:19:13        1190409553        Administrator        1536        Sign of "Win32:Onlinegames-BCC [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\rsmyapm.dll" file.  
2007-9-22        5:19:13        1190409553        Administrator        1536        Sign of "Win32:Delf-FVM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\avwlamn.dll" file.  
2007-9-22        5:19:13        1190409553        Administrator        1536        Sign of "Win32:Downloader-LL [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\样本.rar\ma.exe" file.

微点卫士

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\1.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\AVPMS.EXE
2) C:\PROGRAM FILES\NETMEETING\AVPMS.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\2.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\XYUPRI0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\3.EXE
1) C:\DFD940234.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:

1) C:\DFD940234.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\3.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\AVWLAMN.DLL
2) C:\WINDOWS.0\SYSTEM32\AVWLAST.EXE
是否删除木马程序及其衍生物?
程序:

1) C:\DFD962156.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\8.EXE
1) C:\DFD1005609.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:

1) C:\DFD1005609.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\9.EXE
1) C:\DFD1023890.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:

1) C:\DFD1023890.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\10.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\CSAVPW0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\12.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\AVPDJ.EXE
2) C:\PROGRAM FILES\NETMEETING\AVPDJ.DAT
是否删除木马程序及其衍生物?


5挂，上报