挖掘时遗漏的，挂很多[29DE89]

promised

[ 本帖最后由 promised 于 2007-9-30 18:51 编辑 ]

promised

a-squared	3.0.0.123	2007.09.27	2007-09-27	-	4.040
AntiVir	7.6.0.18	7.0.0.33	2007-09-28	TR/Delphi.Downloader.Gen	1.841
Arcavir	1.0.4	200709282005	2007-09-28	-	1.298
AVAST	1.0.8	000777-3	2007-09-29	-	3.047
AVG	7.5.49.442	269.13.35/1039	2007-09-29	-	1.700
BitDefender	7.60825.897658	7.15033	2007-09-30	-	3.412
CA (VET)	8.4.0.24	31.2.5174	2007-09-29	-	0.927
ClamAV	0.91.1	4440	2007-09-30	-	0.888
Comodo	2.11	2.0.0.300	2007-09-30	-	1.206
Dr.WEB	4.33	2007.09.30	2007-09-30	-	6.086
ewido	4.0.0.2	2007.09.29	2007-09-29	-	3.401
F-PROT	4.4.0.50	20070929	2007-09-29	Possible W32/NewMalware-LSU-based!Maximus	1.624
F-SECURE	5.51.6100	2007.09.28.05	2007-09-28	-	0.174
IKARUS	T3.1.1.12	2007.09.30.69593	2007-09-30	-	5.875
MKS_VIR	2.01	2007.09.29	2007-09-29	-	1.998
NOD32	2.70.10	2560	2007-09-30	-	0.936
NORMAN	5.91.07	5.90	2007-09-28	-	7.625
nProtect	2007-09-29.00	958198	2007-09-29	-	11.236
QuickHeal	9.00	2007.09.29	2007-09-29	-	3.825
SOPHOS	2.49.1	4.21	2007-09-29	-	3.152
The Hacker	6.2.6	v00073	2007-09-28	-	0.732
VBA32	3.12.2.4	20070928.2036	2007-09-28	-	0.966
ViRobot	20070928	2007.09.28	2007-09-28	-	0.472
VirusBuster	4.3.19:9	9.107.2/11.0	2007-09-30	-	4.107
卡巴斯基	5.5.10	2007.09.30	2007-09-30	Trojan-Downloader.Win32.QDown.af	0.078
江民杀毒	10.00.650	2007.09.30	2007-09-30	-	1.394
熊猫卫士	9.04.03.0001	2007.09.29	2007-09-29	-	7.324
瑞星	19.0	19.42.62.00	2007-09-30	-	1.893
赛门铁克	1.3.0.24	20070929.007	2007-09-29	-	0.298
趋势	8.500-1001	4.747.00	2007-09-28	-	0.094
迈克菲	5.2.00	5130	2007-09-28	-	1.021
金山毒霸	2007.6.20.249	2007.9.29	2007-09-29	-	1.980
飞塔	2.81-3.11	8.172	2007-09-30	-	2.196

平淡

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.QDown.af        URL: http://bbs.kafan.cn/attachment.php?aid=133845//dw16.exe//ASPack

碧水寒潭

Start of the scan: 2007年9月30日  21:32

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\dw16.rar
  [0] Archive type: RAR
  --> dw16.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年9月30日  21:32
Used time: 00:11 min

The scan has been done completely.

      1 Scanning directories
      2 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

king6808

已删除：木马程序 Trojan-Downloader.Win32.QDown.af        文件: F:\9.30\dw16.rar/dw16.exe//ASPack

微点卫士

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DW16.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1405
远端地址:218.16.120.253(广东)
远端端口:80
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\W5638X6B\QQ[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\「开始」菜单\程序\启动\QQ.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DW16.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\W5638X6B\QQ[1].EXE
是否删除木马程序及其衍生物?

changzheng2

Authentium  Possibly a new variant of W32/NewMalware-LSU-based!Maximus
Webwasher-Gateway  Trojan.Delphi.Downloader.Gen
eSafe  Suspicious Trojan/Worm
Panda Suspicious file

★File have been compressed.
    ☆Decompressing ASPack.
   
★Changes to filesystem
    ☆Creates file C:\WINDOWS\STARTM~1\PROGRAMS\STARTUP\qq.exe.

★Network services
    ☆Downloads file from hxxp://xxx.f126.com/go/qq.exe as C:\WINDOWS\STARTM~1\PROGRAMS\STARTUP\qq.exe.
    ☆Connects to xxx.f126.com (中国广东省东莞市电信IDC机房)on port 80 (TCP).
    ☆Opens URL: xxx.f126.com/go/qq.exe.

  ★Process&window information
    ☆Creates an event called .

[ 本帖最后由 changzheng2 于 2007-10-1 03:09 编辑 ]

taihuxian

Virus: Trojan-Downloader.Win32.QDown.af

Virus found while downloading Web content.

Address: bbs.kafan.cn

lovewei

这里面还大有文章，下载者再加下载者,autorun，修改host，自动升级

[ 本帖最后由 lovewei 于 2007-10-1 12:43 编辑 ]