今天抓到的一大堆

显示全部楼层 · 发表于 2007-10-1 14:59:59

RT
木马下载器下的

[ 本帖最后由 newcenturysun 于 2007-10-1 15:01 编辑 ]

显示全部楼层 · 发表于 2007-10-1 15:01:27

样本呢？楼主？

显示全部楼层 · 发表于 2007-10-1 15:01:53

还在上传？

显示全部楼层 · 发表于 2007-10-1 15:02:36

刚才没传上不好意思

显示全部楼层 · 发表于 2007-10-1 15:03:22

卡巴 7.0.0.125
18个
已删除: 病毒 Worm.Win32.Viking.lw 文件: F:\病毒样本\1001.zip/1001/104[1].exe
已删除: 病毒 Worm.Win32.Viking.lw 文件: F:\病毒样本\1001.zip/1001/104.exe
已删除: 木马程序 Trojan-Downloader.Win32.Baser.w 文件: F:\病毒样本\1001.zip/1001/1[1].exe//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-Dropper.Win32.Killav.e 文件: F:\病毒样本\1001.zip/1001/108[1].exe//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.dgi 文件: F:\病毒样本\1001.zip/1001/109[1].exe//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.din 文件: F:\病毒样本\1001.zip/1001/110[1].exe//PE_Patch//UPack//#
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.din 文件: F:\病毒样本\1001.zip/1001/110.exe//PE_Patch//UPack//#
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.dne 文件: F:\病毒样本\1001.zip/1001/102.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.dne 文件: F:\病毒样本\1001.zip/1001/102[1].exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.dpd 文件: F:\病毒样本\1001.zip/1001/107.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.dpd 文件: F:\病毒样本\1001.zip/1001/107[1].exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.dru 文件: F:\病毒样本\1001.zip/1001/101[1].exe//PE_Patch.UPX//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.dsl 文件: F:\病毒样本\1001.zip/1001/112.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.dtj 文件: F:\病毒样本\1001.zip/1001/105[1].exe//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.dwc 文件: F:\病毒样本\1001.zip/1001/103[1].exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.dwv 文件: F:\病毒样本\1001.zip/1001/100[1].exe
已删除: 木马程序 Trojan-PSW.Win32.QQPass.afp 文件: F:\病毒样本\1001.zip/1001/111.exe//UPX
已删除: 木马程序 Trojan-PSW.Win32.QQPass.afp 文件: F:\病毒样本\1001.zip/1001/111[1].exe//UPX

显示全部楼层 · 发表于 2007-10-1 15:03:34

[Scan path] C:\Documents and Settings\Administrator\桌面\1001.zip
>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/100[1].exe infected with Trojan.MulDrop.9098
>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/101[1].exe infected with Trojan.PWS.Wsgame.1422
>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/102.exe infected with Trojan.PWS.Wsgame.1424
>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/102[1].exe infected with Trojan.PWS.Wsgame.1424
>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/103[1].exe infected with Trojan.PWS.Wsgame.1457
>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/104.exe infected with Win32.HLLW.Gavir.72
>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/104[1].exe infected with Win32.HLLW.Gavir.72
>>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/105[1].exe infected with Trojan.DownLoader.origin
>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/107.exe infected with Trojan.PWS.Gamania.4533
>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/107[1].exe infected with Trojan.PWS.Gamania.4533
>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/108[1].exe infected with Trojan.PWS.Wsgame.1207
>>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/109[1].exe infected with Trojan.PWS.Gamania.4218
>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/110.exe - Ok
>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/110[1].exe - Ok
>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/111.exe infected with Trojan.PWS.Qqpass.1426
>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/111[1].exe infected with Trojan.PWS.Qqpass.1426
>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/112.exe infected with Trojan.MulDrop.9101
>>C:\Documents and Settings\Administrator\桌面\1001.zip\1001/1[1].exe infected with BackDoor.WebDor
C:\Documents and Settings\Administrator\桌面\1001.zip - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 20
Infected objects found: 16
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Cured: 0
Deleted: 0
Renamed: 0
Moved: 0
Ignored: 0
Scan speed: 233 Kb/s
Scan time: 00:00:02

显示全部楼层 · 发表于 2007-10-1 15:04:48

C:\ABC\1001\1001\100[1].exe - 特征码 'Generic.PWS.Games.3' 被发现
C:\ABC\1001\1001\101[1].exe - 特征码 'Trojan-PWS.Win32.OnLineGames.wp' 被发现
C:\ABC\1001\1001\102.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\1001\1001\102[1].exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\1001\1001\103[1].exe - 特征码 'Generic.PWS.Games.1' 被发现
C:\ABC\1001\1001\104.exe - 特征码 'Worm.Win32.Viking.lj' 被发现
C:\ABC\1001\1001\104[1].exe - 特征码 'Worm.Win32.Viking.lj' 被发现
C:\ABC\1001\1001\105[1].exe - 特征码 'Generic.PWS.Games.2' 被发现
C:\ABC\1001\1001\107.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\1001\1001\107[1].exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\1001\1001\108[1].exe - 特征码 'Trojan-PWS.Win32.OnLineGames.wp' 被发现
C:\ABC\1001\1001\109[1].exe - 特征码 'Trojan-PWS.Win32.OnLineGames.wp' 被发现
C:\ABC\1001\1001\110.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\1001\1001\110[1].exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\1001\1001\111.exe - 特征码 'Virus.Win32.AutoRun.bs' 被发现
C:\ABC\1001\1001\111[1].exe - 特征码 'Virus.Win32.AutoRun.bs' 被发现
C:\ABC\1001\1001\112.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\1001\1001\1[1].exe - 特征码 'Trojan-PWS.Win32.QQPass.pb' 被发现

18 文件被扫描
(0 压缩档 0 文件)
18 特征码被侦测
0 可疑代码段被发现
耗时: 0:00.360

显示全部楼层 · 发表于 2007-10-1 15:05:08

D:\download\virusscan\1001.zip:\1001\100[1].exe - Signature 'Generic.PWS.Games.3' found
D:\download\virusscan\1001.zip:\1001\101[1].exe - Signature 'Trojan-PWS.Win32.OnLineGames.wp' found
D:\download\virusscan\1001.zip:\1001\102.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
D:\download\virusscan\1001.zip:\1001\102[1].exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
D:\download\virusscan\1001.zip:\1001\103[1].exe - Signature 'Generic.PWS.Games.1' found
D:\download\virusscan\1001.zip:\1001\104.exe - Signature 'Worm.Win32.Viking.lj' found
D:\download\virusscan\1001.zip:\1001\104[1].exe - Signature 'Worm.Win32.Viking.lj' found
D:\download\virusscan\1001.zip:\1001\105[1].exe - Signature 'Generic.PWS.Games.2' found
D:\download\virusscan\1001.zip:\1001\107.exe - Signature 'Trojan-Spy.Win32.Bancos.ha' found
D:\download\virusscan\1001.zip:\1001\107[1].exe - Signature 'Trojan-Spy.Win32.Bancos.ha' found
D:\download\virusscan\1001.zip:\1001\108[1].exe - Signature 'Trojan-PWS.Win32.OnLineGames.wp' found
D:\download\virusscan\1001.zip:\1001\109[1].exe - Signature 'Trojan-PWS.Win32.OnLineGames.wp' found
D:\download\virusscan\1001.zip:\1001\110.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
D:\download\virusscan\1001.zip:\1001\110[1].exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
D:\download\virusscan\1001.zip:\1001\111.exe - Signature 'Virus.Win32.AutoRun.bs' found
D:\download\virusscan\1001.zip:\1001\111[1].exe - Signature 'Virus.Win32.AutoRun.bs' found
D:\download\virusscan\1001.zip:\1001\112.exe - Signature 'Trojan-Spy.Win32.Bancos.ha' found
D:\download\virusscan\1001.zip:\1001\1[1].exe - Signature 'Trojan-PWS.Win32.QQPass.pb' found
D:\download\virusscan\1001.zip

19 Files scanned
(1 Archiv with 18 files)
18 Signatures found
0 Suspect code-parts found
Used time: 0:00.751

显示全部楼层 · 发表于 2007-10-1 15:41:50

木马名称:Trojan-PSW.Win32.OnLineGames.ntu

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\101[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.nqf

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\102.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.nqf

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\102[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.Genetik.cvf

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\103[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Vikings.ffd

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\104.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Vikings.ffd

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\104[1].EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.Genetik.crc

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\105[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.nqx

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\107.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.nqx

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\107[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Dropper.Win32.Killav.l

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\108[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.mcg

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\109[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.QQPass.fua

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\111.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.QQPass.fua

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\111[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.ocx

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\112.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Baser.h

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\1[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\100[1].EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYLOADER.EXE
2) C:\WINDOWS.0\SYSTEM32\LYLOADER.EXE
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYMANGR.DLL
4) C:\WINDOWS.0\SYSTEM32\LYMANGR.DLL5) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MSDEG32.DLL
6) C:\WINDOWS.0\SYSTEM32\MSDEG32.DLL
是否删除木马程序及其衍生物?

木马名称:Trojan-PSW.Win32.OnLineGames.mil

程序:
C:\WINDOWS.0\SYSTEM32\MSCOMM.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\110.EXE
是否删除木马程序及其衍生物?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1001\110[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

KO

显示全部楼层 · 发表于 2007-10-1 17:18:41

TrustPort Antivirus On-Demand Scanner

   Status       Quarantined
   Target       G:\v\1001.zip
                           Options
                                             , Requested action: Move to quarantine, Excluded extensions
                           disabled, Excluded objects disabled, Heuristics enabled, Sandbox enabled,
                           Scan archives

            Statistics       Details

                                                Files             Boot sectorsRegistry key

                           Scanned             21                      0                            0
                           Infected             16                      0                            0
                           Repaired             0                      0                            0
                           Renamed             0                      -                            -
                        Quarantined             1                      -                            -
                              Deleted             0                      -                            0

[病毒样本] 今天抓到的一大堆

本帖子中包含更多资源