下午茶一小包13个样本

gzg

大家一起扫扫看

Nerazzurri

deleted: Trojan program Trojan-PSW.Win32.OnLineGames.drd        File: F:\Documents and Settings\Crusade\×ÀÃæ\TEMP.rar/RSZTBSP.EXE//UPack
deleted: virus Virus.Win32.AutoRun.qd        File: F:\Documents and Settings\Crusade\×ÀÃæ\TEMP.rar/S168[1].exe//UPack
deleted: virus Virus.Win32.AutoRun.pi        File: F:\Documents and Settings\Crusade\×ÀÃæ\TEMP.rar/SYSWIN74.JMP//UPX
deleted: virus Virus.Win32.AutoRun.pi        File: F:\Documents and Settings\Crusade\×ÀÃæ\TEMP.rar/WINSYS74.SYS
deleted: Trojan program Trojan-PSW.Win32.WOW.ys        File: F:\Documents and Settings\Crusade\×ÀÃæ\TEMP.rar/wodoor0.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.dpz        File: F:\Documents and Settings\Crusade\×ÀÃæ\TEMP.rar/17cube²¡¶¾Îļþ.exe//#//NSPack
deleted: virus Virus.Win32.AutoRun.pi        File: F:\Documents and Settings\Crusade\×ÀÃæ\TEMP.rar/A0009158.EXE//UPX
deleted: virus Virus.Win32.AutoRun.pi        File: F:\Documents and Settings\Crusade\×ÀÃæ\TEMP.rar/AUTORUN.EXE//UPX
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.drb        File: F:\Documents and Settings\Crusade\×ÀÃæ\TEMP.rar/KAQHDAZ.EXE//UPack
deleted: Trojan program Trojan-Downloader.JS.IstBar.az        File: F:\Documents and Settings\Crusade\×ÀÃæ\TEMP.rar/o.js
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.drc        File: F:\Documents and Settings\Crusade\×ÀÃæ\TEMP.rar/RARJBTL.EXE//UPack

浪滔天

卡巴 7.0.0.125
11个 但有个删除不掉

已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.dpz        文件: F:\病毒样本\TEMP.rar/17cube病毒文件.exe//#//NSPack
已删除: 病毒 Virus.Win32.AutoRun.pi        文件: F:\病毒样本\TEMP.rar/WINSYS74.SYS
已删除: 病毒 Virus.Win32.AutoRun.pi        文件: F:\病毒样本\TEMP.rar/A0009158.EXE//UPX
已删除: 病毒 Virus.Win32.AutoRun.pi        文件: F:\病毒样本\TEMP.rar/AUTORUN.EXE//UPX
已删除: 病毒 Virus.Win32.AutoRun.pi        文件: F:\病毒样本\TEMP.rar/SYSWIN74.JMP//UPX
已删除: 病毒 Virus.Win32.AutoRun.qd        文件: F:\病毒样本\TEMP.rar/S168[1].exe//UPack
已删除: 木马程序 Trojan-Downloader.JS.IstBar.az        文件: F:\病毒样本\TEMP.rar/o.js
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.drb        文件: F:\病毒样本\TEMP.rar/KAQHDAZ.EXE//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.drc        文件: F:\病毒样本\TEMP.rar/RARJBTL.EXE//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.drd        文件: F:\病毒样本\TEMP.rar/RSZTBSP.EXE//UPack
已删除: 木马程序 Trojan-PSW.Win32.WOW.ys        文件: F:\病毒样本\TEMP.rar/wodoor0.dll

jimmyleo

d:\download\virusscan\TEMP.rar:\RSZTBSP.EXE - Signature 'Trojan-Spy.Win32.Bancos.ha' found
d:\download\virusscan\TEMP.rar:\S168[1].exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found
d:\download\virusscan\TEMP.rar:\SC.EXE
d:\download\virusscan\TEMP.rar:\SYSWIN74.JMP - Signature 'Virus.Win32.AutoRun.bs' found
d:\download\virusscan\TEMP.rar:\WINSYS74.SYS - Signature 'Trojan-PWS.Win32.Nilage.bga' found
d:\download\virusscan\TEMP.rar:\wodoor0.dll - Signature 'Backdoor.Win32.Agent.ahj' found
d:\download\virusscan\TEMP.rar:\rising102.exe - File is maybe corrupt
d:\download\virusscan\TEMP.rar:\17cube病毒文件.exe - Signature 'Trojan-Downloader.Win32.Delf.zd' found
d:\download\virusscan\TEMP.rar:\A0009158.EXE - Signature 'Virus.Win32.AutoRun.bs' found
d:\download\virusscan\TEMP.rar:\AUTORUN.EXE - Signature 'Virus.Win32.AutoRun.bs' found
d:\download\virusscan\TEMP.rar:\KAQHDAZ.EXE - Signature 'Trojan-Spy.Win32.Bancos.ha' found
d:\download\virusscan\TEMP.rar:\o.js - Signature 'Trojan-Downloader.JS.IstBar.AI' found
d:\download\virusscan\TEMP.rar:\RARJBTL.EXE - Signature 'Trojan-Spy.Win32.Bancos.ha' found
d:\download\virusscan\TEMP.rar

        14 Files scanned
          (1 Archiv with 13 files)
        11 Signatures found
        0 Suspect code-parts found
        Used time: 0:00.511

wangjay1980

删不掉的是卡6扫不到的，可以上报

浪滔天

原帖由 wangjay1980 于 2007-10-1 15:12 发表
删不掉的是卡6扫不到的，可以上报

但我看2楼的能删掉，以前也碰到过一次，不知道是怎么回事。

微点卫士

木马名称:Trojan-PSW.Win32.OnLineGames.nyl

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\RARJBTL.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.ofg

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TMP2.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\START.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1882
远端地址:222.92.117.186(江苏·苏州)
远端端口:80
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\START.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1887
远端地址:222.92.117.186(江苏·苏州)
远端端口:80
这个要安装魔兽世界的

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\A0009158.EXE
由
E:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) E:\AUTORUN.EXE
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSWIN74.JMP
3) E:\AUTORUN.INF
以及可由此INF文件引导自启的文件:E:\AUTORUN.EXE

是否删除木马程序及其衍生物?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\AUTORUN.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\KAQHDAZ.EXE
1) C:\DFD5800718.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\RSZTBSP.EXE
1) C:\DFD5822093.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\RSZTBSP.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\RSZTBPM.DLL
2) C:\WINDOWS.0\SYSTEM32\RSZTBSP.EXE
是否删除木马程序及其衍生物?


S168[1]  SC上报看看

zengmingwh

Begin scan in 'F:\bingdu\TEMP.rar'
F:\bingdu\TEMP.rar
  [0] Archive type: RAR
  --> RSZTBSP.EXE
      [DETECTION] Is the Trojan horse TR/FWDisable.24152
  --> S168[1].exe
      [DETECTION] Is the Trojan horse TR/Autorun.BK
  --> SYSWIN74.JMP
      [DETECTION] Is the Trojan horse TR/PSW.QQGame.AB
  --> WINSYS74.SYS
      [DETECTION] Is the Trojan horse TR/PSW.QQGame.AB
  --> wodoor0.dll
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 17cube²¡¶¾Îļþ.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> A0009158.EXE
      [DETECTION] Is the Trojan horse TR/PSW.QQGame.AB
  --> AUTORUN.EXE
      [DETECTION] Is the Trojan horse TR/PSW.QQGame.AB
  --> KAQHDAZ.EXE
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.drb
  --> RARJBTL.EXE
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.drc.2
      [WARNING]   The file was ignored!


End of the scan: 2007年10月1日  15:26
Used time: 00:33 min

The scan has been done completely.

      0 Scanning directories
     14 Files were scanned
     10 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

碧水寒潭

Start of the scan: 2007年10月1日  15:29

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\TEMP.rar
  [0] Archive type: RAR
  --> RSZTBSP.EXE
      [DETECTION] Is the Trojan horse TR/FWDisable.24152
  --> S168[1].exe
      [DETECTION] Is the Trojan horse TR/Autorun.BK
  --> SYSWIN74.JMP
      [DETECTION] Is the Trojan horse TR/PSW.QQGame.AB
  --> WINSYS74.SYS
      [DETECTION] Is the Trojan horse TR/PSW.QQGame.AB
  --> wodoor0.dll
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 17cube²¡¶¾Îļþ.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> A0009158.EXE
      [DETECTION] Is the Trojan horse TR/PSW.QQGame.AB
  --> AUTORUN.EXE
      [DETECTION] Is the Trojan horse TR/PSW.QQGame.AB
  --> KAQHDAZ.EXE
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.drb
  --> RARJBTL.EXE
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.drc.2
      [INFO]      The file was deleted!


End of the scan: 2007年10月1日  15:29
Used time: 00:13 min

The scan has been done completely.

      1 Scanning directories
     14 Files were scanned
     10 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

残缺的唯美

nod32
D:\Documents and Settings\EKINCHENG\桌面\TEMP.rar » RAR » RSZTBSP.EXE - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TEMP.rar » RAR » S168[1].exe - a variant of Win32/PSW.OnLineGames.NBR trojan
D:\Documents and Settings\EKINCHENG\桌面\TEMP.rar » RAR » SYSWIN74.JMP - probably a variant of Win32/AutoRun.Q worm
D:\Documents and Settings\EKINCHENG\桌面\TEMP.rar » RAR » WINSYS74.SYS - probably a variant of Win32/AutoRun.Q worm
D:\Documents and Settings\EKINCHENG\桌面\TEMP.rar » RAR » A0009158.EXE - probably a variant of Win32/AutoRun.Q worm
D:\Documents and Settings\EKINCHENG\桌面\TEMP.rar » RAR » AUTORUN.EXE - probably a variant of Win32/AutoRun.Q worm
D:\Documents and Settings\EKINCHENG\桌面\TEMP.rar » RAR » KAQHDAZ.EXE - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TEMP.rar » RAR » RARJBTL.EXE - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\TEMP.rar - multiple threats - deleted - quarantined