费尔全死病毒样本第ㄧ包 26只

显示全部楼层 · 发表于 2007-10-4 17:27:53

解压密码:virus
http://www.sendspace.com/file/2f083a

显示全部楼层 · 发表于 2007-10-4 17:29:42

无法显示网页
您正在查找的页当前不可用。网站可能遇到支持问题，或者您需要调整您的浏览器设置。

显示全部楼层 · 发表于 2007-10-4 17:54:59

用无界下载下来了

[ 本帖最后由 qianwenxiang 于 2007-10-4 17:59 编辑 ]

显示全部楼层 · 发表于 2007-10-4 18:02:58

2007-10-4 18:02:01 1191492121 Administrator 2840 Sign of "MW97:CVE-2006-2492.Gen [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part1.rar\0569.doc" file.
2007-10-4 18:02:09 1191492129 Administrator 2840 Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part1.rar\0577.sys\[Embedded#0c158]" file.
2007-10-4 18:02:09 1191492129 Administrator 2840 Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part1.rar\0577.sys" file.
2007-10-4 18:02:09 1191492129 Administrator 2840 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part1.rar\0309.scr" file.
2007-10-4 18:02:09 1191492129 Administrator 2840 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part1.rar\0310.scr" file.
2007-10-4 18:02:09 1191492129 Administrator 2840 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part1.rar\0311.scr" file.
2007-10-4 18:02:10 1191492130 Administrator 2840 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part1.rar\0312.scr" file.
2007-10-4 18:02:10 1191492130 Administrator 2840 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part1.rar\0319.scr" file.
2007-10-4 18:02:10 1191492130 Administrator 2840 Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part1.rar\0357.exe" file.
2007-10-4 18:02:10 1191492130 Administrator 2840 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part1.rar\0369.scr" file.
2007-10-4 18:02:11 1191492131 Administrator 2840 Sign of "Win32:Ldpinch-IG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part2.rar\0425.exe" file.
2007-10-4 18:02:11 1191492131 Administrator 2840 Sign of "Win32:Agent-KNG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part2.rar\0442.exe" file.
2007-10-4 18:02:12 1191492132 Administrator 2840 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part2.rar\0443.scr" file.
2007-10-4 18:02:15 1191492135 Administrator 2840 Sign of "Win32:Agent-JWU [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part2.rar\0444.exe\[MEW]" file.
2007-10-4 18:02:16 1191492136 Administrator 2840 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part3.rar\0446.scr" file.
2007-10-4 18:02:16 1191492136 Administrator 2840 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part3.rar\0449.scr" file.
2007-10-4 18:02:16 1191492136 Administrator 2840 Sign of "Win32:Tiny-KG [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\1[1].part3.rar\0559.exe\[UPX]" file.

显示全部楼层 · 发表于 2007-10-4 18:05:27

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\1\0569.doc]
                  …………发现Spy！报告:[2]
文件信息:  大小:24064  MD5:ed63916d90a32f30db642fcd2916e01e

[C:\Documents and Settings\Administrator\桌面\Virus\1\0577.sys]
                  …………发现Spy！报告:[2]
文件信息:  大小:187392  MD5:b06090ee2881c1bac0d275b17d140d3b

[C:\Documents and Settings\Administrator\桌面\Virus\1\0582.exe]
                  …………发现Spy！报告:[1]
文件信息:  大小:1173  MD5:c6078d7e9a47fcb3debdb261355e14ce

[C:\Documents and Settings\Administrator\桌面\Virus\1\0357.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:85344  MD5:2312b02cf8c50bc32cdb0686a9c3ac96

[C:\Documents and Settings\Administrator\桌面\Virus\1\0400.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:660480  MD5:ab60f3c51064a28fe80f144583631dfe

[C:\Documents and Settings\Administrator\桌面\Virus\1\0425.exe]
                  …………发现Spy！报告:[1]
文件信息:  大小:237928  MD5:b531574e07dfb3def2558c0c439c7b9e

[C:\Documents and Settings\Administrator\桌面\Virus\1\0442.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:83703  MD5:32697f29ad23ff07f99dcad3d5b7ea64

[C:\Documents and Settings\Administrator\桌面\Virus\1\0444.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:785335  MD5:1551b2406c58c31aa621daf7d58664e3

[C:\Documents and Settings\Administrator\桌面\Virus\1\0559.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:10240  MD5:4728505f026648f2e2368763f04defc8

文件数:26 病毒数:9  比重:0.3461538461538
OK  扫描完毕！
  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2007-10-4 18:06 编辑 ]

显示全部楼层 · 发表于 2007-10-4 21:35:38

已删除：恶意程序 Exploit.MSWord.Agent.c 文件　: G:\Temp\1.rar/1\0569.doc//1Table
已隔离：病毒 Packed.Win32.PePatch.dk (修改) 文件　: G:\Temp\1.rar/1\0582.exe//PE_Patch//PE_Patch
已删除：风险软件 not-a-virus:RemoteAdmin.Win32.WinVNC-based.j 文件　: G:\Temp\1.rar/1\0400.exe//Obsidium

显示全部楼层 · 发表于 2007-10-4 22:49:34

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\1'
C:\Users\morgan\Documents\1\
  0309.scr
[0] Archive type: ZIP SFX (self extracting)
--> photo01.jpg
  0310.scr
[0] Archive type: ZIP SFX (self extracting)
--> photo02.jpg
  0311.scr
[0] Archive type: ZIP SFX (self extracting)
--> photo01.jpg
  0312.scr
[0] Archive type: ZIP SFX (self extracting)
--> photo02.jpg
  0319.scr
[0] Archive type: RAR SFX (self extracting)
--> gi7.jpg
  0357.exe
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/BDSearch.CBT
   [INFO]    The file was deleted!
  0369.scr
[0] Archive type: RAR SFX (self extracting)
--> 1.jpg
  0400.exe
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/Obsidium). Please verify the origin of the file
   [INFO]    The file was deleted!
  0425.exe
  0442.exe
   [DETECTION] Is the Trojan horse TR/HackTool.B
   [INFO]    The file was deleted!
  0443.scr
[0] Archive type: RAR SFX (self extracting)
--> nice.jpg
  0444.exe
   [DETECTION] Contains detection pattern of the SPR/Tool.Chin.AB program
   [INFO]    The file was deleted!
  0446.scr
[0] Archive type: RAR SFX (self extracting)
--> m6.jpg
  0449.scr
[0] Archive type: RAR SFX (self extracting)
--> m6.jpg
  0559.exe
   [DETECTION] Is the Trojan horse TR/Tiny.10240.A
   [INFO]    The file was deleted!
  0565.bmp
  0566.bmp
  0569.doc
   [DETECTION] Contains detection pattern of the exploits EXP/Office.D
   [INFO]    The file was moved to '473afda3.qua'!
  0570.dll
  0571.EXE
  0575.exe
  0577.sys
   [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Cdn.C
   [INFO]    The file was deleted!
  0579.ocx
  0582.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
   [INFO]    The file was deleted!
  0583.htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
   [INFO]    The file was moved to '473cfda3.qua'!
  0587.css

End of the scan: 2007年10月4日  07:49
Used time: 00:05 min

The scan has been done completely.

   1 Scanning directories
   35 Files were scanned
   7 viruses and/or unwanted programs were found
   2 Files were classified as suspicious:
   7 files were deleted
   0 files were repaired
   2 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   28 Files not concerned
   9 Archives were scanned
   0 Warnings
   0 Notes

[病毒样本] 费尔全死病毒样本第ㄧ包 26只

本帖子中包含更多资源

[病毒样本] 费尔全死病毒样本 第ㄧ包 26只

本帖子中包含更多资源

[病毒样本] 费尔全死病毒样本第ㄧ包 26只