刚才番茄花园论坛被挂的马[MD5: 1B0754 8406DF]

显示全部楼层 · 发表于 2007-10-13 16:24:24

kv

http://bbs.kafan.cn/attachment.php?aid=139167->newtemp.bak trojan/psw.gamepass.zfw 2007-10-13 下午 04:23:41 已删除

[ 本帖最后由 kp2006 于 2007-10-13 16:25 编辑 ]

显示全部楼层 · 发表于 2007-10-13 16:25:04

卡巴

已删除: 病毒 Worm.Win32.QQPass.ac 文件: F:\病毒样本\样本6.rar/NewTemp.bak//UPX//PEPatch
已删除: 病毒 Worm.Win32.QQPass.ac 文件: F:\病毒样本\样本6.rar/NewTemp.dll//PEPatch

显示全部楼层 · 发表于 2007-10-13 16:25:13

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\样本6.rar'
C:\Users\morgan\Documents\
  样本6.rar
  样本6.rar:Zone.Identifier
[0] Archive type: RAR
--> NewTemp.bak
      [DETECTION] Contains detection pattern of the worm WORM/QQpass.AC
      [WARNING] Infected files in archives cannot be repaired!
--> NewTemp.dll
      [DETECTION] Contains detection pattern of the worm WORM/QQpass.AC
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-10-13 16:26:45

蠕虫名称:Worm.Win32.QQPass.ch

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\NEWTEMP.BAK
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-10-13 16:28:48

Result: 2 malware found
Worm.Win32.QQPass.ac (virus)
C:\Users\Administrator\Desktop\Ñù±¾6.rar\NewTemp.bak
C:\Users\Administrator\Desktop\Ñù±¾6.rar\NewTemp.dll

显示全部楼层 · 发表于 2007-10-13 16:28:51

扫描进行于：2007-10-13 16:35:15
扫描日志
NOD32版本 2590 (20071012) NT
命令行： C:\Documents and Settings\Administrator\桌面\样本6.rar
C:\Program Files\Eset\nod32.exe - 是正常的
系统内存 - 是正常的
1 的MBR区.物理磁盘 - 是正常的
1 的启动引导区.物理磁盘 - 是正常的

日期： 13.10.2007 时间：16:36:02
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Administrator\桌面\样本6.rar
C:\Documents and Settings\Administrator\桌面\样本6.rar >>RAR >>NewTemp.bak - 可能是 Win32/PSW.Delf.NHI 木马的一个变种
C:\Documents and Settings\Administrator\桌面\样本6.rar >>RAR >>NewTemp.dll - 可能是 Win32/PSW.OnLineGames.NBR 木马的一个变种
已扫描的文件数目：2
已发现的病毒数目：2
完成时间： 16:36:03 总扫描时间：1 秒 (00:00:01)

又是盗号木马看来最近网页挂马趋势直线上升

显示全部楼层 · 发表于 2007-10-13 16:30:29

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.3.2
HC0.rlb = 2.9.1
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\样本\NewTemp.bak 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\样本\NewTemp.dll 检测到 Generic.nFile
检测到了 2 个未知的恶意程序，请上报。
任务扫描完成。共耗费的时间：0-00-00 00:00:00:0020，共扫描的文件数量：2，共扫描到的威胁数量：2，威胁率：100%，扫描速率： 100 文件/秒，扫描速度： 2279.49 千字节/秒，共扫描了 45.59 千字节。

显示全部楼层 · 发表于 2007-10-13 20:57:35

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\樣本'
C:\Documents and Settings\tim\桌面\樣本\欴掛6.rar
  [0] Archive type: RAR
  --> NewTemp.bak
   [DETECTION] Contains detection pattern of the worm WORM/QQpass.AC
  --> NewTemp.dll
   [DETECTION] Contains detection pattern of the worm WORM/QQpass.AC
   [INFO]    A backup was created as '47472450.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

End of the scan: Saturday, 13 October, 2007  20:57
Used time: 00:01 min

The scan has been done completely.

   1 Scanning directories
   4 Files were scanned
   2 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-10-13 22:06:56

C:\DOCUME~1\Martin\LOCALS~1\Temp\qvfs31ec.rar » RAR » NewTemp.bak probably a variant of Win32/PSW.Delf.NHI trojan
C:\DOCUME~1\Martin\LOCALS~1\Temp\qvfs31ec.rar » RAR » NewTemp.dll probably a variant of Win32/PSW.OnLineGames.NBR trojan

[病毒样本] 刚才番茄花园论坛被挂的马[MD5: 1B0754 8406DF]

本帖子中包含更多资源

EAV