7个相关，貌似是美国的东西[MD5: 697208 74FC48 266372 BBB9E0 8EDC71 33B611 907763]

promised

http://bbs.kafan.cn/viewthread.php?tid=145680&extra=page%3D1

[ 本帖最后由 promised 于 2007-10-19 22:40 编辑 ]

欠妳緈諨

反病毒专家 AntiVirusKit 2006 扫描病毒日志记录
版本 16.0.5
双引擎反病毒签名 2008-8-8
开始时间: 2007-10-19 22:09
引擎: KAV 引擎 (AVK 18.888), BD 引擎 (BD 18.888)
高启发式: 打开
压缩文件: 打开
系统区域: 关闭

扫描所选择的目录和文件...
对象: tsitra.exe.bin tsitra.exe
        在压缩档案里: D:\病毒测试\未解压样本\样本1.rar
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Agent.ecz (KAV 引擎)
对象: mmspool.exe
        在压缩档案里: D:\病毒测试\未解压样本\样本1.rar
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Agent.ecl (KAV 引擎)
对象: mmmspool.exe
        在压缩档案里: D:\病毒测试\未解压样本\样本1.rar
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Agent.eck (KAV 引擎)
对象: tsitra565.exe
        在压缩档案里: D:\病毒测试\未解压样本\样本1.rar
        Status: 已发现病毒
        病毒: Trojan-Downloader.Win32.Agent.ecz (KAV 引擎)
4virus  was  found!

Nerazzurri

C:\Documents and Settings\Deepin\桌面\样本1.rar >>RAR >>tsitra.exe.bin >>ZIP >>tsitra.exe - Win32/TrojanDownloader.Agent.BLS 木马的变种
C:\Documents and Settings\Deepin\桌面\样本1.rar >>RAR >>tsitra565.exe - Win32/TrojanDownloader.Agent.BLS 木马的变种
=====================================================
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Deepin\桌面\样本1.rar'
C:\Documents and Settings\Deepin\桌面\样本1.rar
  [0] Archive type: RAR
  --> mmbin.exe
      [DETECTION] Is the Trojan horse TR/Delf.NGX
    --> tsitra.exe.bin
      [1] Archive type: ZIP
      --> tsitra.exe
          [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> mmspool.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.ecl
  --> mmmspool.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eck
  --> tsitra565.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!

欠妳緈諨

AVAST0个

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\MMALL.EXE
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\MMALL.EXE
是否删除病毒程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\MMMSPOOL.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\MMSPOOL.EXE
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\MMSPOOL.EXE
是否删除病毒程序及其衍生物?b
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\MMBIN.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:3795
远端地址:208.72.172.132(美国)
远端端口:3129

上报2个

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.Agent.ecz        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾11.rar/tsitra.exe.bin/tsitra.exe//PE_Patch.Upolyx//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Downloader.Win32.Agent.ecl        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾11.rar/mmspool.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Downloader.Win32.Agent.eck        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾11.rar/mmmspool.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Downloader.Win32.Agent.ecz        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾11.rar/tsitra565.exe//PE_Patch.Upolyx//PE_Patch.UPX//UPX

yurius

symantec 2个 Downloader

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 600
Paranoia Database - 40890
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\mmbin.exe - Suspected MalwareDetector:Win32.Generic.PSW.1
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\tsitra.exe.bin - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\mmspool.exe - Suspected Trojan-Downloader.VB.1
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\mmall.exe - Infected Generic.Malware.21504.5b8
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\mmmspool.exe - Suspected Trojan-Downloader.VB.1
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\tsitra565.exe - Infected Trojan-Downloader.Agent.12
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\msclib.dll - Suspected Trojan-Downloader.Small.2

7 Files scanned
2 Infected files found
4 Suspected files found
0 Files cured
2 Files deleted

kk12

费尔 0

kk12

kv2008 0