10个样本附5.exe的仔

显示全部楼层 · 发表于 2007-10-21 12:31:48

C:\Desktop.rar\RUNTIME.SYS - infected with BackDoor.Bulknet
C:\Desktop.rar\IP6FW.SYS - infected with BackDoor.Bulknet

C:\New Folder/10.exe - infected with Trojan.Packed.149
C:\New Folder/2.exe - infected with Trojan.DownLoader.origin
C:\New Folder/5.exe - infected with Trojan.MulDrop.9341
C:\New Folder/6.exe - infected with Trojan.Packed.187

DRWEB Kill

显示全部楼层 · 发表于 2007-10-21 15:23:34

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 656
Paranoia Database - 48035
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\RUNTIME.SYS - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\DOSKEY.DLL - Suspected Trojan-Downloader.VB.1
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\IP6FW.SYS - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\1.exe - Suspected MalwareDetector:Generic.PSW.8
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\10.exe - Suspected Trojan-Downloader.Small.2
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\2.exe - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\3.exe - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\4.exe - Suspected MalwareDetector:Generic.PSW.1
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\5.exe - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\6.exe - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\7.exe - Suspected Trojan-Downloader.Small.2
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\8.exe - Suspected MalwareDetector:Generic.PSW.2
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\9.exe - Suspected Trojan-Downloader.Small.2

13 Files scanned
0 Infected files found
7 Suspected files found
0 Files cured
0 Files deleted

显示全部楼层 · 发表于 2007-10-21 15:26:56

晕死..那个Desktop里头的一个也没报

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.3.2
HC0.rlb = 2.9.1
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\New Folder\1.exe 检测到 Packed.Unknown.2b6e
[扫描] [Level 1] 在 C:\Documents and Settings\Administrator\桌面\样本\New Folder\2.exe 检测到 Generic.Virus
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\样本\New Folder\4.exe//UPX//Crypt1 检测到 Generic.Downloader
[扫描] [Level 1] 在 C:\Documents and Settings\Administrator\桌面\样本\New Folder\5.exe 检测到 Generic.Virus
[扫描] [Level 1] 在 C:\Documents and Settings\Administrator\桌面\样本\New Folder\6.exe 检测到 Generic.Virus
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\New Folder\8.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\New Folder\9.exe 检测到 Packed.Generic.UPX.Modified.1
检测到了 7 个未知的恶意程序，请上报。
任务扫描完成。共耗费的时间：0-00-00 00:00:00:0911，共扫描的文件数量：17，共扫描到的威胁数量：7，威胁率：41.18%，扫描速率： 18.66 文件/秒，扫描速度： 1569.89 千字节/秒，共扫描了 1430.17 千字节。

显示全部楼层 · 发表于 2007-10-21 17:06:49

我的红伞扫出来了，标了11个，郁闷说10个怎么成了11个了

显示全部楼层 · 发表于 2007-10-21 22:30:14

Start time: 10/21/2007 22:29
Engine(s): Engine A (KAV 17.7965), Engine B (BD 17.5018)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: 1.exe
Path: C:\Users\AJUN\Desktop\New_Folder\New Folder
Status: Virus, file deleted
Virus: Trojan-Downloader.Win32.Small.ges (Engine A)
Object: 10.exe
Path: C:\Users\AJUN\Desktop\New_Folder\New Folder
Status: Virus, file deleted
Virus: Trojan.Win32.Obfuscated.en (Engine A)
Object: 2.exe
Path: C:\Users\AJUN\Desktop\New_Folder\New Folder
Status: Virus, file deleted
Virus: Trojan-Downloader.Win32.Small.get (Engine A)
Object: (Quarantine-4)
In archive: C:\Users\AJUN\Desktop\New_Folder\New Folder\3.exe
Status: Virus detected
Virus: Trojan.DX (Engine B)
Object: 3.exe
Path: C:\Users\AJUN\Desktop\New_Folder\New Folder
Status: Virus, file deleted
Virus: Trojan.DX (Engine B)
Object: 4.exe
Path: C:\Users\AJUN\Desktop\New_Folder\New Folder
Status: Virus, file deleted
Virus: Trojan-PSW.Win32.Meger.b (Engine A)
Object: 5.exe
Path: C:\Users\AJUN\Desktop\New_Folder\New Folder
Status: Virus, file deleted
Virus: Trojan.Win32.Pakes.sb (Engine A)
Object: 6.exe
Path: C:\Users\AJUN\Desktop\New_Folder\New Folder
Status: Virus, file deleted
Virus: Packed.Win32.Tibs.cp (Engine A)
Object: 7.exe
Path: C:\Users\AJUN\Desktop\New_Folder\New Folder
Status: Virus, file deleted
Virus: Trojan.Win32.AddUser.i (Engine A)
Object: 8.exe
Path: C:\Users\AJUN\Desktop\New_Folder\New Folder
Status: Virus, file deleted
Virus: Trojan.Win32.Agent.cfg (Engine A)
Object: 9.exe
Path: C:\Users\AJUN\Desktop\New_Folder\New Folder
Status: Virus, file deleted
Virus: IM-Worm.Win32.Sohanad.cj (Engine A)
Analysis complete: 10/21/2007 22:29
10 files checked
10 infected files detected

显示全部楼层 · 发表于 2007-10-22 00:31:39

Desktop.rar (60.52 KB) 费尔

显示全部楼层 · 发表于 2007-10-22 00:32:04

Desktop.rar (60.52 KB) KV2008

显示全部楼层 · 发表于 2007-10-22 00:34:15

New Folder.zip (871.82 KB) 费尔

显示全部楼层 · 发表于 2007-10-22 00:34:52

New Folder.zip (871.82 KB) kv2008

显示全部楼层 · 发表于 2007-10-22 12:20:48

Start of the scan: Monday, 22 October, 2007  12:20

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\樣本'
C:\Documents and Settings\tim\桌面\樣本\Desktop.rar
  [0] Archive type: RAR
  --> RUNTIME.SYS
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.DPE.1
  --> DOSKEY.DLL
   [DETECTION] Is the Trojan horse TR/Agent.cfg.3
  --> IP6FW.SYS
   [DETECTION] Contains detection pattern of the rootkit RKIT/Ntech.I
   [INFO]    A backup was created as '478f2570.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
C:\Documents and Settings\tim\桌面\樣本\New_Folder.zip
  [0] Archive type: ZIP
  --> New Folder/1.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Small.AAFK.2
  --> New Folder/10.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
  --> New Folder/2.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> New Folder/3.exe
   [DETECTION] Is the Trojan horse TR/Agent.aox
  --> New Folder/4.exe
   [DETECTION] Is the Trojan horse TR/generic.26359
  --> New Folder/5.exe
   [DETECTION] Is the Trojan horse TR/Agent.CZP
  --> New Folder/6.exe
   [DETECTION] Contains detection pattern of the worm WORM/Storm.twa
  --> New Folder/7.exe
   [DETECTION] Is the Trojan horse TR/AddUser.I.19
  --> New Folder/8.exe
   [DETECTION] Is the Trojan horse TR/Agent.cfg.1
   [INFO]    A backup was created as '47932570.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

End of the scan: Monday, 22 October, 2007  12:20
Used time: 00:05 min

The scan has been done completely.

   1 Scanning directories
   17 Files were scanned
   12 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   2 files were deleted
   0 files were repaired
   2 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   5 Files not concerned
   2 Archives were scanned
   0 Warnings
   0 Notes

[病毒样本] 10个样本附5.exe的仔

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

[病毒样本] 10个样本 附5.exe的仔

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

[病毒样本] 10个样本附5.exe的仔