毒来了(样本)

显示全部楼层 · 发表于 2007-10-21 16:06:59

扫扫看

显示全部楼层 · 发表于 2007-10-21 16:20:15

检测到：木马程序 Trojan-PSW.Win32.OnLineGames.flj URL: http://bbs.kafan.cn/attachment.php?aid=142066//KVDXEIS.EXE//UPack

显示全部楼层 · 发表于 2007-10-21 16:21:33

费尔10个

显示全部楼层 · 发表于 2007-10-21 16:33:44

全杀

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.3.2
HC0.rlb = 2.9.1
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\样本\AUTORUN.EXE 检测到 Generic.nFile
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\AVWLCST.EXE 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\AVZXEST.EXE 检测到 Packed.Generic.UPack
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\样本\CAOMSNIMA.DLL 检测到 Generic.nFile
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\KAPJBAZ.EXE 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\KVDXEIS.EXE 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\KVDXSCIS.EXE 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\KVMXFIS.EXE 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\QQ.exe//UPX 检测到 Packed.Unknown.3054
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\RAQJCTL.EXE 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\RATBFTL.EXE 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\RSMYFSP.EXE 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\RSZTSASP.EXE 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\样本\SIDJAAZ.EXE 检测到 Packed.Generic.UPack
检测到了 14 个未知的恶意程序，请上报。
任务扫描完成。共耗费的时间：0-00-00 00:00:00:0580，共扫描的文件数量：15，共扫描到的威胁数量：14，威胁率：93.33%，扫描速率： 25.86 文件/秒，扫描速度： 482.97 千字节/秒，共扫描了 280.12 千字节。

显示全部楼层 · 发表于 2007-10-21 16:34:41

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\KVDXEIS.EXE]
                  …………发现Spy！报告:[1]
文件信息:  大小:14448  MD5:9279c4a8570c58a4fa19a0bb0fdf5d49

[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\KVDXSCIS.EXE]
                  …………发现Spy！报告:[2] [1]
文件信息:  大小:13917  MD5:ec2f02ca5aa91ddda854ef48beced71d

[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\KVMXFIS.EXE]
                  …………发现Spy！报告:[1]
文件信息:  大小:14418  MD5:7e4fc08afff86f93f07f8f2c5954880f

[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\QQ.exe]
                  …………发现Spy！报告:[5] 下载者
文件信息:  大小:38508  MD5:fc0f0e68a128ddc28c4461f21629528d

[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\RAQJCTL.EXE]
                  …………发现Spy！报告:[2] [1]
文件信息:  大小:14789  MD5:143960e96567ad065d258a4293160773

[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\RATBFTL.EXE]
                  …………发现Spy！报告:[1]
文件信息:  大小:13900  MD5:375df513383c82cf9645571aa2619eb4

[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\RSMYFSP.EXE]
                  …………发现Spy！报告:[1]
文件信息:  大小:15115  MD5:5e3097069e7b55005e695df799db396d

[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\RSZTSASP.EXE]
                  …………发现Spy！报告:[2] [1]
文件信息:  大小:13485  MD5:26433020664fc1dc4097afa5662990d2

[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\SIDJAAZ.EXE]
                  …………发现Spy！报告:[2] [1]
文件信息:  大小:13453  MD5:56bc46182cf20ac6e610cd4c1fedbe14

[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\AUTORUN.EXE]
                  …………发现Spy！报告: [4] [2]
文件信息:  大小:32370  MD5:ece2b28586bdaddb146beb9227ea541d

[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\AVWLCST.EXE]
                  …………发现Spy！报告:[1]
文件信息:  大小:14995  MD5:61aad4615d0710f774fc96a3f3520381

[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\AVZXEST.EXE]
                  …………发现Spy！报告:[1]
文件信息:  大小:15168  MD5:9f213bea6d57ca57c544a547b50c0ada

[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\CAOMSNIMA.DLL]
                  …………发现Spy！报告: [4] [1]
文件信息:  大小:7733  MD5:0562f33c6b5ceb6bf26b3972115ae993

[C:\Documents and Settings\Administrator\桌面\Virus\SYSTEM32\KAPJBAZ.EXE]
                  …………发现Spy！报告:[1]
文件信息:  大小:14260  MD5:da822eaf9517fc94f834d0a64a6d392e

文件数:14 病毒数:14  比重:1
OK  扫描完毕！
  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

显示全部楼层 · 发表于 2007-10-21 16:35:14

C:\SYSTEM32.rar\KVDXEIS.EXE - infected with Trojan.PWS.Gamania.5237
C:\SYSTEM32.rar\KVDXSCIS.EXE - infected with Trojan.PWS.Gamania.5202
C:\SYSTEM32.rar\KVMXFIS.EXE - infected with Trojan.PWS.Gamania.5237
C:\SYSTEM32.rar\QQ.exe - infected with Trojan.DownLoader.origin
C:\SYSTEM32.rar\RAQJCTL.EXE - infected with Trojan.PWS.Gamania.origin
C:\SYSTEM32.rar\RATBFTL.EXE - infected with Trojan.PWS.Gamania.5198
C:\SYSTEM32.rar\RSMYFSP.EXE - infected with Trojan.PWS.Gamania.5285
C:\SYSTEM32.rar\RSZTSASP.EXE - infected with Trojan.PWS.Gamania.5124
C:\SYSTEM32.rar\SIDJAAZ.EXE - infected with Trojan.PWS.Gamania.5228
C:\SYSTEM32.rar\AUTORUN.EXE - infected with Trojan.PWS.Qqpass.1478
C:\SYSTEM32.rar\AVWLCST.EXE - infected with Trojan.PWS.Gamania.5284
C:\SYSTEM32.rar\AVZXEST.EXE - infected with Trojan.PWS.Gamania.5284
C:\SYSTEM32.rar\CAOMSNIMA.DLL - infected with Trojan.PWS.Gamania.5236
C:\SYSTEM32.rar\KAPJBAZ.EXE - infected with Trojan.PWS.Gamania.5224

Archive contains 14 infected items

DRWEB 4.44 All Kill

显示全部楼层 · 发表于 2007-10-21 16:43:21

我用小红伞扫到了14个，不知道怎么样

显示全部楼层 · 发表于 2007-10-21 16:43:55

通杀……
Start of the scan: 2007年10月21日  16:43

Starting the file scan:

Begin scan in 'C:\Downloads\SYSTEM32.rar'
C:\Downloads\SYSTEM32.rar
  [0] Archive type: RAR
  --> KVDXEIS.EXE
   [DETECTION] Is the Trojan horse TR/FWDisable.21064
  --> KVDXSCIS.EXE
   [DETECTION] Is the Trojan horse TR/Spy.Delf.anh
  --> KVMXFIS.EXE
   [DETECTION] Is the Trojan horse TR/FWDisable.20560
  --> QQ.exe
   [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> RAQJCTL.EXE
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> RATBFTL.EXE
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fdy.1
  --> RSMYFSP.EXE
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> RSZTSASP.EXE
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.dki
  --> SIDJAAZ.EXE
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fbt
  --> AUTORUN.EXE
   [DETECTION] Is the Trojan horse TR/PSW.Steal.45186
  --> AVWLCST.EXE
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> AVZXEST.EXE
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> CAOMSNIMA.DLL
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fho
  --> KAPJBAZ.EXE
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fgd
   [INFO]    A backup was created as '476e119c.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

End of the scan: 2007年10月21日  16:43
Used time: 00:09 min

显示全部楼层 · 发表于 2007-10-21 16:47:10

deleted: Trojan program Trojan-PSW.Win32.OnLineGames.flj File: C:\Users\Administrator\Desktop\SYSTEM32.rar/KVDXEIS.EXE//UPack
deleted: Trojan program Trojan-Spy.Win32.Delf.anh File: C:\Users\Administrator\Desktop\SYSTEM32.rar/KVDXSCIS.EXE//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.flj File: C:\Users\Administrator\Desktop\SYSTEM32.rar/KVMXFIS.EXE//UPack
deleted: Trojan program Trojan-PSW.Win32.Delf.afn File: C:\Users\Administrator\Desktop\SYSTEM32.rar/QQ.exe//PE_Patch.UPX//UPX//PE_Patch.MaskPE
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.fqg File: C:\Users\Administrator\Desktop\SYSTEM32.rar/RAQJCTL.EXE//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.fdy File: C:\Users\Administrator\Desktop\SYSTEM32.rar/RATBFTL.EXE//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.fmr File: C:\Users\Administrator\Desktop\SYSTEM32.rar/RSMYFSP.EXE//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.dki File: C:\Users\Administrator\Desktop\SYSTEM32.rar/RSZTSASP.EXE//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.fbt File: C:\Users\Administrator\Desktop\SYSTEM32.rar/SIDJAAZ.EXE//UPack
deleted: Trojan program Trojan-PSW.Win32.QQPass.aic File: C:\Users\Administrator\Desktop\SYSTEM32.rar/AUTORUN.EXE//UPX
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.flj File: C:\Users\Administrator\Desktop\SYSTEM32.rar/AVWLCST.EXE//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.flj File: C:\Users\Administrator\Desktop\SYSTEM32.rar/AVZXEST.EXE//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.fho File: C:\Users\Administrator\Desktop\SYSTEM32.rar/CAOMSNIMA.DLL//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.fgd File: C:\Users\Administrator\Desktop\SYSTEM32.rar/KAPJBAZ.EXE//UPack

显示全部楼层 · 发表于 2007-10-21 16:48:24

Start of the scan: 2007年10月21日  16:47

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\Desktop\SYSTEM32.rar'
C:\Documents and Settings\Administrator\Desktop\SYSTEM32.rar
  [0] Archive type: RAR
  --> KVDXEIS.EXE
   [DETECTION] Is the Trojan horse TR/FWDisable.21064
  --> KVDXSCIS.EXE
   [DETECTION] Is the Trojan horse TR/Spy.Delf.anh
  --> KVMXFIS.EXE
   [DETECTION] Is the Trojan horse TR/FWDisable.20560
  --> QQ.exe
   [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> RAQJCTL.EXE
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> RATBFTL.EXE
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fdy.1
  --> RSMYFSP.EXE
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> RSZTSASP.EXE
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.dki
  --> SIDJAAZ.EXE
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fbt
  --> AUTORUN.EXE
   [DETECTION] Is the Trojan horse TR/PSW.Steal.45186
  --> AVWLCST.EXE
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> AVZXEST.EXE
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> CAOMSNIMA.DLL
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fho
  --> KAPJBAZ.EXE
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fgd
   [INFO]    A backup was created as '476e1298.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

[病毒样本] 毒来了(样本)

本帖子中包含更多资源