来个暗藏杀机的数字证书

显示全部楼层 · 发表于 2007-10-23 10:16:55

的确是数字证书,改成文本格式就能看到你想要的

里面品种很多,ARP病毒\盗号木马都有

PS:机器狗带来的,改写userinit.exe..好像是个变种

机器狗就不发了

:-)

显示全部楼层 · 发表于 2007-10-23 10:28:33

http://rrr.jopenkk.com/game/114.exe

http://rrr.jopenkk.com/game/dogdel.exe
这两个失效了

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\TDDOWNLOAD.rar'
C:\Users\morgan\Documents\
  TDDOWNLOAD.rar
[0] Archive type: RAR
--> hosts.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 100.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQpass.ahp
      [WARNING] Infected files in archives cannot be repaired!
--> 101.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 102.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fei
      [WARNING] Infected files in archives cannot be repaired!
--> 103.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 104.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 105.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 106.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fnp
      [WARNING] Infected files in archives cannot be repaired!
--> 107.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 108.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 109.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fnn
      [WARNING] Infected files in archives cannot be repaired!
--> 110.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ezx.2
      [WARNING] Infected files in archives cannot be repaired!
--> 111.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> 112.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fnl
      [WARNING] Infected files in archives cannot be repaired!
--> 113.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
      [WARNING] Infected files in archives cannot be repaired!
--> arpkk.exe
      [1] Archive type: RAR SFX (self extracting)
      --> wpcap.dll
      --> npptools.dll
      --> 3.vbs
      --> drivers\npf.sys
      --> Vml.exe
         [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
         [WARNING] Infected files in archives cannot be repaired!
      --> Packet.dll
      --> run.bat
      --> WanPacket.dll
      [WARNING] The file was ignored!

End of the scan: 2007年10月22日  19:27
Used time: 00:05 min

The scan has been done completely.

   0 Scanning directories
   25 Files were scanned
   16 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   9 Files not concerned
   2 Archives were scanned
   17 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-10-23 10:39:34

小A

显示全部楼层 · 发表于 2007-10-23 10:44:45

symantec 15个

显示全部楼层 · 发表于 2007-10-23 10:57:31

Result: 14 malware found
Trojan-Downloader.Win32.Delf.aas (virus)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\hosts.exe
Trojan-PSW.Win32.QQGame.ao (virus)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\100.exe
Trojan-PSW.Win32.OnLineGames.fmd (virus)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\101.exe
Trojan-PSW.Win32.OnLineGames.fei (virus)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\102.exe
Trojan-PSW.Win32.OnLineGames.fda (virus)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\103.exe
Trojan-PSW.Win32.OnLineGames.fmp (virus)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\104.exe
Trojan-PSW.Win32.OnLineGames.fbo (virus)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\105.exe
Trojan-PSW.Win32.OnLineGames.fnp (virus)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\106.exe
Trojan-PSW.Win32.OnLineGames.ffe (virus)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\107.exe
Trojan-PSW.Win32.OnLineGames.ftr (virus)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\108.exe
Trojan-PSW.Win32.OnLineGames.fnn (virus)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\109.exe
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\112.exe
Trojan-PSW.Win32.OnLineGames.fbm (virus)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\110.exe
Trojan-PSW.Win32.OnLineGames.fwx (virus)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\111.exe

Riskware found
NetTool.Win32.Agent.b (riskware)
C:\Users\Administrator\Desktop\TDDOWNLOAD.rar\arpkk.exe

14个可疑1个

显示全部楼层 · 发表于 2007-10-23 11:09:58

可怜的咖啡，7个

C:\virus\TDDOWNLOAD.rar\100.EXE\100.EXE\0000b4f8.EXE PWS-QQGame(特洛伊)
C:\virus\TDDOWNLOAD.rar\102.EXE\102.EXE\00007760.EXE PWS-OnlineGames.n(特洛伊)
C:\virus\TDDOWNLOAD.rar\102.EXE\102.EXE\00006090.EXE\00006090.EXE PWS-OnlineGames.j(特洛伊)
C:\virus\TDDOWNLOAD.rar\106.EXE\106.EXE\00007090.EXE\00007090.EXE PWS-OnlineGames.j(特洛伊)
C:\virus\TDDOWNLOAD.rar\112.EXE\112.EXE\00007090.EXE\00007090.EXE PWS-OnlineGames.j(特洛伊)
C:\virus\TDDOWNLOAD.rar\113.EXE\113.EXE\00006090.EXE\00006090.EXE PWS-WoW(特洛伊)
C:\virus\TDDOWNLOAD.rar\ARPKK.EXE\VML.EXE BackDoor-AWQ(特洛伊)

显示全部楼层 · 发表于 2007-10-23 11:18:06

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\100.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NYSWIN75.JMP
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NINSYS74.SYS
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\101.EXE
木马程序生成以下文件:
1) C:\WINDOWS\NVDISPDRV.EXE
2) C:\WINDOWS\SYSTEM32\NVDISPDRV.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\102.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SQMAPI32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\103.EXE
木马程序生成以下文件:
1) C:\WINDOWS\GENPROTECT.EXE
2) C:\WINDOWS\SYSTEM32\GENPROTECT.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\104.EXE
木马程序生成以下文件:
1) C:\WINDOWS\WINFORM.EXE
2) C:\WINDOWS\SYSTEM32\WINFORM.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\105.EXE
木马程序生成以下文件:
1) C:\WINDOWS\UPXDND.EXE
2) C:\WINDOWS\SYSTEM32\UPXDND.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\106.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\107.EXE
木马程序生成以下文件:
1) C:\WINDOWS\MSIMMS32.EXE
2) C:\WINDOWS\SYSTEM32\MSIMMS32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\108.EXE
木马程序生成以下文件:
1) C:\WINDOWS\AVPSRV.EXE
2) C:\WINDOWS\SYSTEM32\AVPSRV.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\109.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\110.EXE
木马程序生成以下文件:
1) C:\WINDOWS\CMDBCS.EXE
2) C:\WINDOWS\SYSTEM32\CMDBCS.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\111.EXE
木马程序生成以下文件:
1) C:\WINDOWS\KVSC3.EXE
2) C:\WINDOWS\SYSTEM32\KVSC3.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\112.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\113.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARPKK.EXE
被修改文件:
C:\WINDOWS\SYSTEM32\NPPTOOLS.DLL
是否阻止文件被修改?

显示全部楼层 · 发表于 2007-10-23 12:38:11

全是病毒网址！

显示全部楼层 · 发表于 2007-10-23 12:40:15

这个有证书后缀的非证书文件是某毒的生产物吧，记得上次看到类似的东西

显示全部楼层 · 发表于 2007-10-23 19:52:08

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Delf.xxb
病毒： Worm.Win32.PaBug.bc
病毒： Trojan.PSW.Win32.GameOnline.ew
病毒： Trojan.PSW.Win32.DJOnline.x
病毒： Trojan.PSW.Win32.OnlineGames.zzm
病毒： Trojan.PSW.Win32.WsGame.az
病毒： Trojan.PSW.Win32.OnlineGames.zyr
病毒： Trojan.PSW.Win32.GameOnline.ff
病毒： Trojan.PSW.Win32.OnlineGames.zzy
病毒： Trojan.PSW.Win32.GameOnline.fa
病毒： Trojan.PSW.Win32.OnlineGames.zzp
病毒： Trojan.PSW.Win32.WsGame.ay
病毒： Trojan.PSW.Win32.WoWar.acy
病毒： Trojan.Win32.Agent.vmq

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.15.12

[病毒样本] 来个暗藏杀机的数字证书

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

40/16