木马群38个

显示全部楼层 · 发表于 2007-11-17 14:32:21

http://1.xqhgm.com/1.exe................
http://1.xqhgm.com/24.exe

显示全部楼层 · 发表于 2007-11-17 14:34:37

Starting the file scan:

Begin scan in 'E:\样本.rar'
E:\样本.rar
  [0] Archive type: RAR
  --> Buik01.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> AVPSrv.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> asview32.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hnt
  --> pcihdd.sys
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
  --> 24.exe
   [DETECTION] Contains detection pattern of the dropper DR/Agent.318861
   [1] Archive type: RAR SFX (self extracting)
   --> Vml.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 23.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
  --> 21.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 20.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 19.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 18.exe
   [DETECTION] Is the Trojan horse TR/PSW.Onlineg.KC.2
  --> 17.exe
   [DETECTION] Is the Trojan horse TR/PSW.Onlineg.KC.2
  --> 15.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hqq
  --> 14.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 13.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 12.exe
   [DETECTION] Is the Trojan horse TR/PSW.QQpass.als
  --> 11.exe
   [DETECTION] Is the Trojan horse TR/CrashSystem.C
  --> 10.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 9.exe
   [DETECTION] Is the Trojan horse TR/CrashSystem.C
  --> 8.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 7.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 6.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 5.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hxi
  --> 4.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 2.exe
   [DETECTION] Is the Trojan horse TR/PSW.Nilage.bty.7
  --> Wn_Sys8x.Sys
   [DETECTION] Is the Trojan horse TR/PSW.QQpass.als
  --> 608769WL.DLL
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> Vml.exe
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> SVCCtrl01.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> SQLLink01.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> ProcSvr01.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> LotusHlp.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> KVBatch01.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> joubjptyej.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hnt
  --> DVBBack01.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> DbgHlp32.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hqq
  --> cmdbcs.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was deleted!

End of the scan: 2007年11月17日  14:34
Used time: 00:34 min

The scan has been done completely.

   0 Scanning directories
   47 Files were scanned
   24 viruses and/or unwanted programs were found
   13 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   23 Files not concerned
   2 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-11-17 14:35:42

似乎差一个

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.5.5
HC0.rlb = 3.1.0
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>10.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>11.exe 检测到 Packed.Generic.Modified
[扫描] [捆绑检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>12.exe//UPX 检测到 Generic.Binder
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>13.exe 检测到 Packed.Unknown.2b6e
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>14.exe 检测到 Packed.Unknown.2b6e
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>15.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>17.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>18.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>19.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>2.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>20.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>21.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>23.exe 检测到 Packed.Unknown.c6e7
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>24.exe//RAR_DATA.rar>>3.vbs 检测到 Script.Runner
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>24.exe//RAR_DATA.rar>>Vml.exe 检测到 Packed.Unknown.c6b9
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>4.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>5.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>6.exe 检测到 Packed.Generic.Modified
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>608769WL.DLL 检测到 Trojan.WOW.wu
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>7.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>8.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>9.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>asview32.dll 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>AVPSrv.dll 检测到 Packed.Unknown.ca53
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>Buik01.dll 检测到 Generic.nFile
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>cmdbcs.dll 检测到 Packed.Unknown.ca53
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>DbgHlp32.dll 检测到 Packed.Unknown.ca53
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>DVBBack01.dll 检测到 Generic.nFile
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>joubjptyej.dll 检测到 Packed.Generic.UPack
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>KVBatch01.dll 检测到 Generic.nFile
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>LotusHlp.dll 检测到 Packed.Unknown.ca53
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>pcihdd.sys 检测到 Downloader.Agent.blm
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>ProcSvr01.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>SafeCtrl01.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>SQLLink01.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>SVCCtrl01.dll 检测到 Generic.nFile
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>Vml.exe 检测到 Packed.Unknown.c6b9
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\样本.rar>>Wn_Sys8x.Sys 检测到 Generic.nFile
检测到了 35 个未知的恶意程序，请上报。
任务扫描完成。共耗费的时间：0-00-00 00:00:04:0536，共扫描的文件数量：48，共扫描到的威胁数量：38，威胁率：79.17%，扫描速率： 10.58 文件/秒，扫描速度： 645.59 千字节/秒，共扫描了 2928.38 千字节。

显示全部楼层 · 发表于 2007-11-17 14:36:23

检测到：38
未处理：36

检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hye 文件　: F:\du\样本.rar/Buik01.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.iad 文件　: F:\du\样本.rar/AVPSrv.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hnt 文件　: F:\du\样本.rar/asview32.dll//FSG
检测到：木马程序 Trojan-Downloader.Win32.Agent.blm 文件　: F:\du\样本.rar/pcihdd.sys
检测到：风险软件 not-a-virus:NetTool.Win32.Agent.b 文件　: F:\du\样本.rar/24.exe//data.rar/Vml.exe
检测到：木马程序 Trojan.BAT.Agent.be 文件　: F:\du\样本.rar/24.exe//data.rar/run.bat
检测到：木马程序 Trojan-Downloader.Win32.Agent.blm 文件　: F:\du\样本.rar/23.exe
检测到：木马程序 Trojan-PSW.Win32.Nilage.bty 文件　: F:\du\样本.rar/21.exe//PE_Patch//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hrb 文件　: F:\du\样本.rar/20.exe//PE_Patch//UPack
未发现：木马程序 Trojan-PSW.Win32.OnLineGames.hqt 文件　: F:\du\样本.rar/20.exe//PE_Patch//UPack//#
检测到：木马程序 Trojan-PSW.Win32.Nilage.bty 文件　: F:\du\样本.rar/19.exe//PE_Patch//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hqh 文件　: F:\du\样本.rar/18.exe
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hqh 文件　: F:\du\样本.rar/17.exe
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hre 文件　: F:\du\样本.rar/15.exe//PE_Patch//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hfr 文件　: F:\du\样本.rar/14.exe//ASPack
检测到：木马程序 Trojan-PSW.Win32.Lmir.bov 文件　: F:\du\样本.rar/13.exe//ASPack
检测到：木马程序 Trojan-PSW.Win32.QQPass.als 文件　: F:\du\样本.rar/12.exe//UPX
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hqh 文件　: F:\du\样本.rar/11.exe
检测到：病毒 Heur.Invader (修改) 文件　: F:\du\样本.rar/10.exe//PE_Patch//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hqh 文件　: F:\du\样本.rar/9.exe
检测到：木马程序 Trojan-PSW.Win32.Nilage.bty 文件　: F:\du\样本.rar/8.exe//PE_Patch//UPack
检测到：木马程序 Trojan-PSW.Win32.Nilage.bty 文件　: F:\du\样本.rar/7.exe//PE_Patch//UPack
未发现：木马程序 Trojan-PSW.Win32.OnLineGames.hhn 文件　: F:\du\样本.rar/6.exe//PE_Patch//UPack//#
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hxi 文件　: F:\du\样本.rar/5.exe//PE_Patch//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hyk 文件　: F:\du\样本.rar/4.exe//PE_Patch//UPack//#
检测到：木马程序 Trojan-PSW.Win32.Nilage.bty 文件　: F:\du\样本.rar/2.exe//PE_Patch//UPack
检测到：木马程序 Trojan-PSW.Win32.QQPass.als 文件　: F:\du\样本.rar/Wn_Sys8x.Sys
检测到：风险软件 not-a-virus:NetTool.Win32.Agent.b 文件　: F:\du\样本.rar/Vml.exe
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hys 文件　: F:\du\样本.rar/SVCCtrl01.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hyr 文件　: F:\du\样本.rar/SQLLink01.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hyk 文件　: F:\du\样本.rar/SafeCtrl01.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hyi 文件　: F:\du\样本.rar/ProcSvr01.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hzt 文件　: F:\du\样本.rar/LotusHlp.dll
检测到：木马程序 Trojan-PSW.Win32.Nilage.bue 文件　: F:\du\样本.rar/KVBatch01.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hnt 文件　: F:\du\样本.rar/joubjptyej.dll//UPack//PE_Patch.MaskPE
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hyf 文件　: F:\du\样本.rar/DVBBack01.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hqq 文件　: F:\du\样本.rar/DbgHlp32.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hho 文件　: f:\du\样本.rar/6.exe//PE_Patch//UPack//PE_Patch

显示全部楼层 · 发表于 2007-11-17 14:37:32

nod37个

显示全部楼层 · 发表于 2007-11-17 14:37:54

F:\样本.rar » RAR » Buik01.dll - Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » AVPSrv.dll - Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » asview32.dll - a variant of Win32/PSW.OnLineGames.GJV trojan
F:\样本.rar » RAR » pcihdd.sys - Win32/TrojanDownloader.Agent.BLM trojan
F:\样本.rar » RAR » 24.exe » RAR » Vml.exe - Win32/NetTool.Agent.B application
F:\样本.rar » RAR » 23.exe - a variant of Win32/Agent.NLW trojan
F:\样本.rar » RAR » 21.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » 20.exe - Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » 19.exe - a variant of Win32/PSW.OnLineGames.HCV trojan
F:\样本.rar » RAR » 18.exe - probably a variant of Win32/PSW.OnLineGames.NGU trojan
F:\样本.rar » RAR » 17.exe - Win32/PSW.OnLineGames.NGU trojan
F:\样本.rar » RAR » 15.exe - Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » 14.exe - Win32/PSW.WOW.WU trojan
F:\样本.rar » RAR » 13.exe - Win32/PSW.WOW.WU trojan
F:\样本.rar » RAR » 12.exe - probably a variant of Win32/AutoRun.Q worm
F:\样本.rar » RAR » 11.exe - Win32/PSW.OnLineGames.NGU trojan
F:\样本.rar » RAR » 10.exe - a variant of Win32/PSW.OnLineGames.YA trojan
F:\样本.rar » RAR » 9.exe - probably a variant of Win32/PSW.OnLineGames.NGU trojan
F:\样本.rar » RAR » 8.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » 7.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » 6.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » 5.exe - probably a variant of Win32/Genetik trojan
F:\样本.rar » RAR » 4.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » 2.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » Wn_Sys8x.Sys - probably a variant of Win32/AutoRun.Q worm
F:\样本.rar » RAR » 608769WL.DLL - Win32/PSW.Legendmir.NFN trojan
F:\样本.rar » RAR » Vml.exe - Win32/NetTool.Agent.B application
F:\样本.rar » RAR » SVCCtrl01.dll - Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » SQLLink01.dll - Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » SafeCtrl01.dll - probably a variant of Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » ProcSvr01.dll - Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » LotusHlp.dll - Win32/PSW.OnLineGames.HCV trojan
F:\样本.rar » RAR » KVBatch01.dll - Win32/PSW.OnLineGames.NII trojan
F:\样本.rar » RAR » joubjptyej.dll - Win32/PSW.OnLineGames.GJV trojan
F:\样本.rar » RAR » DVBBack01.dll - Win32/PSW.OnLineGames.HCV trojan
F:\样本.rar » RAR » DbgHlp32.dll - Win32/PSW.OnLineGames.NFL trojan
F:\样本.rar » RAR » cmdbcs.dll - probably a variant of Win32/PSW.OnLineGames.NFL trojan

显示全部楼层 · 发表于 2007-11-17 14:38:53

每次都差一个。。
火大。。

显示全部楼层 · 发表于 2007-11-17 14:40:31

npptools.dll 不是病毒

显示全部楼层 · 发表于 2007-11-17 14:43:28

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameOnline.agr
病毒： Trojan.PSW.Win32.SO2Game.d
病毒： Trojan.PSW.Win32.WoWar.aez
病毒： RootKit.Win32.Paice.a
病毒： Trojan.Win32.Agent.vmq
病毒： Trojan.DL.Win32.Agent.yrh
病毒： Trojan.PSW.Win32.GameOnline.aen
病毒： Trojan.PSW.Win32.GameOnline.adh
病毒： Trojan.PSW.Win32.GameOnline.agj
病毒： Trojan.PSW.Win32.DJOnline.as
病毒： Trojan.PSW.Win32.GameOnline.adp
病毒： Trojan.PSW.Win32.Woool.c
病毒： Trojan.PSW.Win32.WoWar.uz
病毒： Worm.Win32.PaBug.dq
病毒： Trojan.PSW.Win32.SunOnline.fy
病毒： Trojan.PSW.Win32.SO2Online.n
病毒： Worm.Win32.PaBug.dn
病毒： Trojan.PSW.Win32.Woool.c
病毒： Trojan.PSW.Win32.GameOnline.afu
病毒： Trojan.PSW.Win32.GameOnline.aeq
病毒： Trojan.PSW.Win32.GameOnline.afs
病毒： Trojan.PSW.Win32.GameOnline.add
病毒： Trojan.PSW.Win32.GameOnline.aem
病毒： Trojan.PSW.Win32.WoWar.aez
病毒： Trojan.PSW.Win32.GameOnline.aeo
病毒： Trojan.PSW.Win32.GameOnline.adc

显示全部楼层 · 发表于 2007-11-17 15:03:44

小A很好，很强大！

2007-11-17 15:00:36 SYSTEM 1300 Sign of "Win32:Nilage-JY [Trj]" has been found in "http://bbs.kafan.cn/attachment.php?aid=154268\Buik01.dll" file.

[ 本帖最后由斯太尔于 2007-11-17 15:07 编辑 ]

[病毒样本] 木马群38个

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块