[病毒样本] 27x

显示全部楼层 · 发表于 2007-11-19 22:00:39

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 939
Paranoia Database - 48881
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\桌面

C:\Documents and Settings\Uhthn\Desktop\桌面\Setup.exe - Suspected TROJAN-DOWNLOADER (HTTP://{REMOVED}/...)
C:\Documents and Settings\Uhthn\Desktop\桌面\0.exe - Infected TROJAN.KILLAV.2 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\1.exe - Infected TROJAN-PSW.ONLINEGAMES.U - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\2.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\3.exe - Suspected MaliciousScope:GENERIC.MALWARE.4
C:\Documents and Settings\Uhthn\Desktop\桌面\4.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\5.exe - Infected MaliciousScope:TROJAN-PSW.GAME.35 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\6.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\桌面\7.exe - Infected TROJAN-DOWNLOADER.DELF.18 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\8.exe - Suspected MaliciousScope:GENERIC.MALWARE.4
C:\Documents and Settings\Uhthn\Desktop\桌面\9.exe - Suspected MaliciousScope:GENERIC.MALWARE.4
C:\Documents and Settings\Uhthn\Desktop\桌面\10.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\11.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\12.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\13.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\14.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\15.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\16.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\17.exe - Infected MaliciousScope:GENERIC.MALWARE.0DA.48C4 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\18.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\19.exe - Infected MaliciousScope:GENERIC.MALWARE.E27.4868 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\20.exe - Suspected MaliciousScope:GENERIC.MALWARE.4
C:\Documents and Settings\Uhthn\Desktop\桌面\21.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\22.exe - Suspected MaliciousScope:GENERIC.MALWARE.4
C:\Documents and Settings\Uhthn\Desktop\桌面\23.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\24.exe - Infected TROJAN-PSW.ONLINEGAMES.126 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\25.exe - Suspected MaliciousScope:GENERIC.MALWARE.4

27 Files scanned
19 Infected files found
8 Suspected files found
0 Files disinfected
19 Files deleted

显示全部楼层 · 发表于 2007-11-19 22:05:04

江民22

显示全部楼层 · 发表于 2007-11-19 23:10:44

都是网游木马

显示全部楼层 · 发表于 2007-11-19 23:47:00

已刪除: 特洛伊木馬程式 Trojan.Win32.KillAV.ge 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/0.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqi 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/1.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqh 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/2.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.idj 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/3.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqh 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/4.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iaw 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/5.exe//NSPack//PE_Patch
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.axx 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/6.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.axx 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/7.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqh 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/10.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqh 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/11.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqh 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/12.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqh 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/13.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqh 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/14.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqh 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/15.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqh 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/16.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.Nilage.bty 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/17.exe//NSPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqh 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/18.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.Nilage.bty 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/19.exe//NSPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqh 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/21.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hqh 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/23.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hzt 檔案: C:\Documents and Settings\kato9096\桌面\1119.rar/24.exe//PE_Patch//UPack

21个,6个没报,已上报

显示全部楼层 · 发表于 2007-11-20 00:17:08

Hello,

20.exed, 22.exed, 25.exed - Trojan-PSW.Win32.OnLineGames.idj,
8.exed - Trojan-PSW.Win32.OnLineGames.iet,
9.exed - Trojan-PSW.Win32.OnLineGames.iep,
Setup.exed - Virus.Win32.VB.hz

These files are already detected. Please update your antivirus bases.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.idj 檔案: C:\Documents and Settings\kato9096\桌面\158740\1119\20.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.idj 檔案: C:\Documents and Settings\kato9096\桌面\158740\1119\22.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.idj 檔案: C:\Documents and Settings\kato9096\桌面\158740\1119\25.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iet 檔案: C:\Documents and Settings\kato9096\桌面\158740\1119\8.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iep 檔案: C:\Documents and Settings\kato9096\桌面\158740\1119\9.exe//PE_Patch//UPack
已刪除: 病毒 Virus.Win32.VB.hz 檔案: C:\Documents and Settings\kato9096\桌面\158740\1119\Setup.exe

[ 本帖最后由 kato9096 于 2007-11-20 00:20 编辑 ]

显示全部楼层 · 发表于 2007-11-20 05:52:05

very thx

显示全部楼层 · 发表于 2007-11-20 11:32:14

Roboon：整天发这么大的

显示全部楼层 · 发表于 2007-11-20 13:14:04

费尔，27个，哈哈，牛死了

显示全部楼层 · 发表于 2007-11-20 14:26:43

用今天的病毒库查昨天的样本？？
我从来不查昨天的，就用当天的病毒库查杀今天发的帖子

显示全部楼层 · 发表于 2007-11-20 16:48:28

原帖由 Graybird 于 2007-11-19 21:40 发表
卡巴和红伞都没报Setup.exe~

The file 'Setup.exe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Dldr.Hiker. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.