13个样本,7个FS查杀,6个Anubis沙盘分析为risk

lanvin

FS不多说了,Anubis的介绍请看我的blog
http://hi.baidu.com/tomatolabs

gwazy

Begin scan in 'C:\Documents and Settings\gwazy\桌面\11.22.zip'
C:\Documents and Settings\gwazy\桌面\11.22.zip
  [0] Archive type: ZIP
  --> 11.22/11.22_1.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 11.22/11.22_2.exe
      [DETECTION] Is the Trojan horse TR/Conime.8192
  --> 11.22/11.22_3.exe
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> 11.22/11.22_4.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 11.22/11.22_5.exe
      [DETECTION] Is the Trojan horse TR/Agent.cue
  --> 11.22/11.22_6.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hwt
  --> 11.22/11.22_7.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 11.22/11.22_9.exe
      [DETECTION] Is the Trojan horse TR/Agent.2560.156
  --> 11.22/11.22_10.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Small.PD.5 Backdoor server programs
  --> 11.22/11.22_11.exe
      [DETECTION] Is the Trojan horse TR/Agent.6656.142
  --> 11.22/11.22_12.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 11.22/11.22_13.exe
      [DETECTION] Is the Trojan horse TR/Agent.4096.151
      [WARNING]   The file was ignored!


End of the scan: 2007年11月22日  17:54
Used time: 00:13 min

The scan has been done completely.

      0 Scanning directories
     15 Files were scanned
     12 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

剑指七星

10个

已删除: 木马程序 Trojan-Downloader.Win32.Delf.cqv        文件: F:\11[1].22.zip/11.22/11.22_1.exe
已删除: 木马程序 Trojan-Downloader.Win32.Small.eyz        文件: F:\11[1].22.zip/11.22/11.22_2.exe//UPX
已删除: 木马程序 Trojan-Downloader.Win32.Tibs.py        文件: F:\11[1].22.zip/11.22/11.22_3.exe
已删除: 病毒 Packed.Win32.PolyCrypt.b        文件: F:\11[1].22.zip/11.22/11.22_4.exe//PE_Patch.Poly
已删除: 木马程序 Trojan.Win32.Agent.cue        文件: F:\11[1].22.zip/11.22/11.22_5.exe//FSG
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.hwt        文件: F:\11[1].22.zip/11.22/11.22_6.exe//UPack
已删除: 木马程序 Trojan-Downloader.Win32.Delf.vw        文件: F:\11[1].22.zip/11.22/11.22_7.exe
已删除: 病毒 Heur.Invader (变种)        文件: F:\11[1].22.zip/11.22/11.22_10.exe//PE-Crypt.PNH
已删除: 病毒 Heur.Invader (变种)        文件: F:\11[1].22.zip/11.22/11.22_11.exe
已删除: 病毒 Heur.Downloader (变种)        文件: F:\11[1].22.zip/11.22/11.22_13.exe

taiw_1144

微点七个报已知，三个报未知二个打不开，最后那个11.22_13.exe双击后，在C:\windows\system32下生成newmaxxsv234.exe后报未知，木马被删除，但11.22_13.exe未删，日志如下：

[ 本帖最后由 taiw_1144 于 2007-11-22 19:56 编辑 ]

sam.to

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.cqv    檔案: C:\Documents and Settings\kato9096\桌面\160231\11.22\11.22_1.exe
已隔離: 病毒 Heur.Invader (修改)    檔案: C:\Documents and Settings\kato9096\桌面\160231\11.22\11.22_10.exe//PE-Crypt.PNH
已隔離: 病毒 Heur.Invader (修改)    檔案: C:\Documents and Settings\kato9096\桌面\160231\11.22\11.22_11.exe
已隔離: 病毒 Heur.Downloader (修改)    檔案: C:\Documents and Settings\kato9096\桌面\160231\11.22\11.22_13.exe
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.eyz    檔案: C:\Documents and Settings\kato9096\桌面\160231\11.22\11.22_2.exe//UPX
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Tibs.py    檔案: C:\Documents and Settings\kato9096\桌面\160231\11.22\11.22_3.exe
已刪除: 病毒 Packed.Win32.PolyCrypt.b    檔案: C:\Documents and Settings\kato9096\桌面\160231\11.22\11.22_4.exe//PE_Patch.Poly
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.cue    檔案: C:\Documents and Settings\kato9096\桌面\160231\11.22\11.22_5.exe//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hwt    檔案: C:\Documents and Settings\kato9096\桌面\160231\11.22\11.22_6.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.vw    檔案: C:\Documents and Settings\kato9096\桌面\160231\11.22\11.22_7.exe


因为有三个变种,所以已把样本上报

sam.to

Hello,

11.22_10.exe - Trojan-Downloader.Win32.Small.gtc,
11.22_11.exe - Trojan-Downloader.Win32.Small.gta,
11.22_9.exe - Trojan-Downloader.Win32.Small.gtb

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

11.22_12.exe, 11.22_13.exe

No malicious code were found in these files.

11.22_8.exe

This file is corrupted.

Please quote all when answering.

--
Best regards, Ermilov Maxim
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

jeremy600832

瑞星病毒查杀结果报告

清除病毒种类列表：8
病毒： Trojan.DL.Win32.Direct.ko
病毒： Trojan.Clicker.Win32.Agent.adg
病毒： Trojan.Win32.Mnless.zfq  
病毒： Packer.RyCrypt           
病毒： Worm.Win32.DiskGen.p     
病毒： Trojan.PSW.Win32.XYOnline.sf
病毒： Trojan.DL.Delf.xxb      
病毒： Trojan.DL.Small.vai      

MAC 地址：00:0F:EA:6C:08:F1

用户来源：局域网

软件版本：20.19.32

Graybird

The file '11.22_8.exe' has been determined to be 'DAMAGED FILE (UNKNOWN)'. In particular this means that this file is damaged and not working properly. We could not find any malicious content. However the heuristic detection module may still detect this particular file even though it is damaged. In that case we will not adjust and remove detection for this damaged file.

傻猪猪米走鸡

D:\firefox download\11.22.zip ?ZIP ?11.22/11.22_1.exe - Win32/TrojanDownloader.Delf.NHL 特洛伊木马 的变种
D:\firefox download\11.22.zip ?ZIP ?11.22/11.22_2.exe - 可能是 Win32/TrojanDownloader.Small 特洛伊木马 的变种
D:\firefox download\11.22.zip ?ZIP ?11.22/11.22_3.exe - 未查明的 NewHeur_PE 病毒
D:\firefox download\11.22.zip ?ZIP ?11.22/11.22_6.exe - Win32/PSW.OnLineGames.FDY 特洛伊木马 的变种
D:\firefox download\11.22.zip ?ZIP ?11.22/11.22_7.exe - Win32/TrojanDownloader.SMW.A 特洛伊木马
D:\firefox download\11.22.zip ?ZIP ?11.22/11.22_9.exe - 未查明的 NewHeur_PE 病毒
D:\firefox download\11.22.zip ?ZIP ?11.22/11.22_13.exe - Win32/TrojanDownloader.Small.NEC 特洛伊木马 的变种

欠妳緈諨

8