某贴暗号下载者下的黑洞和盗Q[MD5: CA7675 55FD36 3DF26C FE3BE1 08ED3C]

SONGBOWEN

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\样本.rar
  [0] Archive type: RAR
  --> atmQQ2.dll
      [DETECTION] Is the Trojan horse TR/PSW.Steal.21910
  --> add.exe
      [DETECTION] Is the Trojan horse TR/Drop.AtomPSW
  --> brc_Server.dll
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Blackhole.AU Backdoor server programs
  --> brc_Server.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING]   The file was ignored!
红伞再次报壳……


检测到：木马程序 Trojan-PSW.Win32.QQPass.ajz        文件: C:\Documents and Settings\Administrator\桌面\样本.rar/atmQQ2.dll
检测到：木马程序 Trojan-PSW.Win32.QQPass.ajz        文件: C:\Documents and Settings\Administrator\桌面\样本.rar/add.exe
检测到：木马程序 Backdoor.Win32.BlackHole.au        文件: C:\Documents and Settings\Administrator\桌面\样本.rar/brc_Server.dll
检测到：木马程序 Backdoor.Win32.BlackHole.au        文件: C:\Documents and Settings\Administrator\桌面\样本.rar/brc_Server.exe

野马

这么大的个头，可惜微点都已知

SONGBOWEN

黑洞的DLL都没有经过任何免杀处理？？？
真服了作者了，这样的黑洞，一运行不久就被咔嚓了？

SONGBOWEN

[quote]原帖由 风野胤 于 2007-11-24 11:41 发表
4
R:\

wangjay1980

anhao.dll

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.QQPass.ytv
病毒： Trojan.PSW.Win32.QQPass.ywn
病毒： Backdoor.Win32.BlackHole.ds
病毒： Backdoor.Win32.BlackHole.ea

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.19.52

rest1min

KV2008杀掉4个。

biaobiao

应该告诉雪落，有人用他软件干坏事呵呵

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 977
Paranoia Database - 49098
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder

C:\Documents and Settings\Uhthn\Desktop\New Folder\atmQQ2.dll - Infected MaliciousScope:WIN32.GENERIC.MALWARE.BCE.5586 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\add.exe - Infected WIN32.GENERIC.MALWARE.E5D.EE7A - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\brc_Server.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.A - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\brc_Server.exe - Infected WIN32.BACKDOOR.BLACKHOLE.1 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\anhao.dll - Suspected WIN32.TROJAN-DROPPER.RIME.2

5 Files scanned
4 Infected files found
1 Suspected files found
0 Files disinfected
4 Files deleted

wjzhhr

倒，我运行了，今天 升级小红伞才发现，有点郁闷。