24个样本解压后扫描此包会引起小红伞V8扫描器崩溃

显示全部楼层 · 发表于 2007-11-29 12:34:07

那你的V8扫出来了几个？把报告发上来看看

显示全部楼层 · 发表于 2007-11-29 12:58:17

确实会这样，已经向官方反应

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\s'
C:\Users\morgan\Documents\s\s\
  a1.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
   [INFO]    The file was deleted!
  a10.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Contains suspicious code HEUR/Malware
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  a11.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.itq
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  a12.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iza
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  a13.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  a14.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iuw
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  a15.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
   [INFO]    The file was deleted!
  a16.exe
[0] Archive type: Runtime Packed
--> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.ikc
      [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  a17.exe
   [WARNING] An exception has been identified!
   [WARNING] In the module 'avcore.dll' an exception occured.
Calling the function AVEPROC_TestFile in file: \\?\C:\Users\morgan\Documents\s\s\a17.exe
Error description:ACCESS_VIOLATION
  EAX = 00000003  EBX = 000E0013
  ECX = 000E0012  EDX = 00000002
  ESI = 385D83E7  EDI = 03723e63
  EIP = 015E890A  EBP = 02B7EBE0
  ESP = 02B7EBD8  Flg = 00010202
  CS = 00000023 SS = 0000001B
  a18.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iso
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  a19.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/FWDisable.22884
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  a2.exe
[0] Archive type: Runtime Packed
--> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.iqw
      [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  a20.exe
   [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
   [INFO]    The file was deleted!
  a21.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/Spy.Gen
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  a22.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
   [INFO]    The file was deleted!
  a23.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/FWDisable.24932
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  a3.exe
[0] Archive type: RSRC
--> Object
   [INFO]    The file was deleted!
  a4.exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
   [INFO]    The file was deleted!
  a5.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/Spy.Gen
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  a7.exe
[0] Archive type: RSRC
--> Object
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
      [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  a8.exe
   [DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
   [INFO]    The file was deleted!
  a9.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ijw
         [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!
  aTxHMoU.Exe
   [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
   [INFO]    The file was deleted!
  aupxdnd.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [INFO]    The file was deleted!

End of the scan: 2007年11月28日  20:57
Used time: 00:08 min

The scan has been done completely.

   2 Scanning directories
   24 Files were scanned
   20 viruses and/or unwanted programs were found
   3 Files were classified as suspicious:
   23 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   4 Files not concerned
   15 Archives were scanned
   15 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-11-29 13:01:47

有些杀毒软件扫描后有可能会出问题，这是引擎的问题。比如rising，有时用它扫描就会自己瘫痪掉……

显示全部楼层 · 发表于 2007-11-29 14:13:59

kis7.0
28个

显示全部楼层 · 发表于 2007-11-29 14:19:13

微点砍掉

木马名称:Backdoor.Win32.Delf.caa
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A20.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.Agent.mly
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A7.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A1.EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A2.EXE
木马程序生成以下文件:
1) C:\WINDOWS\GENPROTECT.EXE
2) C:\WINDOWS\SYSTEM32\GENPROTECT.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A3.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYLOADER.EXE
2) C:\WINDOWS\SYSTEM32\LYLOADER.EXE
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYMANGR.DLL
4) C:\WINDOWS\SYSTEM32\LYMANGR.DLL
5) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MSDEG32.DLL
6) C:\WINDOWS\SYSTEM32\MSDEG32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A5.EXE
木马程序生成以下文件:
1) C:\WINDOWS\UPXDND.EXE
2) C:\WINDOWS\SYSTEM32\UPXDND.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A8.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\DKSBKQXDLR.DLL
2) C:\WINDOWS\SYSTEM32\ASVZHUZHU32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A9.EXE
1) C:\DFD15341843.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A10.EXE
木马程序生成以下文件:
1) C:\WINDOWS\CMDBCS.EXE
2) C:\WINDOWS\SYSTEM32\CMDBCS.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A11.EXE
1) C:\DFD15384265.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A12.EXE
1) C:\DFD15399609.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A13.EXE
木马程序生成以下文件:
1) C:\WINDOWS\391231M.EXE
2) C:\WINDOWS\391231MM.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A14.EXE
1) C:\DFD15430265.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A17.EXE
木马程序生成以下文件:
1) C:\WINDOWS\MSPRINT32D.EXE
2) C:\WINDOWS\SYSTEM32\MSPRINT32D.DLL
是否删除木马程序及其衍生物?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\AUPXDND.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\ATXHMOU.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\TXHMOU.EXE
2) C:\SOS.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A23.EXE
1) C:\DFD15628468.BAT
是否删除可疑程序?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A22.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\DJRYJRXEMTAG.DLL
2) C:\WINDOWS\SYSTEM32\AMPVSTQJ32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A21.EXE
木马程序生成以下文件:
1) C:\WINDOWS\391231L.EXE
2) C:\WINDOWS\391231WL.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A19.EXE
1) C:\DFD15679718.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A18.EXE
1) C:\DFD15691734.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S[1]\S\A16.EXE
1) C:\DFD15704484.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

显示全部楼层 · 发表于 2007-11-29 16:53:51

Roboon：微点只漏了几个。

显示全部楼层 · 发表于 2007-11-29 16:57:10

杀省5个四个exe 一个 dll

病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\aTxHMoU.Exe中 Win32.Troj.Autorun.56832 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a9.exe中 Win32.Troj.AgentT.fm.14452 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a8.exe中 Win32.Troj.OnlineGames .av.110592 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a7.exe中 Win32.TrojDownloader.Agent.61440 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a5.exe中 Win32.Troj.OnLineGamesT.gr.2637 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a4.exe中 Win32.Hack.Huigezi.mk.14848 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a23.exe中 Win32.Troj.AgentT.fm.14452 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a22.exe中 Win32.Troj.OnlineGames.av.102400 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a21.exe中 Win32.PSWTroj.OnLineGames.49664 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a20.exe中 Win32.Packed.MaskPE 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a19.exe中 Win32.Troj.AgentT.fm.14452 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a18.exe中 Win32.Troj.AgentT.fm.14452 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a17.exe中 Win32.Troj.OnLineGamesT.gr.2637 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a16.exe中 Win32.Troj.AgentT.fm.14452 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a14.exe中 Win32.Troj.AgentT.fm.14452 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a12.exe中 Win32.Troj.AgentT.fm.14452 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a11.exe中 Win32.Troj.AgentT.fm.14452 处理成功（操作：删除）
病毒 2007-11-29  16:55:43 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a10.exe中 Win32.Troj.OnLineGamesT.gr.2637 处理成功（操作：删除）
病毒 2007-11-29  16:55:41 病毒在文件C:\Documents and Settings\Norways Winter\桌面\s[1]\s\a1.exe中 Win32.Packed.MaskPE 处理成功（操作：删除）

显示全部楼层 · 发表于 2007-11-29 20:04:14

bug 已修复 :-)
24个全杀~

显示全部楼层 · 发表于 2007-11-29 20:24:42

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Mnless.zub
病毒： Trojan.PSW.Win32.GameOnline.amm
病毒： Trojan.PSW.Win32.QQHX.tsf
病毒： Trojan.PSW.Win32.XYOnline.ui
病毒： Trojan.PSW.Win32.LMir.yzb
病毒： Trojan.PSW.Win32.GameOnline.aqo
病毒： Trojan.PSW.Win32.QQHX.tsg
病毒： Trojan.PSW.Win32.GameOnline.ana
病毒： Trojan.PSW.Win32.QQSG.an
病毒： Trojan.PSW.Win32.TLOnline.jjs
病毒： Trojan.PSW.Win32.GameOnline.ars
病毒： Trojan.PSW.Win32.GameOnline.asy
病毒： Trojan.Win32.Mnless.zhs
病毒： Trojan.PSW.Win32.Woool.c
病毒： Trojan.PSW.Win32.GameOnline.anx
病毒： Trojan.PSW.Win32.GameOnline.arq
病毒： Trojan.DL.Delf.xxb
病毒： Trojan.PSW.Win32.GameOnline.art
病毒： Trojan.DL.Win32.Agent.yrh
病毒： Trojan.PSW.Win32.WoWar.afr
病毒： Trojan.PSW.Win32.XYOnline.tp
病毒： Trojan.PSW.Win32.GameOnline.art

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.20.32

显示全部楼层 · 发表于 2007-11-29 22:26:07

AVG AV 24ge

[病毒样本] 24个样本解压后扫描此包会引起小红伞V8扫描器崩溃

回复 9楼 gmen_pliskin 的帖子

42/22 老面孔

[病毒样本] 24个样本 解压后扫描此包会引起小红伞V8扫描器崩溃

回复 9楼 gmen_pliskin 的帖子

42/22 老面孔

[病毒样本] 24个样本解压后扫描此包会引起小红伞V8扫描器崩溃