下载者及产物共12个

promised

http://web.freewebhtm.com/soft/versoft.exe
http://web.freewebhtm.com/soft/1.exe
http://web.freewebhtm.com/soft/2.exe
http://web.freewebhtm.com/soft/3.exe
http://web.freewebhtm.com/soft/4.exe
http://web.freewebhtm.com/soft/5.exe
http://web.freewebhtm.com/soft/test.exe

[ 本帖最后由 promised 于 2007-12-1 12:27 编辑 ]

promised

C:\ABC\KVMonXP071022.exe - 特征码 'Trojan-Spy.Win32.Delf.PD' 被发现
C:\ABC\use071022.dll - 特征码 'Trojan-Downloader.Win32.Delf.bcm' 被发现
C:\ABC\user32.dll - 特征码 'Virus.Win32.Delf.ECV' 被发现
C:\ABC\x\tool\1.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\x\tool\3.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\x\tool\nlook.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\x\tool\npptools.dll - 特征码 'Win32.SuspectCrc' 被发现
C:\ABC\x\tool\nslookupi.exe - 特征码 'Trojan-PWS.Win32.Agent.jp' 被发现
C:\ABC\x\tool\ntsokele.exe - 特征码 'Trojan.Win32.StartPage.aph' 被发现
C:\ABC\x\tool\RichDll.dll - 特征码 'Trojan-PWS.Win32.Small.br' 被发现
C:\ABC\x\tool\rundl132.exe - 特征码 'Worm.Win32.Viking.lj' 被发现
C:\ABC\x\tool\test.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现

[ 本帖最后由 promised 于 2007-12-1 12:34 编辑 ]

promised

C:\ABC\x\tool.rar
        C:\ABC\x\tool.rar\tool\1.exe
>>> Virus 'Mal/Packer' found in file C:\ABC\x\tool.rar\tool\1.exe
        C:\ABC\x\tool.rar\tool\3.exe
>>> Virus 'Mal/Packer' found in file C:\ABC\x\tool.rar\tool\3.exe
        C:\ABC\x\tool.rar\tool\nlook.exe
>>> Virus 'Mal/Dorf-A' found in file C:\ABC\x\tool.rar\tool\nlook.exe
        C:\ABC\x\tool.rar\tool\npptools.dll
        C:\ABC\x\tool.rar\tool\nslookupi.exe
C:\ABC\kvmon.rar
        C:\ABC\kvmon.rar\KVMonXP071022.exe
>>> Virus 'Mal/Behav-052' found in file C:\ABC\kvmon.rar\KVMonXP071022.exe
        C:\ABC\kvmon.rar\use071022.dll
>>> Virus 'Mal/Generic-A' found in file C:\ABC\kvmon.rar\use071022.dll
        C:\ABC\kvmon.rar\user32.dll
>>> Virus 'Mal/Heuri-E' found in file C:\ABC\kvmon.rar\user32.dll
>>> Virus 'Mal/Packer' found in file C:\ABC\x\tool.rar\tool\nslookupi.exe
        C:\ABC\x\tool.rar\tool\ntsokele.exe
>>> Virus 'Mal/Generic-A' found in file C:\ABC\x\tool.rar\tool\ntsokele.exe
        C:\ABC\x\tool.rar\tool\RichDll.dll
>>> Virus 'Mal/Packer' found in file C:\ABC\x\tool.rar\tool\RichDll.dll
        C:\ABC\x\tool.rar\tool\rundl132.exe
        C:\ABC\x\tool.rar\tool\rundl132.exe\FILE:0000
>>> Virus 'Mal/Packer' found in file C:\ABC\x\tool.rar\tool\rundl132.exe\FILE:0000
>>> Virus 'Mal/Behav-053' found in file C:\ABC\x\tool.rar\tool\rundl132.exe
        C:\ABC\x\tool.rar\tool\test.exe
>>> Virus 'Mal/Behav-152' found in file C:\ABC\x\tool.rar\tool\test.exe

Graybird

Starting the file scan:

Begin scan in 'E:\tool.rar'
E:\tool.rar
  [0] Archive type: RAR
  --> tool\1.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.AF.2
  --> tool\3.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.alh.25 Backdoor server programs
  --> tool\nlook.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
  --> tool\nslookupi.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.alh.25 Backdoor server programs
  --> tool\ntsokele.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Kolmat.B.25 Backdoor server programs
  --> tool\RichDll.dll
      [DETECTION] Is the Trojan horse TR/PSW.Delf.AF.2
  --> tool\rundl132.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.AF.2
  --> tool\test.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
      [INFO]      The file was deleted!
Begin scan in 'E:\kvmon.rar'
E:\kvmon.rar
  [0] Archive type: RAR
  --> KVMonXP071022.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Delf.cqo
  --> use071022.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Delf.cqo
  --> user32.dll
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年12月1日  12:18
Used time: 00:19 min

The scan has been done completely.

      0 Scanning directories
     14 Files were scanned
     11 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      2 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      2 Archives were scanned
      0 Warnings
      0 Notes

残缺的唯美

C:\Documents and Settings\Administrator\桌面\kvmon.rar » RAR » KVMonXP071022.exe - probably a variant of Win32/Genetik trojan - was a part of the deleted object
C:\Documents and Settings\Administrator\桌面\kvmon.rar - probably a variant of Win32/Genetik trojan - deleted - quarantined
C:\Documents and Settings\Administrator\桌面\tool.rar » RAR » tool\1.exe - probably a variant of Win32/Viking virus - was a part of the deleted object
C:\Documents and Settings\Administrator\桌面\tool.rar » RAR » tool\3.exe - Win32/Agent.NEM trojan - was a part of the deleted object
C:\Documents and Settings\Administrator\桌面\tool.rar » RAR » tool\nlook.exe - a variant of Win32/Agent.NLW trojan - was a part of the deleted object
C:\Documents and Settings\Administrator\桌面\tool.rar » RAR » tool\nslookupi.exe - Win32/Agent.NEM trojan - was a part of the deleted object
C:\Documents and Settings\Administrator\桌面\tool.rar » RAR » tool\ntsokele.exe - Win32/Delf.NGD trojan - was a part of the deleted object
C:\Documents and Settings\Administrator\桌面\tool.rar » RAR » tool\RichDll.dll - Win32/Viking.LU virus - was a part of the deleted object
C:\Documents and Settings\Administrator\桌面\tool.rar » RAR » tool\rundl132.exe - Win32/Viking.LU virus - was a part of the deleted object
C:\Documents and Settings\Administrator\桌面\tool.rar » RAR » tool\test.exe - a variant of Win32/PSW.WOW.WU trojan - was a part of the deleted object
C:\Documents and Settings\Administrator\桌面\tool.rar - multiple threats - deleted - quarantined

NobleT

-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.2
Virus signature file from: 2007-12-1, 2:36

Scan name: [Custom Scan]
Path to scan: F:\|

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2007-12-1, 12:30:30
---------------------------------------------------------------------

[Clean]        Boot sector on drive F:
[Clean]        Boot sector on drive E:
[Clean]        Boot sector on drive D:
[Clean]        Boot sector on drive G:
[Clean]        Boot sector on drive C:
[Clean]        Master Boot Record on disk 0
[Clean]        F:\alh_000011.JPG
[Clean]        F:\alh_000033.JPG
[Clean]        F:\alh_000044.JPG
[Clean]        F:\alh_000055.JPG
[Clean]        F:\alh_000066.JPG
[Clean]        F:\antiLeech.dll
[Found backdoor]         <W32/Agent.B.gen!Eldorado (not disinfectable, generic)>        F:\kvmon.rar->KVMonXP071022.exe
[Clean]        F:\kvmon.rar->use071022.dll
[Clean]        F:\kvmon.rar->user32.dll
[Contains infected objects]        F:\kvmon.rar
[Quarantined]        F:\kvmon.rar->user32.dll
[Clean]        F:\LFS_S2W_KeyGen.exe
[Clean]        F:\RECYCLER\S-1-5-21-746137067-725345543-839522115-1003\desktop.ini
[Clean]        F:\RECYCLER\S-1-5-21-746137067-725345543-839522115-1003\INFO2
[Found virus]         <W32/Viking.3!Generic (not disinfectable)>        F:\tool.rar->tool\1.exe->(embedded)
[Found downloader]         <W32/Agent.GYM (exact, not disinfectable)>        F:\tool.rar->tool\3.exe
[Found Trojan]         <W32/Trojan.CCJM (exact, not disinfectable)>        F:\tool.rar->tool\nlook.exe->(embedded)
[Clean]        F:\tool.rar->tool\npptools.dll
[Found backdoor]         <W32/Backdoor.BQTM (exact, not disinfectable)>        F:\tool.rar->tool\nslookupi.exe
[Found backdoor]         <W32/Backdoor.ARBR (exact, not disinfectable)>        F:\tool.rar->tool\ntsokele.exe
[Found worm]         <W32/Worm.HEB (exact, not disinfectable)>        F:\tool.rar->tool\RichDll.dll
[Found virus]         <W32/Viking.3!Generic (not disinfectable)>        F:\tool.rar->tool\rundl132.exe
[Found Trojan]         <W32/Trojan.CCJM (exact, not disinfectable)>        F:\tool.rar->tool\test.exe->(embedded)->(embedded)
[Contains infected objects]        F:\tool.rar
[Quarantined]        F:\tool.rar->tool\test.exe->(embedded)->(embedded)
[Clean]        F:\存档\fdgvd.sav
[Clean]        F:\存档\Hroll\playersave\commondt.sav
[Clean]        F:\存档\Hroll\playersave\playersave
[Clean]        F:\存档\Hroll\playersave2\commondt.sav
[Clean]        F:\存档\Hroll\playersave2\playersave

---------------------------------------------------------------------
Scan ended:        2007-12-1, 12:30:42
Duration:        0:00:12

Scan result:

Scanned files:                 22
Infected objects:         9
Disinfected objects:         0
Quarantined files:         2

IllusionWing

全K

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.5.5
HC0.rlb = 3.1.0
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\KVMonXP071022.exe 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\use071022.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\user32.dll 检测到 Generic.nFile
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\tool\1.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\tool\3.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\tool\nlook.exe 检测到 Packed.Generic.Modified
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\tool\npptools.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\tool\nslookupi.exe 检测到 Generic.nFile
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\tool\ntsokele.exe 检测到 Trojan.Agent.adr
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\tool\RichDll.dll 检测到 Packed.Generic.UPack
[扫描] [捆绑检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\tool\rundl132.exe 检测到 Generic.Binder
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\tool\test.exe 检测到 Packed.Generic.UPack
检测到了 11 个未知的恶意程序，请上报。
任务 扫描 完成。共耗费的时间：0-00-00 00:00:00:0080，共扫描的文件数量：12，共扫描到的威胁数量：12，威胁率：100%，扫描速率： 150 文件/秒，扫描速度： 6721.28 千字节/秒，共扫描了 537.7 千字节。

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\kvmon.rar'
C:\Users\morgan\Documents\
  kvmon.rar
    [0] Archive type: RAR
      --> KVMonXP071022.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
              [WARNING]   Infected files in archives cannot be repaired!
    --> use071022.dll
        [DETECTION] Is the Trojan horse TR/Dldr.Delf.cqo
        [WARNING]   Infected files in archives cannot be repaired!
    --> user32.dll
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
      [WARNING]   The file was ignored!

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\tool.rar'
C:\Users\morgan\Documents\
  tool.rar
    [0] Archive type: RAR
      --> tool\1.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: RSRC
            --> Object
      --> tool\3.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
          --> Object
          --> Object
          --> Object
          --> Object
              [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.alh.25 Backdoor server programs
              [WARNING]   Infected files in archives cannot be repaired!
      --> tool\nlook.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
              [WARNING]   Infected files in archives cannot be repaired!
    --> tool\npptools.dll
    --> tool\nslookupi.exe
        [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.alh.25 Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
    --> tool\ntsokele.exe
        [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Kolmat.B.25 Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
      --> tool\RichDll.dll
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.Delf.AF.2
            [WARNING]   Infected files in archives cannot be repaired!
      --> tool\rundl132.exe
        [1] Archive type: RSRC
        --> Object
      --> tool\test.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      [WARNING]   The file was ignored!


End of the scan: 2007年11月30日  20:39
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
     10 Files were scanned
      8 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      7 Archives were scanned
      6 Warnings
      0 Notes

wangfeng66

DRWEB4.44  漏掉一只npptools.dll   其它全灭

sam.to

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.cqn        檔案: C:\Documents and Settings\kato9096\桌面\tool\KVMonXP071022.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.cqo        檔案: C:\Documents and Settings\kato9096\桌面\tool\use071022.dll
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.gfe        檔案: C:\Documents and Settings\kato9096\桌面\tool\user32.dll
已刪除: 特洛伊木馬程式 Trojan-Dropper.Win32.Agent.bou        檔案: C:\Documents and Settings\kato9096\桌面\tool\tool\1.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-Dropper.Win32.Agent.aqq        檔案: C:\Documents and Settings\kato9096\桌面\tool\tool\3.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.blm        檔案: C:\Documents and Settings\kato9096\桌面\tool\tool\nlook.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Backdoor.Win32.Agent.alh        檔案: C:\Documents and Settings\kato9096\桌面\tool\tool\nslookupi.exe//UPack
已刪除: 特洛伊木馬程式 Backdoor.Win32.Kolmat.b        檔案: C:\Documents and Settings\kato9096\桌面\tool\tool\ntsokele.exe
已刪除: 病毒 Worm.Win32.Viking.lu        檔案: C:\Documents and Settings\kato9096\桌面\tool\tool\RichDll.dll//UPack//PE_Patch
已刪除: 病毒 Worm.Win32.Viking.lw        檔案: C:\Documents and Settings\kato9096\桌面\tool\tool\rundl132.exe
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.axx        檔案: C:\Documents and Settings\kato9096\桌面\tool\tool\test.exe//UPack


一个不报,已上报